Comparing the Effects of DNS, DoT, and DoH on Web Performance

(1987) mentions queries with multiple questions in a single packet. AFAIK there have never been any DNS servers that can read and respond to multiple questions in a single packet. But recently there is a practicable workaround, 29 years later: DoT pipelining (multiple question in a single TCP connection). IME, after about 10 years of use, the speed of DoT blows away DoH] A Comprehensive Study of DNS-over-HTTPS Downgrade Attack (2020) Qing Huang, Deliang Chang, Zhou Li https://www.usenix.org/system/files/foci20-paper-huang.pdf "The fundamental reason is that all browsers enable Opportunistic Privacy profile by default, which allows DoH fall backs to DNS when DoH is not usable." [DoT/DoH outside the browser generally does not have this problem As will see Dot/DoH research generally (a) is browser-centric (b) assumes the only way to obtain DNS data is by letting a browser retrieve it piecemeal from remote servers automatically (c) assumes the popular graphical browser is the only application that uses DNS data, and (d) fails to consider other ways to retrieve and use DNS data that can actually speed up www information retrieval and increase "privacy", but do not necessarily work well with advertising and tracking] Large Scale Measurement on the Adoption of Encrypted DNS (2021) Sebastin Garca, Karel Hynek, Dmtrii Vekshin, Tom Čejka https://arxiv.org/pdf/2107.04436 Organization 2 "The amount of DoH traffic is in average 35 times smaller than DoT." "DoT Trends. DoT traffic seems to be much larger in the ISP (Organization 2) than in the other organizations. Showing a non-stationary growth in this organization. However, it shows an actually decrease in Organization 2 on mid-January 2021. The absolute number of DoT flows is larger than DoH in all the traffic captures combined." "DoT traffic seems to be growing in some organizations and has a large volume of traffic considering all absolute numbers. It probably produces more global traffic than DoH." Can Encrypted DNS Be Fast? (2021) Austin Hounsel, Paul Schmitt, Kevin Borgolte, and Nick Feamster https://link.springer.com/content/pdf/10.1007/978-3-030-7258... "We note that queries for DNS and DoT are sent synchronously, i.e., they must each receive a response before the next query can be sent. On the other hand, DoH queries are sent asynchronously, functionality that is enabled by the underlying HTTP protocol [if it's HTTP/2]" "Interestingly DoT lookup times are close to those of conventional DNS." "Interestingly, for X and Y, we find that DoT performs 2.3 ms and 2.6 ms faster than conventional DNS, respectively" "DoH experienced higher response times than conventional DNS or DoT, although this difference in performance varies significantly across DoH resolvers." "DoT Can Meet or Beat Conventional DNS Despite High Latencies to Resolvers, Offering Privacy Benefits for no Performance Cost." "DoH Performs Worse Than Conventional DNS and DoT as Latencies To Resolvers Increase." [Authors apparently not aware that DoT queries can be sent asynchronously. I do this outside the browser. Nor did authors acknowledge that alternative to using HTTP/2, DoH can be sent synchronously, using HTTP/1.1 pipelining. I do this outside the browser when ports 53, 853 are being redirected by the ISP "Table 5: Supported HTTP versions by the resolvers found in our Internet scan. HTTP Version support Number of servers Only HTTP/1 45 (4.9 %) Only HTTP/2 86 (9.2 %) HTTP/1 and HTTP/2 800 (85.9 %)" Source: https://arxiv.org/pdf/2107.04436] Domain Name Encryption Is Not Enough: Privacy Leakage via IP-based Website Fingerprinting (2021) Nguyen Phong Hoang, Arian Akhavan Niaki, Phillipa Gill, and Michalis Polychronakis https://arxiv.org/pdf/2102.08332 "Our technique exploits the complex structure of most websites, which load resources from several domains besides their primary one." [What if not using browser. I only retrieve resources from the primary domain, or an "API" domain if that is where the content comes from. Despite "the complex structure of most websites" this works really well for me. The "complex structure of most websites" is mostly ads and tracking. As for "mitigation" why not self-hosting a remote forward proxy]