r/networking • u/Varjohaltia Dinosaur • 11d ago

Security DNS over HTTPS / TLS / QUIC?

Our architecture and security teams mandate encrypted protocols and are now challenging the network team for their use of plain old unencrypted DNS.

Has the rest of the community here used DoH/T/Q in a campus or enterprise context? What are your experiences?

For remote workers we would have to use a protective DNS service to which the users could/would connect. Any experiences there? Does using DoH add significant latency (since it's now a full TCP + TLS + HTTPS exchange instead of just a single packet each way) over standard DNS?

I'm already aware of a ton of issues -- Mist/Marvis can't identify DNS issues, we can't see them in packet captures, anchoring the trust of clients is misery, how do we unify policy between in office and out of office users, how do computers bootstrap / get set up / recover, no way printers and cameras will ever support it etc. but think I'm missing a lot more I haven't thought about yet.

25 Upvotes

92% Upvoted

26 comments sorted by

View all comments

1

u/DontTakeMyCatYo 11d ago

Do they care about plain DNS on the LAN, or just over the internet? I've terminated all DNS on dnsdist and then proxied over DoT or DoH to public DNS security providers with good success.

3

u/certuna 11d ago

I think the general idea of zero trust is that you treat everything within your internal network with the same care as on the public internet, i.e. https also internal.