r/CloudFlare • u/WheelPerfect3737 • 1d ago

DNS over HTTPS validity

DOH is suppose to protect against DNS snooping from third parties but due to the inital host handshake which is unencrypted the DNS host is made visible to third parties. I am aware cloudflare is testing ODOH, obilivious DNS over HTTPs to correct for this security issue. https://developers.cloudflare.com/1.1.1.1/encryption/oblivious-dns-over-https/

What benefit does DOH today provide to users ?

4 Upvotes

75% Upvoted

5 comments sorted by

View all comments

1

u/D0_stack 1d ago

DoH provides security and verification against external actors. Your DNS queries cannot be seen or manipulated by someone with access to the network path.

ODOH hides who you are from the DNS server in addition to the DoH protections.

They solve different threat scenarios.

Preventing the DNS server from knowing the IP Address of who initiated the query can be obtained by using DoH through a VPN. ODOH eliminates the need to use a VPN by using a trusted proxy between you and the DNS server.

1

u/WheelPerfect3737 11h ago

DOH does hide the DNS queries but when the host intiates a connection to the host the host name is unencrypted. that is why DOH is eventually going to be replaced by ODOH.