Chapter 6 – DNS Services on Linux
- DNSSEC implements records that allow "signing" to validate DNS response data. It does not encrypt either the request or the response, so it can operate using the standard DNS ports of
udp/53andtcp/53. DoT fully encrypts DNS requests and responses using TLS. Because DoT is an entirely different protocol, it uses porttcp/853. - DoH behaves as an API—the requests and responses are carried within HTTPS traffic with a specific HTTP header. A DoT Uniform Resource Locator (URL) has a default "landing" site of
/dns-query, and because of the HTTPS transport, the protocol uses onlytcp/443. - An internal DNS server would definitely implement recursion and forwarders, to allow the resolution of internet hosts. Usually, auto-registration is enabled, and requests are normally limited to "known" subnets that are within the organization.
External DNS servers for an organization's zone will normally not implement...
