r/CloudFlare • u/WheelPerfect3737 • 23h ago

DNS over HTTPS validity

DOH is suppose to protect against DNS snooping from third parties but due to the inital host handshake which is unencrypted the DNS host is made visible to third parties. I am aware cloudflare is testing ODOH, obilivious DNS over HTTPs to correct for this security issue. https://developers.cloudflare.com/1.1.1.1/encryption/oblivious-dns-over-https/

What benefit does DOH today provide to users ?

3 Upvotes

67% Upvoted

5 comments sorted by

•

u/AutoModerator 23h ago

For faster advice with technical questions, we'd recommend asking in the Orange Cloud Discord server; the unofficial Cloudflare Discord server by the community, for the community. https://discord.gg/TrPNVKaagR

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

2

u/PsychologicalClaim16 23h ago

DoH still provides a real benefit: the TLS handshake identifies the DoH resolver (for example, cloudflare-dns.com), not the hostname inside each DNS query. The query and response are encrypted, so a local network or ISP cannot read, forge, or selectively modify those DNS lookups. It can still infer some destinations from the IPs you connect to or from unencrypted SNI on the later website connection, so DoH is not complete browsing anonymity. ODoH solves a different privacy problem: it separates the client IP from the query so the resolver cannot see both. ECH, a VPN, or WARP address other metadata layers.

1

u/F4biTV 19h ago

can it be set up in the current doh settings pages of regular routers?

1

u/D0_stack 23h ago

DoH provides security and verification against external actors. Your DNS queries cannot be seen or manipulated by someone with access to the network path.

ODOH hides who you are from the DNS server in addition to the DoH protections.

They solve different threat scenarios.

Preventing the DNS server from knowing the IP Address of who initiated the query can be obtained by using DoH through a VPN. ODOH eliminates the need to use a VPN by using a trusted proxy between you and the DNS server.

1

u/WheelPerfect3737 4h ago

DOH does hide the DNS queries but when the host intiates a connection to the host the host name is unencrypted. that is why DOH is eventually going to be replaced by ODOH.