DoH: Anti-Competitive and Network Neutrality Aspects
This is a disinformation campaign. DoH doesn&#x27;t centralize DNS or DNS privacy. Anyone can run a DoH resolver server, and it&#x27;ll do just as good a job as Cloud Flare&#x27;s.<p>The people crusading against DoH favor a different centralized DNS standard, DoT. DoT is DoH with essentially one difference, which is that it runs on its own port, so that network operators can block it. There&#x27;s a sprawling cottage industry of security and analytics products that rely on passive DNS analysis to function, and people who sell those products or operate networks that use them have a strong disincentive to block DoT and require users to speak standard, plaintext DNS to servers they can monitor.<p>Note however that once it&#x27;s up and running, DoT is just as centralized as DoH is; it has to be, because it provides the exact same service model. Centralization and competition has nothing to do with their real concerns, or they&#x27;d be lobbying against DoT as well.<p>I can&#x27;t say I&#x27;m especially fond of Firefox&#x27;s decision to default to Cloud Flare for its DoH resolver, because I loathe Cloud Flare. Google Chrome does something more sensible: it won&#x27;t change your DNS server at all, but will upgrade you to DoH if your nameservers support DoH. You should use nameservers that do, because DoH is valuable: if you&#x27;re in the US, your ISP is almost certainly passively monitoring and recording your DNS queries, and you shouldn&#x27;t let them. Personal feelings about Cloud Flare aside, you are better off with them than with your US ISP&#x27;s DNS servers.<p>There&#x27;s a strain of Unix sysadmin criticism against DoH that says it&#x27;s wrong for browsers to co-opt DNS resolution at all, and that they should use the system&#x27;s resolver. This is nonsense. First, almost no matter which browser you use, you should trust their DNS resolution code more than your operating system&#x27;s; it will be more security-conscious and probably more performance-conscious code --- DNS resolution maintenance is the job you get on Microsoft or Apple&#x27;s OS teams to punish you when you break the build. More importantly, as anyone who&#x27;s ever had to mess around with libares will tell you, browsers have always needed better DNS resolution than libc offers, because they need fast async lookups.<p>There&#x27;s another strain of criticism against DoH that Unix nerds won&#x27;t see much of but which is probably even more important to be aware of: there have been hearings in Congress about how DoH threatens law enforcement by depriving them of intelligence for investigations. Ultimately, this is of a kind with the DoT vs. DoH argument: the people lobbying against DoH <i>simply don&#x27;t believe DNS lookups should be private</i>. Another &quot;tell&quot; that you&#x27;re reading one of these people is when they start talking about how DNS privacy doesn&#x27;t provide complete or perfect privacy --- that you shouldn&#x27;t care if your DNS lookups are being monitored, because you&#x27;re leaking so much information elsewhere. This is bamboozlement. DoH privacy is extraordinarily low-effort, actually modernizes the DNS protocol in some ways, and addresses a threat millions of users are directly facing right now.<p>You should be wary of any outlet that promotes the meme that DoH is somehow shady.