# Encrypted DNS Favours Resolver-Side Collection ## The trend that breaks wire-based DNS monitoring strengthens this architecture DNS is moving to encrypted transport. DoT wraps queries in TLS on a dedicated port. DoH sends them as ordinary HTTPS on port 443, indistinguishable from web browsing. For anyone collecting DNS from a network tap, this is a slow failure. The traffic is still there and it can no longer be read. Coverage degrades as adoption rises, and it keeps rising. > [!important] Where TelemetriX sits relative to that > Collection happens at the resolver through DNSTAP. The resolver is the endpoint of the encrypted connection, so it sees the query in the clear regardless of how it arrived. ==Encryption changes who can see the query in transit, not whether the resolver sees it.== This is a real and durable advantage over tap-based approaches, and it is the right question to put to any competing vendor: do you collect at the resolver, or from the wire. > [!warning] The matching limitation > The architecture sees what the organisation's own resolvers handle. A device configured to send DoH straight to an external resolver, which browsers and operating systems increasingly do by default, bypasses the organisation's resolver entirely and therefore does not appear in the stream. Enterprises manage this with policy and DNS control, and it is a fair question for any deployment: what share of endpoints actually use the corporate resolver. ## Why it matters It makes the timing argument technical rather than commercial. Wire-based DNS visibility is on a decline curve that nobody can reverse, and the replacement has to sit at the resolver. That is a structural reason for the category to exist now. ## Related - [[Red Onion MOC]] - [[DoH and DoT]] - [[DNSTAP and Where the Data Comes From]] - [[DNS Security Vendor Landscape]] - [[TLS]]