In https://www.privacytools.io/providers/dns/#dns-definitions, there are definitions which don't include DNS-over-TLS having two modes, opportunistic/automatic and manual. In opportunistic mode DoT is attempted with DNS server provided by DHCP and wihle it is vulnerable for downgrade and MITM (due to certificate validation skipping), it doen't have the issue of centralising everything to a single encrypted DNS provider that is hardcoded in apps (which is often said about Firefox).
This is an important difference between DoT and DoH, and I view PrivacyTools as being in a good position to inform users about it.
My connection with the software
I was one of the original authors of the DNS page and I think this information was removed as a part of some cleanup (or maybe it never got past draft). I have no connection to the RFCs or their authors that I know of.
I will keep the issue up-to-date if something I have said changes or I remember a connection with the software.
## Description
In https://www.privacytools.io/providers/dns/#dns-definitions, there are definitions which don't include DNS-over-TLS having two modes, opportunistic/automatic and manual. In opportunistic mode DoT is attempted with DNS server provided by DHCP and wihle it is vulnerable for downgrade and MITM (due to certificate validation skipping), it doen't have the issue of centralising everything to a single encrypted DNS provider that is hardcoded in apps (which is often said about Firefox).
* https://tools.ietf.org/html/rfc7858#section-4.1
## Why I am making the suggestion
This is an important difference between DoT and DoH, and I view PrivacyTools as being in a good position to inform users about it.
## My connection with the software
I was one of the original authors of the DNS page and I think this information was removed as a part of some cleanup (or maybe it never got past draft). I have no connection to the RFCs or their authors that I know of.
- [x] I will keep the issue up-to-date if something I have said changes or I remember a connection with the software.
This repo is archived. You cannot comment on issues.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Description
In https://www.privacytools.io/providers/dns/#dns-definitions, there are definitions which don't include DNS-over-TLS having two modes, opportunistic/automatic and manual. In opportunistic mode DoT is attempted with DNS server provided by DHCP and wihle it is vulnerable for downgrade and MITM (due to certificate validation skipping), it doen't have the issue of centralising everything to a single encrypted DNS provider that is hardcoded in apps (which is often said about Firefox).
Why I am making the suggestion
This is an important difference between DoT and DoH, and I view PrivacyTools as being in a good position to inform users about it.
My connection with the software
I was one of the original authors of the DNS page and I think this information was removed as a part of some cleanup (or maybe it never got past draft). I have no connection to the RFCs or their authors that I know of.