Over the year of discussions in regard to DNS over HTTPS I find the best illustration is to look at email. Your email client on the phone or PC send to a email over SMTP to a email server, the server look at the address and contact the recipient server and delivers the request. In email it is client->MTA->server-recipient. In DNS it is client->Resolver->Authoritive-server with the answer traveling back in the chain.<p>A little historical similarity, ISP used to provide a default MTA servers just like they do with resolver. Now days it most people use a email provider of choice.<p>So lets now imagine we solved the plain text problem of email by having the client use a default list of trusted MTA, with thunderbird defaulting to partner with gmail, and just sent it there over HTTPS. Gmail would take the email and forward it in plaintext to the recipient-server.<p>Email security did not follow that path. There we collectively decided to first encrypt communication between the client and the MTA using TLS, addressing the first step in the chain. Then the communication between MTA and recipient server got encrypted. In order to prevent downgrade attacks there is also currently two competing standards, one based on DNS and the other on HTTPS side channel. Looking at email, we are also almost done converting the plain text protocol to encrypted: <a href="https://transparencyreport.google.com/safer-email/overview" rel="nofollow">https://transparencyreport.google.com/safer-email/overview</a><p>The general question is then, why not just copy the success of email? The answer it seem is about money. No company got more users or data when email protocols got encrypted. Cloudflare however will benefit if everyone route their DNS through them as that gives them a comparable performance benefit when people use them as a hosting provider. They also say they won't sell data, but people who move their domain hosting to cloudflare and pay for Pro, Business and Enterprise plan can get access to DNS analytics.