DNS over TLS: Encrypting DNS end-to-end

What this post added

This post details Meta's pilot project with Cloudflare to implement DNS over TLS (DoT), encrypting DNS traffic between Cloudflare's 1.1.1.1 resolvers and Meta's authoritative name servers. It analyzes the feasibility, latency overhead, and computing overhead of DoT in a production workload. The pilot demonstrated that initial connection latency is amortized through TLS session resumption, resulting in p99 DNS latency comparable to UDP. The post also discusses the historical context of DNS security, the evolution of standards like DNSSEC and DoT, and the importance of operator input in protocol development. Future optimizations with TLS 1.3 and TCP Fast Open are mentioned.