Perfect Content and clear explanation! Kudos to you! Please make more of this kinds of technical/conceptual videos related to security topics which are a great help for other IT/Network enthusiastic individuals such as myself!
@@christianlempa consulta cual de los dos es es mejor usar cual recomiendas usar solo dime uno dot o doh cual uso ya que uno de los dos es mejor y lleva la ventaja cual me recomiendas usar para ponerlo en todos mis dispositivos responder lo antes posible porfavor.
My main use case for DNS over TLS OR HTTPS is to prevent my ISP from using things like Transparent DNS proxies to reroute or tamper with my request. Something about them quietly rerouting my DNS request just feel violating you know.
You are addressing HALF of the problem : the "question" (request). What about the "reply" ? What is the packet configuration of the reply ? Does it contain your IP address (in clear) and the IP address of the encrypted url (in clear) ? If so, then... you aren't "protected" since your ISP can reverse lookup the DNS contained in the "reply" packet ! No ?
I did a video about "7 amazing network engineer tools" where wireshark was one of them, that could be interesting for you 😉. However, if more people are requesting I consider making a short series about it.
Thanks for the knowledge. So these techniques still need to be supported by the hosters/sites to make it fully encrypted? I am just wondering if its really better to send the dns query via cloud based providers instead of „trusting/rely“ on your ISP. Probably depends on the country and their laws
Hello Christian, a question; I use Stubby dns on Linux mint, and when using Firefox or LibreWolf after logging in, they do not load, they do not open a first connection; I am forced to go to networks, disconnect and reconnect from the network, and NOW, suddenly they load and no longer fail during the session.... Could anyone tell me why? Thank you so much.
How does the performance impact look here? DNS under 512 bytes is a UDP query, super fast. Most machines cache the results locally, but resolvers usually don't cache. They may have to take more burden of responding to users queries by encrypting, decrypting, additional payload etc., Also I'm not sure if bind daemon supports these protocols as it's widely used.
@@christianlempa I think Christian’s question was “how would my internet provider be able to process my searches if they are unable to view my searches” 🤔
Wouldn’t encrypting your queries with DOH or DOT also protect you from the dns provider itself? I understand that Cloudfare, Nextguard, etc claim not to keep logs but can they initially see all of our traffic?
@@contenteater At some point, they need to be unencrypted: someone must be able to answer the DNS query, or otherwise you won't get a response at all and URLs stop working. This unencryption happens at your DNS resolver. (A late response, I hope it's still useful)
That's right. A lot companies actually disable DoH and DoT because it bypasses the companies DNS and firewalls which is a big problem. It is a challenge for companies, but I think we need to come up with a reliable solution that allows companies, firewall vendors to make use of DoH or DoT, aligned with the companies preferences and security needs. But that's something that is not established well at this stage and it's interesting to see what solution will become the new standard at some day. In networking those changes take usually a long time.
Maybe companies need to embrace the fact that their no longer able to filter user traffic. I have a VPN enabled 24/7 & I know many other people do as well.
Greeting, hope help me. 1- i set my machine network(i donot do any change for router only change my machine) to use "1.0.0.2 & 1.1.1.2" as dns server, they belong to cloudfloar. 2- is that mean all my machine dns quire encrypted (dns over https)? 3- when i go to cloudfloar test page the results was i do not use dns over https. Also when activate the dns over https in Firefox the results was "we do not know if you use dns over https or not". 4- there's any steps i should do beside set machine network to use clodfloar dns server, to be sure i use dns over https? Thanks in advance
Question: Considering android 9 pie now incorporates DoT configuration, browsers like Bromite incorporating DoH and DNS providers like Quad9 providing free encrypted options for both... is it possible/beneficial to use both simultaneously...? On android mobile or tablet devices
Thanks 😊. One of the problems when browsers or applications implement their own DNS resolving technique is that it's independent from the OS DNS resolving. That means your browser will use DoH queries to whatever it uses as a resolver, and other apps will use the DoT queries configured in android. So yes, it can work both and it doesn't interfere each other, but it could be that the browser will use different resolvers like it's configured in the OS. DNS resolvers like Quad9, cloud flare and Google usually support both methods, so that should work fine in this case 😉
I love that 30 hrs ago, that question i asked would've seemed like a totally foreign language to me, and already, so many puzzle pieces regarding internet security, privacy, anonymity and how networks function are all coming together and making sense. That's all thanks to youtubers like you. Thanks for getting back to me and thank you for helping me to understand, much appreciated
How do attackers use the DOH for malicious purposes? Will they use any tool to tunnel the DOH and then applies data exfiltration or they will exploit the server such as Cloudflare, Mozilla and then applies C2 commands.
But doesn't this only hide the URL? Once the URL is resolved to an IP address, isn't that IP address then visible to your ISP, therefore they can still work out exactly what website you are accessing?
Würde ich das Problem lösen, wenn ich einen VPN in meinem Wlan-Netzwerk etabliere und wenn nicht, warum nicht? Besten Dank! - Ich beantworte mal selbst, würde mich aber über Feedback freuen: das Problem entsteht "ausserhalb" meines Netzwerkes und die IP-Adresse wird über die Leitung "einsehbar" so kein TLS über DNS konfiguriert ist. Der VPN kann nur verhindern, dass jemand mein Wlan entert, davon wird das senden der IP ausserhalb des Netzwerkes aber nicht berührt, korrekt?
Doesn't my provider still know which domains I visit? It the provider has a DNS, the provider knows which IPs belong to which domain. So even if my provider does not see the DNS request, once I load a single package from the IP he will still know that I visited the website with that IP. If the DNS knows which IP belongs to which domain, the opposite should als be possible. So I do now really see how my privacy is protected unless I use a VPN. PS: Be careful with Google's DNS servers! Google does not really provide that service for free. They will store all the domains you visited forever to send you even more targeted ads.
Often the IP address does not directly relate to the actual web site you're browsing. Most companies and websites today use CDNs like Akamai or Cloudflare, so you can sometimes compare the address with the name, but not always. Also, you can still see the domain in the HTTP's requests, as it's included in the SNI (not the full path though). But that always works, no matter if you encrypt the DNS requests. So yeah, you're right, a VPN is the only way to really "hide" the traffic from your ISP.
Technically both are sufficient and generally you can use whatever works for you. But I think that DoH is a bit more widespread than DoT in terms of implementation by companies. However, this is still work in progress, there are also other alternatives like DoQ and we'll see what will become the new standard.
Mr.13 why is DoT better than DoH I need the most secure form of DNS and I do not want my ISP spying on me. I don’t mind going the extra step for security.
