3 ms·

> - you can provide your own server Nobody will do this except for maybe 5 individuals and a few dozen cooperations simply because there are no other public Do

by foepys 8y ago

> - you can provide your own server Nobody will do this except for maybe 5 individuals and a few dozen cooperations simply because there are no other public DoH servers around.

Xylakant 8y ago
No other public resolver? https://developers.google.com/speed/public-dns/docs/dns-over-https https://developers.google.com/speed/public-dns/docs/dns-over... https://ripe76.ripe.net/on-site/technical-information/dns-over-tls-resolvers/ https://ripe76.ripe.net/on-site/technical-information/dns-ov... The DNScrypt project has a longer list here: https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md https://download.dnscrypt.info/resolvers-list/v2/public-reso... Keep in mind that this is currently all pretty much experimental.
Mister_Snuggles 8y ago
Many corporations will choose to run their own resolvers for internal services. Home/small business router vendors already include DNS resolvers on the boxes they sell which work to automatically provide hostnames for addresses that they've served up with DHCP.
vetinari 8y ago
Many already run their own resolvers, so providing DNS-over-HTTPS proxy is not a problem. What is THE problem, is configuring the browser. No one is going to reconfigure their browser after each connection to a different network. There's a reason why we moved from static configuration towards DHCP, which can configure network-specific settings. DNS is a network-specific setting, and Mozilla is breaking it.
- topranks 8y ago
  That’s really the issue I think, has to be a public server if it’s going to work for mobility. Fixed desktops maybe, but a laptop or phone?
- pastage 8y ago
  Split horizon was always a bad hack, there has always been alternatives. DoH could be used on the default DNS servers too, there is value of encrypted DNS on LAN as well.
  - vetinari 8y ago
    > Split horizon was always a bad hack, there has always been alternatives. I always see this repeated as a mantra, but never it's rationale. No company is going to advertise their internal infrastructure needlessly. There's no upside in the world knowing that your _kdc._tcp.company.com is 192.168.10.20; but there are downsides. > DoH could be used on the default DNS servers too, there is value of encrypted DNS on LAN as well. Sure, but hardcoding or statically-configuring the value is not the way. LANs need to have their DHCP tags respected. If one of them is "use this URL for DoH-server", that's fine.

by foepys 8y ago

> - you can provide your own server Nobody will do this except for maybe 5 individuals and a few dozen cooperations simply because there are no other public DoH servers around.

Xylakant 8y ago

No other public resolver? https://developers.google.com/speed/public-dns/docs/dns-over-https https://developers.google.com/speed/public-dns/docs/dns-over... https://ripe76.ripe.net/on-site/technical-information/dns-over-tls-resolvers/ https://ripe76.ripe.net/on-site/technical-information/dns-ov... The DNScrypt project has a longer list here: https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md https://download.dnscrypt.info/resolvers-list/v2/public-reso... Keep in mind that this is currently all pretty much experimental.

Mister_Snuggles 8y ago

Many corporations will choose to run their own resolvers for internal services. Home/small business router vendors already include DNS resolvers on the boxes they sell which work to automatically provide hostnames for addresses that they've served up with DHCP.

vetinari 8y ago

Many already run their own resolvers, so providing DNS-over-HTTPS proxy is not a problem. What is THE problem, is configuring the browser. No one is going to reconfigure their browser after each connection to a different network. There's a reason why we moved from static configuration towards DHCP, which can configure network-specific settings. DNS is a network-specific setting, and Mozilla is breaking it.

topranks 8y ago
That’s really the issue I think, has to be a public server if it’s going to work for mobility. Fixed desktops maybe, but a laptop or phone?
pastage 8y ago
Split horizon was always a bad hack, there has always been alternatives. DoH could be used on the default DNS servers too, there is value of encrypted DNS on LAN as well.
- vetinari 8y ago
  > Split horizon was always a bad hack, there has always been alternatives. I always see this repeated as a mantra, but never it's rationale. No company is going to advertise their internal infrastructure needlessly. There's no upside in the world knowing that your _kdc._tcp.company.com is 192.168.10.20; but there are downsides. > DoH could be used on the default DNS servers too, there is value of encrypted DNS on LAN as well. Sure, but hardcoding or statically-configuring the value is not the way. LANs need to have their DHCP tags respected. If one of them is "use this URL for DoH-server", that's fine.