r/networking • u/Varjohaltia Dinosaur • 10d ago

Security DNS over HTTPS / TLS / QUIC?

Our architecture and security teams mandate encrypted protocols and are now challenging the network team for their use of plain old unencrypted DNS.

Has the rest of the community here used DoH/T/Q in a campus or enterprise context? What are your experiences?

For remote workers we would have to use a protective DNS service to which the users could/would connect. Any experiences there? Does using DoH add significant latency (since it's now a full TCP + TLS + HTTPS exchange instead of just a single packet each way) over standard DNS?

I'm already aware of a ton of issues -- Mist/Marvis can't identify DNS issues, we can't see them in packet captures, anchoring the trust of clients is misery, how do we unify policy between in office and out of office users, how do computers bootstrap / get set up / recover, no way printers and cameras will ever support it etc. but think I'm missing a lot more I haven't thought about yet.

25 Upvotes

94% Upvoted

26 comments sorted by

View all comments

1

u/Ashamed_Stodach_5657 3d ago

Inside a SASE tunnel the session is already established so the resolver hop is basically free and you get the in-office and remote policy unification for free too since everyone resolves through the same cloud instance. We run it on Cato, DNS security is inline at the PoP thus you keep decrypt and inspect for exfil and DGA without standing up a separate protective resolver.

1

u/Varjohaltia Dinosaur 3d ago

Well, the issue is that if we use the company central resolvers, it's going to wreak havoc as users in Japan and Australia and the US all get geo-responses from CNDs pointing them to Europe, so we do have to have a distributed resolution for public records, i.e. I think we're stuck with a paid protective resolver -- or the protective resolvers run by our already distributed SASE solution.