# Best of the Hedge: Episode 5 on DoH (Part 1)

An episode of [The Hedge](https://invisiblenetwork.ai/podcast/1473947013), 28 Nov 2025, 28 min.

Audio: https://media.blubrry.com/hedge/content.blubrry.com/hedge/hedge-005.mp3

In this episode of the Hedge, Geoff Huston joins Tom Ammon and Russ White to discuss the ideas behind DNS over HTTPS (DoH), and to consider the implications of its widespread adoption. Is it time to bow to our new overlords? https://media.blubrry.com/hedge/content.blubrry.com/hedge/hedge-005.mp3 download

## Transcript

[0:00] Join us at The Hedge for a conversation
[0:02] about engineering,
[0:03] technology, and business. In this episode, Jeff Houston,
[0:06] Russ White, and Tom Ammon dig into the
[0:09] first part of their discussion of DNS over
[0:11] HTTPS.
[0:24] Good evening, Jeff. I think it's morning for
[0:26] you in Australia because you're upside down.
[0:30] It is morning. I'm on my head, but
[0:32] the sun is out. Yes.
[0:34] What you see above, Jeff, which you can't
[0:36] really see is actually
[0:38] the floor. Just don't tell anybody that.
[0:43] Tom, how are you tonight?
[0:45] I'm doing fine.
[0:47] Good. Good. So
[0:49] This on this episode of the hedge. We're
[0:51] here to talk about dough
[0:52] If you say it real fast 10 times,
[0:54] you'll understand what it means
[0:56] dough
[0:59] DNS over https
[1:01] and, Jeff wrote an article in the Internet
[1:04] Protocol Journal, which was really really good. And
[1:06] by the way, if you don't read the
[1:07] Internet Protocol Journal, you should
[1:10] it's an occasional. I don't know that Olay
[1:13] does, I'm not sure how consistent Olay publishes
[1:15] it. But when it does come out, it
[1:17] generally has very good articles in it like
[1:19] this one by Jeff. It's well worth reading.
[1:22] So, Jeff, talk to us about dough a
[1:24] little bit. Tell us what it is,
[1:27] And then we can back into trying to
[1:29] understand some of the architectural
[1:31] issues and stuff that's going on there
[1:33] Okay, you know, thanks Russ and, good morning.
[1:37] You and John
[1:40] Look,
[1:40] it's one of those really simple acronyms. It's
[1:43] DNS
[1:44] over
[1:46] HTTPS.
[1:48] Now you kinda go It's really Doze.
[1:51] Doze, I suppose, if you stress the s.
[1:54] But these days, HTTP is so yesterday. None
[1:56] of us are allowed to use it. So,
[1:58] you know, as soon as you say HTTP,
[2:00] you mean HTTPS.
[2:04] That sounds innocuous,
[2:06] and
[2:06] to some extent, it is.
[2:10] You might recall various little tools and techniques
[2:14] to get past firewalls going back almost twenty
[2:17] years,
[2:18] where we actually managed to get IP itself
[2:21] stuffed into
[2:23] HTTPS.
[2:24] What's that? IPH, I suppose, is the way
[2:27] you'd like to call it. And doing the
[2:28] DNS in HTTPS
[2:30] is certainly nothing new.
[2:32] And and to that extent, it's sort of,
[2:34] so what?
[2:36] But
[2:37] it became an RFC
[2:39] really quickly,
[2:40] about a year ago, 2018.
[2:43] And the IETF
[2:45] meeting in March
[2:47] 2019
[2:49] had a session to
[2:50] talk about dough, you know, I think we
[2:52] need to talk about dough,
[2:54] and the room was certainly packed.
[2:57] And the conversation was,
[3:00] highly tensioned.
[3:02] There's a lot of feeling about dough.
[3:05] And So it's What's the problem we're trying
[3:07] to solve? I know one problem is
[3:09] people complain about middle boxes,
[3:12] messing around with DNS,
[3:14] and another problem people are fussing about is
[3:16] man in the middle attacks against dns. Right?
[3:18] Those those are kind of
[3:20] Those are my impression of where the problem
[3:22] people. Well, we have to go back to
[3:24] the the I think for the I t
[3:26] f the snowden leaks and those allegations were
[3:29] a defining moment for the IETF.
[3:32] I'm like, they'd had their moments before when
[3:34] they were asked to standardize various, eavesdropping protocols.
[3:38] And, you know, some of the really old
[3:39] gray beards might remember the CALEA fuss.
[3:42] They are whether the IETF was gonna work
[3:45] on standardizing,
[3:47] tapping protocols in in the media gateway controllers.
[3:51] And it goes back further even to Raven?
[3:54] Yeah. All of those old debates. So so
[3:56] up comes
[3:57] up comes Snowden.
[3:59] And what emerges, of course, is this huge
[4:01] amount
[4:02] of
[4:03] state surveillance,
[4:06] in amongst and trying to find some oxygen
[4:08] from all the commercial surveillance that happens anyway.
[4:12] But some of the reactions to this
[4:15] was a long hard look at the IETF
[4:18] standard protocols
[4:20] with the view of saying,
[4:22] if you were a reasonably
[4:25] resourced observer
[4:27] and you had access
[4:29] to wires, to routers, whatever, you had access
[4:31] to infrastructure,
[4:32] how much could you see with not a
[4:34] lot of effort?
[4:36] And, of course, the results are quite surprising.
[4:38] If you're using unencrypted
[4:40] HTTP,
[4:41] there's a huge amount this is sitting there.
[4:44] But equally, if you're using the standard DNS,
[4:48] which is open,
[4:49] unencrypted,
[4:51] runs on UDP port 53,
[4:54] then you can see all the queries and
[4:56] all the answers. You kinda go, well, boring,
[5:00] not boring.
[5:01] Almost everything that you and I do
[5:04] starts as a name,
[5:06] even the ads. And your machine
[5:09] translates the DNS label, or part of that
[5:12] name, into an IP address and then goes,
[5:14] well, okay. Make a connection. Off we go.
[5:16] Let's do fun stuff.
[5:18] So if I had
[5:20] an up to the second
[5:22] record
[5:23] of all of your queries
[5:25] as you make them,
[5:28] I know what you're doing.
[5:29] I know who you are.
[5:31] I think I can put you into a
[5:32] profile.
[5:33] I think I understand you.
[5:36] And if I work just a tiny bit
[5:37] harder, I think I know what you're gonna
[5:39] do next.
[5:41] Now that's kinda chilling in so many ways
[5:44] because all you're doing is just playing on
[5:46] your computer,
[5:47] yet the sort of data exhaust, the fumes
[5:51] that come out of your digital wire
[5:53] are astonishingly
[5:54] rich in information.
[5:56] And so
[5:57] the the move was on at that point
[5:59] to harden up our protocols and one of
[6:01] the places we wanted to harden up, was
[6:03] the DNS itself.
[6:05] So the sort of Uber the overall project
[6:08] was called DNS privacy,
[6:10] and there are a number of approaches that
[6:13] have been made to try and improve the
[6:15] DNS to make it not impossible,
[6:17] certainly not impossible to look at, but to
[6:20] make it harder.
[6:21] There's no absolutes in this world, but if
[6:24] it costs you a large sum of money
[6:25] to see what I'm doing, you won't do
[6:27] it casually. You might still do it, but
[6:30] it won't be a casual decision. If it's
[6:32] gonna cost you a lot of money to
[6:33] find out what I'm doing, you're gonna figure
[6:34] out whether you wanna do it or not.
[6:36] And that's kinda where this work started.
[6:39] So
[6:40] the first thing was, well, what can we
[6:42] do about the DNS? Well,
[6:44] it's an awfully chatty protocol,
[6:46] but it chats in the clear.
[6:49] So can we
[6:51] kind of make it chat down an encrypted
[6:54] wire?
[6:55] And the answer, surprisingly, or maybe not so
[6:58] surprisingly, is sort of, you know, yeah, we
[7:00] can.
[7:01] And this started
[7:03] the entire issue of DNS over something other
[7:07] than open UDP.
[7:09] Now
[7:11] right at the word go, the DNS actually
[7:13] had two transport protocols, TCP and UDP.
[7:16] We used UDP because it was fast, efficient,
[7:20] lightning quick, just the thing you need for
[7:22] the DNS.
[7:24] Oddly enough, it's also really easy for a
[7:27] third party to manipulate,
[7:29] alter,
[7:30] fake,
[7:31] and generally make a menace of themselves because
[7:34] it's UDP.
[7:36] I send out a query to a supposed
[7:38] IP address.
[7:39] I get back an answer
[7:41] from a supposed IP address.
[7:44] Is the machine
[7:46] that is faking the answer the machine I
[7:49] sent the the query to? I don't know.
[7:52] Is this a real answer?
[7:53] I don't know.
[7:55] Should I trust it?
[7:57] Well, everyone does all of the time. Well,
[7:59] doesn't doesn't DNSSEC solve that problem, though, that
[8:02] particular problem?
[8:03] Look. If if everyone signed, if we're in
[8:06] the room of DNSSEC,
[8:07] I would say that's a whole lot better
[8:09] than the room we're in now,
[8:11] but no one signs their domains with DNSSEC.
[8:14] So an awful lot of focus sitting there
[8:16] with the magnifying glass going, if you sign
[8:18] it, I can check it.
[8:19] But if no one signs so what well
[8:22] and beyond that even I think even going
[8:25] to that point Even if everybody did sign
[8:28] you still could do man man in the
[8:29] middle attacks from what I understand well
[8:32] Okay, this is one of these but you
[8:34] could
[8:35] But this is one of these age old
[8:36] tensions between security and speed.
[8:39] Right.
[8:40] Over in browser land,
[8:42] they talk about the billion dollar millisecond.
[8:45] And at one point, you know, one of
[8:47] the browser folk had even toyed with the
[8:49] concept of putting the DNS right inside the
[8:51] browser because it would just shave off milliseconds.
[8:54] They do all kinds of weird and wacko
[8:56] tricks.
[8:59] If you want to validate your DNS responses,
[9:03] you better bring a packed lunch
[9:06] and possibly a few supplies because your web
[9:09] experience
[9:10] is about to get an awful lot slower.
[9:12] And and no one's willing to go there.
[9:15] Right. So, you know, you might say, well,
[9:17] let's all use DNSSEC.
[9:19] But in a world where one second is
[9:21] regarded as an as an eternity,
[9:23] you know, just no one's gonna do it.
[9:26] So,
[9:28] okay, we need something different. We need something
[9:30] a bit better. We need something that's fast
[9:33] and certainly no slower than the DNS as
[9:35] we understand it,
[9:36] but doesn't kind of broadcast what you're doing
[9:39] to your neighbors, your ISP,
[9:41] and and various other folk who have an
[9:43] interest in seeing what you're doing.
[9:45] And the approach started,
[9:48] I suppose, innocuously,
[9:50] like all things.
[9:52] You have to break down the DNS into
[9:54] two parts of a conversation.
[9:56] There's me and you out at the end.
[9:59] And pretty typically, when we turn on our
[10:01] machines,
[10:03] our infrastructure, the normally, the Internet service provider
[10:06] says, hi. Here's an address for you to
[10:08] use. Here's you know how to get started.
[10:09] By the way,
[10:11] I've rigged up some DNS resolvers, what we
[10:13] call recursive resolvers.
[10:15] Load those IP addresses into your machine, and
[10:18] whenever you have a query, just ask us,
[10:21] and we'll give you the answer.
[10:23] And so that first hop
[10:25] is called the stub, me,
[10:28] the stub resolver, the endpoint,
[10:31] to the first piece of DNS machinery
[10:33] that's doing the hard work, the recursive resolver.
[10:38] Most ISPs run recursive resolvers, and there are
[10:41] a few other big companies out there.
[10:44] Google springs to mind.
[10:45] Cisco bought OpenDNS.
[10:47] There's Quad nines. There's,
[10:50] Cloudflare.
[10:51] There's a bunch of these folks that also
[10:52] run
[10:53] open recursive resolvers.
[10:55] If you just do nothing, you're probably gonna
[10:57] run with the resolve that your ISP gave
[10:59] you.
[11:00] If you make an effort, you can go
[11:02] and use someone else's.
[11:04] Now the next step, recursive to the folk
[11:07] who really know the answer, the authoritatives,
[11:10] is not part of what we're talking about.
[11:13] So I ask recursive. The recursive asks the
[11:15] authoritatives.
[11:16] Let's just ignore that second part of the
[11:18] puzzle.
[11:20] It has its problems, but let's not talk
[11:22] about it today. Let's talk about the bit
[11:24] that matters,
[11:25] the bit where you know it's me,
[11:27] where Jeff is making queries, and it's pretty
[11:30] obviously Jeff.
[11:31] And what we're trying to do is to
[11:33] stop other folk from looking at Jeff making
[11:35] these queries.
[11:36] So what we'd like to do is encrypt
[11:40] the session between my machine
[11:42] and that recursive resolver over there.
[11:46] Now
[11:47] we spent a lot of time
[11:49] making sure that the web was secure using
[11:52] a thing called transport level security, TLS.
[11:55] Yep. It started off as a secure socket
[11:57] layer and then sort of morphed by name,
[12:00] but it's it's actually the same old stuff.
[12:03] And the way it works, of course, is
[12:08] when I open up a secure session,
[12:10] I first start in the clear
[12:13] and say, hi,
[12:14] Russ. Good to see you.
[12:17] I wanna connect to rus.net.
[12:20] And you go,
[12:23] okay.
[12:24] Here's
[12:26] a key
[12:27] for rus.net,
[12:29] and here's my certificate.
[12:32] And I go, well, fascinating. Why should I
[12:34] trust this random digital stuff?
[12:37] But luckily, I've got inside my machine
[12:40] about 1,500 trust points.
[12:42] And if I can make a secure
[12:45] chain of signing
[12:47] from one of my local trust points
[12:50] to the digital key that you've offered me,
[12:53] I believe that certificate, and I believe it's
[12:56] you, and I'm now talking to rush.net.
[12:59] You kinda go, well, so what? What about
[13:01] my Internet banking?
[13:02] You know? I'd like to know I'm talking
[13:04] to the right person. Offer me a certificate.
[13:07] But that's not all. Because at that point
[13:09] then, the two of us do a very
[13:11] rapid exchange and create a session key,
[13:15] And then all further communication
[13:17] is encrypted using that session key.
[13:21] The beauty of the session key is even
[13:23] if you know the public key of rust.net,
[13:25] it won't help you. And even if you
[13:27] know my public key, it won't help you.
[13:30] To actually break into that session, you need
[13:32] to have knowledge of private keys. And by
[13:34] definition,
[13:35] if you know my private key, you're me.
[13:38] So TLS, as far as we understand, and
[13:41] and with some caveats, TLS is a pretty
[13:43] good protocol.
[13:44] It better be
[13:45] because
[13:46] there's nothing else in the cupboard.
[13:49] Yeah. I was gonna say that's pretty much
[13:50] all you got. Right. It's kind of what's
[13:53] security on the Internet? TLS. Yeah. Well, what
[13:56] if TLS doesn't work?
[13:58] Jeez. You shouldn't have asked that question because,
[14:00] hey,
[14:02] no answer.
[14:03] Right?
[14:04] That's it. That's that's that's you have to
[14:06] live with it.
[14:07] So we wanted to encrypt the session between
[14:10] the stub and the recursive, and so you
[14:12] reach into the toolbox and you go, TLS.
[14:15] Now, TLS is a TCP protocol,
[14:19] not UDP,
[14:21] because this security association takes a little bit
[14:24] of handshaking,
[14:25] and there's kind of a shared crypto state.
[14:28] And while some folks spend a lot of
[14:30] time and a lot of effort trying to
[14:31] make
[14:33] UDP
[14:34] TLS work,
[14:36] DTLS, Datagram TLS,
[14:39] the results have been largely paperwork.
[14:42] As someone once described about the old ancient
[14:44] OSI protocols as vaporware about paperware, or was
[14:48] it the other way around? Paperware about paperware.
[14:51] DTLS is largely the same kind of, you
[14:53] know, e.
[14:55] Looks fine on paper,
[14:57] and that's all you get. So, okay, we're
[14:59] down in TCP land.
[15:01] Now this DNS over TLS excited some reaction,
[15:05] and one of the first of these was
[15:08] the DNS will melt because there are literally
[15:11] trillions of these tiny transactions every single day.
[15:14] And if all of the servers had to
[15:16] run TLS,
[15:17] all the recursives instead of UDP,
[15:19] obviously, they'd all die and go to silicon
[15:22] heaven.
[15:23] That's an odd statement to make
[15:26] because
[15:27] we use the web
[15:29] like crazy.
[15:31] And there are just as many short web
[15:33] sessions probably as there are DNS queries and
[15:36] answers. I was gonna say they probably were
[15:38] not paying attention to the work done around
[15:41] ILMP,
[15:42] for instance.
[15:44] Right. So we know how to make
[15:47] massive TLS work. Right. Right? Because the web
[15:50] is living proof that trillions of sessions a
[15:53] day Right. And not work. Very fast DNS
[15:56] to work at the same time. Yeah.
[15:58] Okay. So
[16:00] DNS over TLS
[16:02] looks pretty good, and and it kind of
[16:04] does a couple of things which are not
[16:06] bad at all.
[16:09] I know who am I talking to.
[16:11] If I say I'm going to CloudFlare, if
[16:13] I'm, say, the quad nine, I get back
[16:15] a certificate.
[16:17] And so my friendly local spook agency
[16:20] cannot fake it out unless they've been playing
[16:22] with my machine.
[16:24] Unless they've done the Kazakhstan thing and inserted
[16:28] a fake certificate on my machine,
[16:30] I can't be fooled.
[16:32] Now, okay,
[16:34] install faxes it, you're dead, fine, we all
[16:36] know that.
[16:37] But on the assumption,
[16:39] my machine is roughly as, you know, I
[16:41] configured it and I have trust points that
[16:42] I am prepared to trust, then I'm talking
[16:44] to whom I want to talk to and
[16:47] no one else can see it while I'm
[16:49] talking to it. So that traffic is a
[16:51] secret between me and my chosen recursive resolver.
[16:55] This sounds great.
[16:57] No one cared.
[16:59] And, again, this is kind of moving towards
[17:01] dough. Why did no one care? They're geek
[17:04] knobs.
[17:06] So there are, what, four and a half
[17:07] billion users out there.
[17:10] Roughly, how many are gonna configure DNS over
[17:12] TLS into their machines?
[17:15] I've got
[17:16] 10 figures on my hand. Okay. I'll go
[17:19] 10.
[17:20] Yeah. That's because, honestly, I don't. I don't
[17:22] know. You know what? It's hard, and it
[17:25] doesn't quite work. And and and and so
[17:28] it largely remained a paper exercise going, we
[17:30] could do this. Aren't we clever?
[17:32] But as a tool for the masses,
[17:34] nah. It was never gonna happen. So everyone
[17:36] just yawned.
[17:38] Now
[17:39] the move from DNS over TLS to DNS
[17:42] over HTTPS,
[17:44] in protocol terms,
[17:46] is about one millimeter to the left.
[17:50] You know, if you think about it, it's
[17:52] still TLS.
[17:53] I still know who I'm talking to. It's
[17:55] still encrypted.
[17:58] And inside DNS over HTTPS,
[18:01] the packets are actually wire format DNS,
[18:04] which is the same as HTTPS.
[18:08] So
[18:09] nothing's changed.
[18:11] You go, well, what's the fuss about?
[18:15] Okay.
[18:16] Next next issue.
[18:18] If all you're doing
[18:20] is playing with the operating system and changing
[18:23] the way your operating system talks to the
[18:26] recursive resolver,
[18:28] so what?
[18:29] But the folk who really took this up
[18:31] were the folk who deal in HTTPS,
[18:34] otherwise known as the browser people.
[18:37] Now the browser people have a number of
[18:39] motivations.
[18:41] And in some ways, they're very worthy motivations,
[18:44] but they have their own motivations.
[18:47] They don't trust the platform.
[18:50] If you're Firefox,
[18:52] you're my customer. You're Firefox's customer.
[18:55] You're me, and I don't really care what
[18:57] the underlying Android or Apple or anything else
[19:00] is doing.
[19:01] I, Firefox, am here to protect you.
[19:04] So I want control.
[19:06] I want to make your browsing experience one
[19:09] that I control.
[19:11] I don't wanna leak.
[19:13] I don't wanna gratuitously
[19:15] send out information,
[19:17] and I wanna be fast. I want control.
[19:20] So you've offered me a way to do
[19:22] DNS over HTTPS,
[19:25] and I am an HTTPS engine.
[19:28] Well,
[19:29] marriage made in heaven. Let me do your
[19:31] DNS for you.
[19:33] So then why not just stick the resolver
[19:35] in the browser itself? That's what we're talking
[19:37] about. So that's what the whole angst is
[19:40] all about.
[19:41] The resolver gets stuck in the browser. Now
[19:43] the browser
[19:44] now has a knowledge of the DNS
[19:47] that no other application
[19:48] on your platform has.
[19:51] So your browser might know, I'm going to
[19:53] rust.net. Here's its IP address. Blah blah blah.
[19:55] I've done a web fetch.
[19:57] But if you bring up a terminal window
[19:59] and go SSH rust.net,
[20:01] the operating system goes,
[20:05] because it's not a common pool anymore.
[20:08] Right? So the application
[20:10] is now making its own choices.
[20:14] Now
[20:15] which resolver are you gonna go to? Because
[20:17] you're running HTTPS, and like the web, you
[20:20] can go anywhere.
[20:22] And so the ISP says, hi. Here's some
[20:25] friendly resolvers.
[20:26] Now you could be in China.
[20:28] You could be in Kazakhstan.
[20:30] You could be in many places
[20:32] that offer some kind of DNS censorship for
[20:34] free.
[20:36] Even The UK and Australia, it's just part
[20:38] of the service.
[20:41] We care. It's free.
[20:43] But if I'm a browser
[20:45] and I tunnel across to
[20:48] a DNS provider that says,
[20:50] I will translate anything that's in the DNS.
[20:52] I'm not going to censor you.
[20:55] I'm making an independent decision as a browser.
[21:00] Again, though, let's look at this a little
[21:01] bit more. If the browser is doing it,
[21:05] then it's no longer a nerd knob.
[21:08] So let's say,
[21:09] just for one
[21:11] microsecond,
[21:12] that Chrome decides to do it. And let
[21:14] me point out they have not decided to
[21:16] do anything yet.
[21:18] But if they did,
[21:20] 78%
[21:21] of the world will then do it
[21:23] because that's its market share.
[21:25] So if Chrome decided to take all of
[21:28] its DNS
[21:30] and quietly direct it to a trusted recursive
[21:33] resolver
[21:34] that Chrome has chosen,
[21:37] no one else would see it because it's
[21:39] encrypted.
[21:40] No one else could argue with it because
[21:42] Chrome did it, and it would be hard
[21:44] to undo it because it's a nerd knob.
[21:47] And it would break all this and it
[21:48] would break all the CDNs. Right?
[21:51] Well, break a whole bunch of stuff.
[21:53] Not the least national policies, but CDNs, VPN,
[21:56] you you name it. A whole bunch of
[21:58] things would get broken that kind of assume
[22:00] the DNS works one way.
[22:02] And these guys are tunneling
[22:04] from the application itself
[22:07] across to some other point,
[22:09] a point that
[22:10] the user, the platform, and the intermediaries
[22:13] have no say in.
[22:14] It's the browser's choice.
[22:17] Now on the browser side, they kind of
[22:19] argue, look.
[22:21] You got caught with your fingers in in
[22:23] the till. You got caught looking. You got
[22:25] caught abusing us.
[22:27] We don't think you're worthy of the user's
[22:29] trust anymore.
[22:30] We, the browser folk, whose interests are you,
[22:32] the consumer,
[22:33] think you deserve better than this. So we're
[22:36] gonna take the decision away from you and
[22:38] basically put you in a different room where
[22:40] your DNS doesn't leak.
[22:43] So this is the kind of the pros
[22:45] and cons of the argument flying around here.
[22:47] The some folk kinda go, well, we're used
[22:50] to the DNS
[22:51] being
[22:52] an open piece of infrastructure.
[22:54] And whether you're a CDN provider or a
[22:57] VPN provider,
[22:58] whether you're a platform provider,
[23:00] like Android or or Apples with their Mac
[23:03] Mac OS's and iPhone, if that's your stock
[23:05] in trade, then
[23:07] you do the DNS.
[23:08] And if you're an ISP, you do the
[23:10] DNS.
[23:12] But the browser folk are kinda going, with
[23:14] DNS over HTTPS,
[23:17] I don't necessarily have to play your game,
[23:20] and I can use defaults
[23:22] inside my application
[23:24] that lift the application
[23:25] away from you
[23:27] and take it out of your control.
[23:30] Right.
[23:31] And at that point, you know, we light
[23:33] the firecrackers.
[23:35] We take a step back and watch the
[23:37] light show. Yes.
[23:39] Well, right. And it and it becomes I
[23:41] mean, there's just so much about this that
[23:43] is
[23:44] potentially troubling. Right? There's so much about this
[23:47] that could just that could go wrong. Not
[23:50] that it necessarily will, but it could.
[23:54] Well, let let's talk about this, and let's
[23:56] actually go there because, you know, why not?
[24:00] There is no doubt
[24:02] that the underlying certificate system that the DNS
[24:05] uses as its
[24:06] trusted rock of security
[24:09] is pretty corrupt and pretty horrible.
[24:14] We all wish that were otherwise,
[24:16] but
[24:18] folk who
[24:19] get listed
[24:20] inside software as a trusted,
[24:22] issuer of certificates
[24:25] are sometimes corrupted by, you know, mere money
[24:28] and do things that they should not do.
[24:31] And the problem is you can't tell a
[24:33] bad certificate from a good certificate. They're all
[24:35] just certificates.
[24:37] Symantec,
[24:38] which is now no longer in existence,
[24:41] got caught certifying
[24:43] the domain name that doesn't exist, example.com.
[24:48] Now
[24:48] if I tell you I'm a certificate authority
[24:51] and I hardly ever lie,
[24:53] and I'm not gonna tell you which ones
[24:55] I'm lying about,
[24:58] you can't trust anything I do because I
[25:00] could be lying for just you. You know?
[25:03] And this is the problem that kind of
[25:05] besets
[25:06] the certificate world.
[25:08] There have been numerous approaches to try and
[25:10] clean this up.
[25:12] And do you know the best answer we
[25:14] have?
[25:16] It's an old one, actually. It's called certificate
[25:18] transparency.
[25:20] The best answer we have
[25:22] is that a trusted certificate provider
[25:25] has to publish in the open
[25:28] every certificate it issues.
[25:30] So the only thing that keeps the CA
[25:32] system from going
[25:34] completely off the rails
[25:36] is openness.
[25:38] Now
[25:39] I can still be bad,
[25:41] and I've got about, I don't know, ten
[25:44] minutes before you'll notice.
[25:47] And and it's not a very good defense.
[25:49] But after about ten minutes, someone might see
[25:52] this logged fake certificate and go, that's bad,
[25:55] and we'll go and fix it up.
[25:57] But the point is, well, the only thing
[26:00] that's keeping all this stuff together is openness.
[26:04] Now the DNS
[26:05] was an open protocol.
[26:07] You could see it. Anyone could see it.
[26:10] And that was both its strength and its
[26:12] weakness.
[26:13] Because if
[26:15] I started to stand up a recursive resolver
[26:18] that lied,
[26:20] literally lied.
[26:22] You wanna go to facebook.com?
[26:23] Try, oh, 1.1.1.one.
[26:26] That's a lie.
[26:28] Well,
[26:29] I can see it's a lie because it's
[26:31] open.
[26:32] But what if your browser does it through
[26:35] an encrypted channel
[26:36] and the other end of the channel lies
[26:38] back? No one can see it.
[26:41] So
[26:42] one of the things we lose with DOH
[26:45] is actually the openness of the namespace.
[26:48] Now
[26:50] we talked a little bit about CDNs and
[26:52] VPNs and customized spaces.
[26:55] But what if
[26:56] I set up a trusted
[26:58] DoH server
[27:00] that deliberately
[27:02] creates a so called fake name space that
[27:06] is tuned against your application?
[27:09] Good or bad?
[27:11] It's kind of taking the split DNS model
[27:14] and making the split not obvious.
[27:38] Join us in the next episode of The
[27:40] Hedge as we continue our discussion of DNS
[27:43] over HTTPS with Jeff Houston.

Shows are listed from Apple Podcasts' charts and directory, and Podcast Index where it is used. Every show and episode belongs to its publisher and plays from the publisher's own feed; this site hosts none of them.