What's the point of DoH/DoT

[nikr]

I've been running Pihole with cloudflare doh proxy for sometime now. While it works ok, I've been considering ditching it for Asus-merlin built in dot with nextdns. But does DoH/DoT makes any difference. My ISP can still see the IPs i am communicating with and can do reverse dns lookup to see what I am doing if they want to and if they dont it does not really matter anyways. I understand it prevents alteration of reply but that can also be accomplished with dnssec.

I know I am missing something, but cannot figure out what..

 

[bbunge]

I've been running Pihole with cloudflare doh proxy for sometime now. While it works ok, I've been considering ditching it for Asus-merlin built in dot with nextdns. But does DoH/DoT makes any difference. My ISP can still see the IPs i am communicating with and can do reverse dns lookup to see what I am doing if they want to and if they dont it does not really matter anyways. I understand it prevents alteration of reply but that can also be accomplished with dnssec.

I know I am missing something, but cannot figure out what..

Much has been written on the topic. Boils down to what level of security or no security you are comfortable with.
This is a bit old but good: https://blog.apnic.net/2018/08/20/dnssec-and-dns-over-tls/
As for me I feel more comfortable using DoT (not DoH) with DNSSEC. We've gotten both built into the Merlin custom firmware for Asus routers.

 

[New2This]

I kinda feel the same way Running Pihole with Unbound, which goes thru VPN tunnel

I'm suspicious of "secure" DNS aka DoH/DoT (vlog) | What the Tech is that

In this video I talk about DNS over HTTPS/TLS and how I don't quite get the benefits of using it, and how it seems like the trade-off of centralizing things makes things worse.

odysee.com

 

[Treadler]

An interview with Bill Woodcock (Quad 9 DNS) here.
He has quite the definite view of DoT vs DoH.
Well worth a read........

DNS privacy, legal enforcement and Quad9: a conversation with Bill Woodcock

Quad9 is a free Domain Name System (DNS) service, focusing on privacy and security. In February 2021, the company reincorporated in Switzerland to provide its users even stronger privacy guarantees. The move was facilitated by SWITCH, a CENTR member and registry for the .ch and .li top level ...

centr.org