Serverless DNS over HTTPS (DoH) at the Edge

privacy, which is essential for security. currently your DNS requests are sent in the clear. and even if DNSSEC sort of guarantees the integrity and authenticity of the answers, it doesn't provide secrecy.

and yes, currently TLS (+SNI) leaks the domain name (server name in TLS parlance), but there's work being done on that and it's very likely that in a few years that leaky hole will be closed too.

That depends on how close you're looking at the tail. Things like ISP servers that purposefully or not corrupt information, caches that cache things for weeks after the ttl expired, ISP servers that simply don't respond in a timely fashion. It's pretty useful to have an alternative way to resolve hosts.

It's running on EdgeEngine, which is similar to Lambda@Edge.

i thought it would be a clever name for a p2p architecture pattern, but now it means "runs in an on-demand container on a cloud"

DNS has always been “serverless” for most people.

I have no idea what software or hardware my DNS provider uses. All the scaling, fault tolerance, backups etc are out of sight and out of mind.

How? Pointing your resolver to something returning whatever has been possible since DNS was invented. This changes nothing except that your ISP isn't able to read/change responses.