Comment by dev_l1x_be

Thanks to the ossification of the internet, every new protocol or protocol extension needs to be over HTTPS.

DoT works fine, it's supported on all kinds of operating systems even if they don't advertise it, but DoH arrived in browsers. Some shitty ISPs and terrible middleboxes also block DoT (though IMO that should be a reason to switch ISPs, not a reason to stop using DoT).

On the hosting side, there are more options for HTTP proxies/firewalls/multiplexers/terminators than there are for DNS, so it's easier to build infra around DoH. If you're just a small server, you won't need more than an nginx stream proxy, but if you're doing botnet detection and redundant failovers, you may need something more complex.

My ISP (my area is serviced by 1 more but they offer lower speeds) blocks the DoT port. They cannot block 443. If they start blocking popular DoH domains, I can use any of the mirrors or run my own over https://wongogue.in/catpics/

DOH prevents malicious network providers from blocking DOT traffic to enforce their own DNS services for “efficiency” reasons.

Most ISPs just want to sell your data and with encrypted client hello and DOH they’re losing visibility into what you’re doing.

DOT picked an odd port, DOH uses 443. Otherwise they both have the benefits of TLS.

DoQ is better than either dot/doh

It's both. In oppressive countries (Iran, China, Russia) where all traffic is filtered, DOH is supposed to help keep things concealed, too.