3 ms·
Comically enough, browser manufacturers aren't going to hardcode the IP of the DoH server. They will look it up using the DNS you already control. Give them a n
by ectospheno 8y ago
Comically enough, browser manufacturers aren't going to hardcode the IP of the DoH server. They will look it up using the DNS you already control. Give them a non-routable address and log the attempt. Then go tell that user to stop.
If some crazy group does hardcode it then they have made your job even easier.
- pmoriarty 8y agoWhy would you refer to a DNS server by domain name and not by IP in the first place?
- adrianmonk 8y agoI can think of some possible motivations: (1) Some kind of load-balancing thing and/or edge DoH servers. It gives you an opportunity to connect to a DoH server near you. Latency matters for DNS, and for traditional DNS, DHCP takes care of hooking you up with a nearby server. This could give comparable functionality for DoH. (This could probably also be done at the IP routing layer. But it's nice to have options.) (2) Decoupling. You can change DoH server IP addresses without releasing a new browser build. And anyway, if you did try to do it by releasing new browser builds, you'd have users who don't bother to update.
- jandrese 8y agoAlso, presumably these services will use pinned certificates so it won't be possible for someone MITM the query for the DNS provider and do anything more than just DOS your DoH.