DNS over TLS: Encrypting DNS end-to-end

This post details a pilot project with Cloudflare to implement DNS over TLS (DoT) between Cloudflare's recursive resolvers and Meta's authoritative name servers. It analyzes the feasibility, latency overhead, and computing overhead of this protocol in a production environment. The pilot demonstrates that DoT can be implemented at scale without negatively impacting user experience, with p99 DNS latency between Cloudflare and Meta name servers being comparable to UDP baselines due to TLS session resumption. The post also highlights the importance of operator input in protocol development and encourages industry partners to join the pilot.