DoH was mostly forced by few companies, it doesn't solve any real problems because the places that would like to spy on your DNS can just block few DoH providers that are used by default. Like, it's nice to have that random MITM can't see your DNS but if ISP wants it, they can just block it.
replyThis mostly describes the difference between DoT (which is trivial to block) and DoH (which is deliberately harder to block). Are you aware of any ISP blocking DoH?
replySecurity provided by CAs is TLS Web Server Authentication (1.3.6.1.5.5.7.3.1). CAs too are exclusively for integrity, provide no confidentiality and don't prioritize availability.
reply