Trust?
Trust?
Posted May 30, 2025 21:41 UTC (Fri) by Cyberax (✭ supporter ✭, #52523)In reply to: Trust? by brunowolff
Parent article: System-wide encrypted DNS
It does. It obscures the host name, so mere passive probing is insufficient for reliable detection. The ISP will have to actively probe the target host to find out what it serves, which also fails if it is a multiplexing load balancer.
Moreover, traffic monitoring is an order of magnitude more complex and expensive than just passively snooping on DNS requests. That's because traffic is usually handled completely in the dataplane of routers, and diverting it for inspection is expensive. But diverting a handful of DNS packets per minute for a typical host? That's easy.
So in practice, DoH/DoT will increase the privacy.
