Windows will improve user privacy with DNS over HTTPS
> There is an assumption by many that DNS encryption requires DNS centralization.<p>A lot of the discussion recently, like this statement, conflates "DNS encryption" with "DoH". Encrypting DNS does <i>not</i> require centralization, but <i>DoH does</i> require[1] centralization in in the RFC. DoH doesn't even "improve user privacy"; it simply changes who can record your DNS queries. Instead of the ISP, Cloudflare/Microsoft/etc gets to see your unencrypted DNS queries.<p>The way to actually improve privacy is to perform the recursive resolution locally[2]. The actual communication with each individual DNS server needs to be encrypted, which is where work needs to be done. DNS servers need to support DNS over TLS (DoT) or some other type of encrypted transport. Hypothetically, DoH could be modified to support this, although that seems more complicated than simply wrapping the DNS protocol in TLS.<p>You don't get privacy by centralizing all of your requests onto one server. To protect privacy, you limit the data that any one party can see. DNS was designed for this purpose: only the NS record of a domain needs to be sent to a centralized server, which is easy to cache for a long time. Most requests then go to domain-specified authoritative server[4].<p>It's good to see Microsoft at least trying to address this at the OS level. App doing DNS without involving the OS seems to be more about taking away control from the user. I'm sure Google would love to be able top bypass DNS based adblocking.<p>[1] <a href="https://news.ycombinator.com/item?id=21110296" rel="nofollow">https://news.ycombinator.com/item?id=21110296</a><p>[2] Which is easy: follow NS records until you get to the server that has your authoritative answer.<p>[3] <a href="https://news.ycombinator.com/item?id=21348328" rel="nofollow">https://news.ycombinator.com/item?id=21348328</a>