[HerraBRE]

This is neat!

DoH/DoT over Tor will provide stronger security and privacy guarantees across the board, but a well run .odns (anycast, good caches) could probably provide better performance.

The .odns anonymity is strictly weaker than DoH-over-Tor because the .odns operator can see which recursive resolver is in use, and not all such resolvers serve large enough audiences to provide strong anonymity.

The .odns requests are also very easy to identify, monitor and block, and it's likely that metadata (query size, timings) will still leak a fair bit of information, especially if correlated with other network activity.

[toast0]

You can make query size non snoopable if you include padding, and say, always pad to 512 bytes. I didn't read the article closely, but if this is via TLS, TLS 1.3 includes optional padding in all application data, so should be doable (depending on tls api design).