[subwindow]

This has negative implications for security. For instance, one reason why DNS resolvers might block or modify requests is to blacklist domains used for malware operation (botnet C&C domains). Other things like DNS sinkholing and poisoning are also frequently used as tools to disrupt malware communication.

In addition, collection and analysis of below-the-recursive DNS traffic is one of the primary ways in which security researchers discover the infrastructure of botnet networks.

Overall DoH is probably a net positive, but I don't see downsides like this being discussed.

[judge2020]

You can currently customize the trr address in firefox, so assuming you trust a network box's single HTTPS certificate, it can also run a DoH server.

[darkhorn]

> This has negative implications for security.

Yeah, Erdoğan won't be able to block oppositions' web sites. That is a very big threat! /s