F35: CHANGE: DNS Over TLS

[dustymabe]

In #856 (a result of the video community meeting on 06/02/2021) we went over the proposed changes for Fedora 35. We decided to discuss further the following change:

• DISCUSS DNS Over TLS
  • Fedora will attempt to use DNS over TLS (DoT) if supported by configured DNS servers.
  • Tracking bug: #1889901

[darkmuggle]

After researching this, this won't affect anything. The default is try to use DNS over HTTP if the resolver supports the protocol, otherwise fall back to good 'ole UDP. The upstream debates about DNS over TLS and support over DNSSec for some of the resolvers are really unrelated to how FCOS will use DNS. 

[dustymabe]

Thanks @darkmuggle!

[rugk]

The default is try to use DNS over HTTP if the resolver supports the protocol, otherwise fall back to good 'ole UDP.

Hmm, but if I read the change correctly, this is different to what Fedora proposes there?
I.e. the upstream change wants to use DoT and you say here CoreOS will use DoH by default – or was this a mistake?
If not, would it really be good to handle it different than the rest of the Fedora project here?

[bgilbert]

I think @darkmuggle probably misspoke, and meant to say DNS over TLS rather than DNS over HTTP.