Advice Request DoH, DoT, DNSCrypt or DoQ?

[Kongo]

Hey guys,

just wanted to ask you all which of the protocols mentioned above do you prefer and why?

(DNS-over-QUIC is pretty new and only implemented in Adguard as far as I know)

 

[ForgottenSeer 85179]

I prefer the ones which supported by OS / Router / Browser so DoT and DoH

DNSCrypt or similar tools aren't necessary nowadays because of DoT, DoH and upcoming DoQ

 

[silversurfer]

My choice is DoT for a simple reason it's supported to setup on my router from AVM

 

[Ink]

What are the differences between them?

 

[Kongo]

What are the differences between them?

I think Cloudflare describes it best: https://www.cloudflare.com/learning/dns/dns-over-tls/

 

[HarborFront]

I just tested DoT these two days and I find it really slows down my laptop. After I disabled it my laptop really flies even when running double-hop VPNs

Not sure if even worth the while using it

 

[ForgottenSeer 85179]

running double-hop VPNs

This may the problem here.
Did you try without?

 

[TairikuOkami]

If I could choose, I would in this order (UDP over TCP always).

1. DNS-over-QUIC
2. DNSCrypt
3. DNS-over-TLS
4. DNS-over-HTTPS

DoH is the worst possible option, unfortunately, it is the only thing, that browsers and the next Windows 10 support. It is still better than the default DNS, but ... .

 

[Kongo]

If I could choose, I would in this order (UDP over TCP always).

1. DNS-over-QUIC
2. DNSCrypt
3. DNS-over-TLS
4. DNS-over-HTTPS

DoH is the worst possible option, unfortunately, it is the only thing, that browsers and the next Windows 10 support. It is still better than the default DNS, but ... .

UDP over TCP because it's faster?

 

[HarborFront]

This may the problem here.
Did you try without?

Tested with Adguard VPN for Windows and same results

 

[HarborFront]

If I could choose, I would in this order (UDP over TCP always).

1. DNS-over-QUIC
2. DNSCrypt
3. DNS-over-TLS
4. DNS-over-HTTPS

DoH is the worst possible option, unfortunately, it is the only thing, that browsers and the next Windows 10 support. It is still better than the default DNS, but ... .

DNSCrypt has quit and replaced by DoT

DNSCrypt has quit, but you needn’t worry (UPDATED)

The maintainer of DNSCrypt stopped supporting it, closed the repository on GitHub and put the domain on sale. The repository has already been cloned and is now maintained by Dyne. Unfortunately, they do not plan to add any new features, so DNSCrypt is abandoned in favor of the "DNS over TLS"...

adguard.com

 

[Kongo]

DNSCrypt has quit and replaced by DoT

DNSCrypt has quit, but you needn’t worry (UPDATED)

The maintainer of DNSCrypt stopped supporting it, closed the repository on GitHub and put the domain on sale. The repository has already been cloned and is now maintained by Dyne. Unfortunately, they do not plan to add any new features, so DNSCrypt is abandoned in favor of the "DNS over TLS"...

adguard.com

Isn't it still integrated in Yandex Browser?

 

[HarborFront]

Isn't it still integrated in Yandex Browser?

Not sure for I'm not using Yandex browser

 

[TairikuOkami]

UDP over TCP because it's faster?

Faster and safer, no MITM and other TCP vulnerabilities. Lost UDP packets are the thing of the past anyway. I guess QUIC is the way to go, UDP via 80/443.

How to protect from Malware that abuses DNS over HTTPS or DoH

DNS over HTTPS (DoH) is a protocol to perform remote resolution of the Domain Name System (DNS) over the HTTPS protocol. The proposed standard was

santanderglobaltech.com

 

[ForgottenSeer 85179]

Tested with Adguard VPN for Windows and same results

This is also a VPN

 

[TairikuOkami]

therefore DNS requests must be hidden in HTTPS traffic

Encrypted DNS requests are all private, regardless of which option you choose. ISP will still see, that you are making requests to the particular DNS service, just via https, but ISP will not be able to tell, what you are requesting. DoH is just harder to block, but not impossible, if they wanted to. Still, without VPN, ISP will know to what IPs you have connected, most likely webpages as well. So much for privacy. The main advantage of encrypted DNS is, that they are better protected and can not be easily tampered with, DNSEC can be hijacked.

Against DNSSEC

10 years later and still unrebutted: DNSSEC is pageantry, it's not security, which is why so few security teams deploy it.

sockpuppet.org

recdnsfp by recdnsfp

 

[ForgottenSeer 85179]

The task of DNS encryption is primarily in privacy and therefore DNS requests must be hidden in HTTPS traffic, as is the case with DOH, otherwise you can do with DNSSEC altogether.

DNSSEC isn't for privacy but security