Hacker News Reader

Actual DNS servers and clients have supported TLS since the early years of this decade. What's gained by adding HTTP transport overhead?

View on HN

http is not overhead, http is the only transport that can go through middle boxes.

if the traffic is encrypted how can you tell whether it's http or plain dns?

Because the purpose of middle boxes is to log your traffic no matter what, usually by installing a root certificate on your devices.

What dns servers and clients support TLS?

Unbound does it natively, and BIND and the rest use DNSCrypt's shim

While we at DNSFilter are working on support of DNSCrypt, just to add some flavor to your note... it should be mentioned that the original author just abandoned the project, removed the repos from his github user, shut down the website, and it's been setup by a few industry players under a new github org: https://github.com/DNSCrypt

Tough to say what direction the project will take.

I for one welcome other advancements such as Google's efforts.

FWIW, my understanding is if you use Chrome it actually communicates over QUIC

Reply on news.ycombinator.com