Hacker News new | ask | show | jobs
by kim0 3128 days ago
I know DNS over TLS is basically the same, but any plans to integrate dnscrypt too?
2 comments

Not currently no. First of all, there's sort of two parts to "DNSCrypt", the typical DNSCrypt, which is Client<->Recurosor, and DNSCurve, which is Recursor<->Authority. The implementation is complex, and not well supported. I know that a number of people in the OpenNIC community to support DNSCrypt.

We've decided to go with TLS instead of DNSCrypt, since it's a well understood (and now RFC standardized protocol). While we're the first to support this publicly, we expect others to follow soon, which, combined with DNSSEC, will provide true security for DNS.

Out of curiosity, what do you see as the advantages of dnscrypt vs. DNS over TLS?

I looked at dnscrypt myself, it's implementation is much more complex than using standard TLS support libraries that already exist. TLS and dnscrypt seem to cover similar use cases...