3 ms·
> blocking a canary domain And how long will it take for most ISPs to block this domain when they realize that their DNS servers are not being used anymore? So
by nicolaslem 7y ago
> blocking a canary domain
And how long will it take for most ISPs to block this domain when they realize that their DNS servers are not being used anymore? Some of them sell this data so they see it as a source of revenue.
At this point this canary domain will have the same fate as Do Not Track.
> I look forward to applications taking DNS under their own control.
I am sure I can find a hundred applications/programs resolving domains on my machine. It is unrealistic to configure all of them separately. At this point we are back to the OS providing the configuration for all of them.
- GTP 7y agoThey already stated in the article that if the canary domain will be abused they will disable that check.
- josteink 7y agoYeah. Sounds like another do-not-track then. I’ll keep my firewall-rules banning all DoH-traffic to Cloudflare, just in case.
- mtsr 7y agoNot a bad call, I guess.
- Ayesh 7y agoI suppose you can block the IP 1.1.1.1, but Google serves THEIR DNS at `google.com` on HTTPS port. One of the design choices of DoH to make it look like HTTPS traffic. It's gonna be difficult to block DoH traffic.
- throw0101a 7y ago> One of the design choices of DoH to make it look like HTTPS traffic. Wait until encrypted SNI gets implemented everywhere was well.