DoH plugin for BIND
kremels at kreme.com
Fri May 1 21:51:15 UTC 2020
On 29 Apr 2020, at 14:19, Tony Finch <dot at dotat.at> wrote:
> DoT is easier since you only need a raw TLS reverse proxy, and there are
> lots of those, for example, nginx:
DOH is better because it cannot be blocked without blocking all https traffic.
(FSVO of better, of course. I am sure there is a vi/emacs space/tab trek/wars religious canonical war here, but being able to guarantee access to secure DNS is definitely better for users).
All that its need to subvert DoT is to block port 853.
If DoT takes off, I expect all US ISPs to block port 853 universally. There’s nothing they can do about DoH.
'You're your own worst enemy, Rincewind,' said the sword. Rincewind
looked up at the grinning men. 'Bet?' --Colour of Magic
More information about the bind-users