Https-dns-proxy: DoH to QUAD9 error-prone

[timur.davletshin]

@reinerotto

This is, how fake news are born...

False:

@reinerotto

chrome will still use internal dns-client, which falls back to tcp-dns

False:

@reinerotto

... you might be able to have same effect on a LINUX client, in case no proper UDP port entropy. DNS over TCP is not a special case; AFAIK there is no MUST in the RFC, to force UDP for small requests

...hardening DNS by using TCP is a simple method, to improve security...

False:

@reinerotto

As I wrote already, in case you have “sufficient” entropy in the UDP ports used for query, UDP will be used by chrome. Otherwise, chrome switches the internal dns-client to use tcp.

... and then I just realized that you have no idea that DNS over TCP and DoH are two different things. DNS can employ TCP for long replies. It has been like that for more than 20 years. DoH works over TCP. DoQ works over Quic (UDP)... but it is not supported by Chrome. You can't get encrypted secure DNS over UDP in Chrome. Stop making things up. Use OS resolver and that's it. You can set up DNSCrypt on your router and get UDP + secirity (if you so like it). But very resolvers support it. "Fake news, fake news", - it became too easy to explain own stupidity by saying this phrase.