4 ms·

I'm sure Pi Hole will have DoH support, so it should be fine as long as you can still change the server (in the browser and/or OS). The only snag might be mobil

I'm sure Pi Hole will have DoH support, so it should be fine as long as you can still change the server (in the browser and/or OS). The only snag might be mobile apps, in case they hardcode a DNS/DoH server instead of using the system config; that may be hard to change without rooting the device.

throw0101a 7y ago
> I'm sure Pi Hole will have DoH support ... We'll see. Pi Hole uses DNSmasq as its DNS (and DHCP) server, and the few DNSmasq mailing list threads I've seen on the topic seem to indicate that the DNSmasq developers are not interested in either DoT or DoH. One said that it would be difficult to implement because of architectural issues IIRC. It may be necessary to use a front-end proxy: * https://dnsdist.org/ https://dnsdist.org/
- kchamplewski 7y ago
  Pi Hole already has documentation on how to use DoH with it, and it already works: https://docs.pi-hole.net/guides/dns-over-https/ https://docs.pi-hole.net/guides/dns-over-https/ Note: this is using cloudflared but that's just a DoH, it can and happily will query whatever provider you tell it to.
  - icebraining 7y ago
    That's for upstream queries, I think we're talking about the connection from the devices to the PiHole.
- portmanteaufu 7y ago
  PiHole has already merged a patch[1] to disable DoH via the global canary[2]. [1] https://github.com/pi-hole/pi-hole/pull/2915 https://github.com/pi-hole/pi-hole/pull/2915 [2] https://use-application-dns.net/ https://use-application-dns.net/
- fulafel 7y ago
  DNSmasq needs to be replaced with something more secure in any event. Hopefully implemented in a memory-safe programming language. https://www.cvedetails.com/vulnerability-list.php?vendor_id=8351&product_id=14557&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=15&sha=c1974d4b960eaac58e9ed44d9ad3a1136cbe3411 https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

throw0101a 7y ago

> I'm sure Pi Hole will have DoH support ... We'll see. Pi Hole uses DNSmasq as its DNS (and DHCP) server, and the few DNSmasq mailing list threads I've seen on the topic seem to indicate that the DNSmasq developers are not interested in either DoT or DoH. One said that it would be difficult to implement because of architectural issues IIRC. It may be necessary to use a front-end proxy: * https://dnsdist.org/ https://dnsdist.org/

kchamplewski 7y ago
Pi Hole already has documentation on how to use DoH with it, and it already works: https://docs.pi-hole.net/guides/dns-over-https/ https://docs.pi-hole.net/guides/dns-over-https/ Note: this is using cloudflared but that's just a DoH, it can and happily will query whatever provider you tell it to.
- icebraining 7y ago
  That's for upstream queries, I think we're talking about the connection from the devices to the PiHole.
portmanteaufu 7y ago
PiHole has already merged a patch[1] to disable DoH via the global canary[2]. [1] https://github.com/pi-hole/pi-hole/pull/2915 https://github.com/pi-hole/pi-hole/pull/2915 [2] https://use-application-dns.net/ https://use-application-dns.net/
fulafel 7y ago
DNSmasq needs to be replaced with something more secure in any event. Hopefully implemented in a memory-safe programming language. https://www.cvedetails.com/vulnerability-list.php?vendor_id=8351&product_id=14557&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=15&sha=c1974d4b960eaac58e9ed44d9ad3a1136cbe3411 https://www.cvedetails.com/vulnerability-list.php?vendor_id=...