Hello *,
while DNS over TLS is operational in upcoming Core Update 140/141, we already discovered some performance issues due to missing TLS connection reuse and similar optimisations.
Further, Unbound performs some measurements to determine response times of given forwarders and submits all queries to the fastest one - which obviously is a bad thing with a view to DNS privacy.
Stubby (https://dnsprivacy.org/wiki/display/DP/About+Stubby), which is also written by NLnet Labs, aims to fix both issues.
Personally, I do not like the idea of putting another software before Unbound in case the user decides to enable DNS over TLS. However, to discuss this matter and further steps, mentioning it did sound reasonable to me. :-)
Thoughts/comments/opinions?
Thanks, and best regards, Peter Müller