Question: Which DNS encryption protocol is the most secure?

DoH, DoT or DNSCrypt? What are the best use cases for each? "DoH (DNS over HTTPS): DoH uses the widely used HTTPS, which is known for its strong security and features. It operates over port 443, which is less likely to be blocked. It can help bypass certain network restrictions or censorship. It is good for security asi it can appear as regular HTTPS traffic. "DoT (DNS over TLS): DoT utilizes Transport Layer Security (TLS) to secure DNS communication. DoT operates over port 853, which may require specific firewall configurations to allow the traffic. It's less likely to be blocked by network administrators since it uses a special port for communication." I found this on some website, is this true, it doesn't mention anything about DNSCrypt, maybe it's because DNSCrypt is new or something, I don't know I'm not familear with this stuff?

DNScrypt is a pretty basic encryption layer on top of DNS. It doesn't have any kind of certificate checking or any of that -- your client just has a list of key signatures it thinks are genuine. Much like SSH. Its lower overhead and less complicated than DoH and DoT, for no real loss in security. For this reason I think DNScrypt is the best.

>>21616 Thank you, this is very helpful. I just have one question, and this is might sound very dumb, but how does the client get the list of key signatures, and what stops someone from replicating them for impersonation?

>>21617 They come bundled with the client when you download it usually. You could also copy/paste them from the operator's website, if they have one. If you have the right keys , nobody can impersonate the servers to you, unless they've managed to crack EdDSA. You only need the public keys. Someone could give you fake certificates, but at least if you currently have real keys nobody can compel a CA to send you certificates for bogus keys.

>>21619 What about when I'm changing my DNS to Quad9 in Firefox, then how do I get the keys?

>>21620 Firefox can only do DoH. You should use a program like DNScrypt-proxy that comes with a huge list of servers and their keys and picks the fastest one.

Does encrypting DNS make sense though?

>>21622 Logging DNS requests is one of the cheapest ways for your ISP to build a profile of your tastes as a consumer. They know your exact address, your name, and probably several other key facts. Some random DNS provider meanwhile just knows your IP address. Also, DNS is a very common form of VPN leak.

dumb question, but this is really as easy as `sudo resolvectl dnsovertls wlp1s0 yes`, correct?