Search code examples
dnsdnssecdns-over-https

What is the difference between DNS-over-HTTPS and DNSSEC?

I was just introduced to the Domain Name System Security Extensions (DNSSEC) and it sounds very similar to the concept of DNS-over-HTTPS (DoH) and DNS-over-TLS: to add privacy and security into DNS lookups.

What are the main differences between these protocols? Do they compete/serve the same goals?

Solution

  • DNSSEC just signs answers, to check integrity and preserve DNS cache poisoning from unauthorized fake "servers". With DNSSEC, any eavesdropper can:

    • listen traffic
    • understand "this is DNS"
    • watch domain names for request/responses.

    DOH is DNS over HTTPS. There is:

    • traffic encrypted
    • eavesdropper cannot understand - is this DNS or web http.
    • eavesdropper unable to see contains of requests/answers.

    Advantage of DNSSEC - more quick. Advantage of DOH - more private.