3 ms·
Many already run their own resolvers, so providing DNS-over-HTTPS proxy is not a problem. What is THE problem, is configuring the browser. No one is going to r
by vetinari 8y ago
Many already run their own resolvers, so providing DNS-over-HTTPS proxy is not a problem.
What is THE problem, is configuring the browser. No one is going to reconfigure their browser after each connection to a different network. There's a reason why we moved from static configuration towards DHCP, which can configure network-specific settings. DNS is a network-specific setting, and Mozilla is breaking it.
- topranks 8y agoThat’s really the issue I think, has to be a public server if it’s going to work for mobility. Fixed desktops maybe, but a laptop or phone?
- pastage 8y agoSplit horizon was always a bad hack, there has always been alternatives. DoH could be used on the default DNS servers too, there is value of encrypted DNS on LAN as well.
- vetinari 8y ago> Split horizon was always a bad hack, there has always been alternatives. I always see this repeated as a mantra, but never it's rationale. No company is going to advertise their internal infrastructure needlessly. There's no upside in the world knowing that your _kdc._tcp.company.com is 192.168.10.20; but there are downsides. > DoH could be used on the default DNS servers too, there is value of encrypted DNS on LAN as well. Sure, but hardcoding or statically-configuring the value is not the way. LANs need to have their DHCP tags respected. If one of them is "use this URL for DoH-server", that's fine.