Hello, welcome to the Tuesday, December 10th, 2019 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich and the time I'm recording from Sevalde, Germany.

A couple times in this podcast I already talked about the relatively new DNS over HTPS protocol, some of the problems with this protocol, and also

how it's trying to protect your DNS queries from spying eyes.

Now one of the organization that has really been pushing the standard is Mozilla with its Firefox

browser and it has been an optional feature for quite a while now in Firefox.

Starting in September, Firefox will start to make DNS over HTTP the default in particular in the US.

So it will be rolled out in stages starting with users in the US.

And the way it's supposed to be configured is by default Firefox will use DNS over

HDPS and only if these queries fail, then it will

switch back to the traditional DNS API and will use the local Resolver.

Now the privacy issue here is actually not sort of a simple black and white issue.

Now in particular as a home user, and this is really sort of

more addressing home users, your DNS queries typically go to your ISP, and they are unencrypted

between you and your ISP. With DNS or HEPS enabled, all these queries will go to Cloudflare and on the path to Cloudflare, they are using HTTP, so they should be reasonably well encrypted.

In the end, it sort of comes down to who do you trust more, your ISP or Cloudflare.

Performance-wise, according to Firefox, the initial testing they have done by allowing people

to enable DNS or HTTP has shown that it works well enough, so we'll see how it goes once

they make it the default. According to Mozilla, there are also some additional conditions they're trying to take care of if,

for example, a user does use specifically configured DNS privacy scheme, something like

Open DNS or such that they will not use DNS or HDPS in those cases.

So it should only be used if you are using your default DNS provider.

Now as a system administrator, if you're concerned about this protocol,

...