I never understood DOH over DOT. It makes sense if you want to hide DNS lookups so that people cannot block the DNS queries to ad and other scam networks.
[dead]
Quad9 DOH HTTP/1.1 Retirement, December 15, 2025
31–40 of 63 posts
Re: Quad9 DOH HTTP/1.1 Retirement, December 15, 2025
#32Earlier quoted context omitted.
probably not - it can be quite poorly defined in places and the edge cases can be very fiddly. by pushing for http/2 it encourages more users to pick it up imo
http/2 surely not simpler?
I feel like securing against request smuggling is simpler with http/2. That is of course only one aspect.
Ultimately though, its not like this is getting rid of http/1.1 in general, just DNS over http/1.1. I imagine the real reason is simply nobody was using it. Anyone not on the cutting edge is using normal dns, everyone else is using http/2 (or 3?) for dns. It is an extremely weird middle ground to use dns over http 1. Im guessing the ven diagram was empty.
Re: Quad9 DOH HTTP/1.1 Retirement, December 15, 2025
#33> However, we are reaching the end of life for the libraries and code that support HTTP/1.1 What libraries are ending support for HTTP/1.1? That seems like an extremely bad move and somewhat contrived.
I wonder too, for a DNS query do you ever need keepalive or chunked encoding? HTTP/1.0 seems appropriate and http2 seems overkill
DNS seems like exactly the scenario where you would want http2 (or http1.1 pipelining but nobody supports that). You need to make a bunch of dns requests at once, and dont want to have to wait a roundtrip to make the next one.
Re: Quad9 DOH HTTP/1.1 Retirement, December 15, 2025
#34I think code to implement http/1.1 in whatever software stack they use would have been shorter than the blog post...
I think you’re severely underestimating the complexity of http/1.1. It’s definitely much simpler than http/2, but it’s a lot of code that needs to be maintained.
Yes; the web server I use for my site is about twice the size of that blog post. Though, I think that if you drop the file-listing functionality you may be able to get it closer.
Re: Quad9 DOH HTTP/1.1 Retirement, December 15, 2025
#35I never understood DOH over DOT. It makes sense if you want to hide DNS lookups so that people cannot block the DNS queries to ad and other scam networks.
Thanks to the ossification of the internet, every new protocol or protocol extension needs to be over HTTPS. DoT works fine, it's supported on all kinds of operating systems even if they don't advertise it, but DoH arrived in browsers. Some shitty ISPs and terrible middleboxes also block DoT (though IMO that should be a reason to switch ISPs, not a reason to stop using DoT). On the hosting side, there are more option…
> Thanks to the ossification of the internet, every new protocol or protocol extension needs to be over HTTPS.
If someone can tell you're using HTTPS instead of some other TLS-encrypted protocol, that means they've broken TLS.
Re: Quad9 DOH HTTP/1.1 Retirement, December 15, 2025
#36Earlier quoted context omitted.
Thanks to the ossification of the internet, every new protocol or protocol extension needs to be over HTTPS. DoT works fine, it's supported on all kinds of operating systems even if they don't advertise it, but DoH arrived in browsers. Some shitty ISPs and terrible middleboxes also block DoT (though IMO that should be a reason to switch ISPs, not a reason to stop using DoT). On the hosting side, there are more option…
> Thanks to the ossification of the internet, every new protocol or protocol extension needs to be over HTTPS. If someone can tell you're using HTTPS instead of some other TLS-encrypted protocol, that means they've broken TLS.
> If someone can tell you're using HTTPS instead of some other TLS-encrypted protocol, that means they've broken TLS.
Lots of clients just tell the world. ALPN is part of the unecrypted client hello.
Re: Quad9 DOH HTTP/1.1 Retirement, December 15, 2025
#37> However, we are reaching the end of life for the libraries and code that support HTTP/1.1 What libraries are ending support for HTTP/1.1? That seems like an extremely bad move and somewhat contrived.
HTTP versions less than 2 have serious unresolvable security issues related to http request/response smuggling and stream desynchronization.
Re: Quad9 DOH HTTP/1.1 Retirement, December 15, 2025
#38I never understood DOH over DOT. It makes sense if you want to hide DNS lookups so that people cannot block the DNS queries to ad and other scam networks.
DOH prevents malicious network providers from blocking DOT traffic to enforce their own DNS services for “efficiency” reasons. Most ISPs just want to sell your data and with encrypted client hello and DOH they’re losing visibility into what you’re doing.
Don't you just intercept traffic to well know recursive resolvers? And then drop packets to ports other than 53?
Re: Quad9 DOH HTTP/1.1 Retirement, December 15, 2025
#39> However, we are reaching the end of life for the libraries and code that support HTTP/1.1 What libraries are ending support for HTTP/1.1? That seems like an extremely bad move and somewhat contrived.
HTTP versions less than 2 have serious unresolvable security issues related to http request/response smuggling and stream desynchronization. https://http1mustdie.com/
If you're using a reverse proxy, maybe. I don't think it's sufficient to kill a whole version of HTTP because of that.
Re: Quad9 DOH HTTP/1.1 Retirement, December 15, 2025
#40Earlier quoted context omitted.
But is DoH? If your library is too old to support http2, what are the chances you've upgraded the DNS resolver to a DoH resolver? Luckily it's pretty easy to run your own DoH server if you're deploying devices in the field, and there are alternatives to Quad9.
Its not about age, its about complexity. HTTP/1.1 client is trivial to implement.
We're talking about an HTTP/1.1 server here