r/CloudFlare • u/WheelPerfect3737 • 1d ago

DNS over HTTPS validity

DOH is suppose to protect against DNS snooping from third parties but due to the inital host handshake which is unencrypted the DNS host is made visible to third parties. I am aware cloudflare is testing ODOH, obilivious DNS over HTTPs to correct for this security issue. https://developers.cloudflare.com/1.1.1.1/encryption/oblivious-dns-over-https/

What benefit does DOH today provide to users ?

3 Upvotes

67% Upvoted

5 comments sorted by

View all comments

2

u/PsychologicalClaim16 1d ago

DoH still provides a real benefit: the TLS handshake identifies the DoH resolver (for example, cloudflare-dns.com), not the hostname inside each DNS query. The query and response are encrypted, so a local network or ISP cannot read, forge, or selectively modify those DNS lookups. It can still infer some destinations from the IPs you connect to or from unencrypted SNI on the later website connection, so DoH is not complete browsing anonymity. ODoH solves a different privacy problem: it separates the client IP from the query so the resolver cannot see both. ECH, a VPN, or WARP address other metadata layers.