5 ms·
The thing that is still being ignored is the configuration mechanism for the DoH resolver. Currently, the only way to configure it is manual and application-sp
by vetinari 7y ago
The thing that is still being ignored is the configuration mechanism for the DoH resolver.
Currently, the only way to configure it is manual and application-specific; there's no way to configure it for all apps and automatically, like DHCP for the normal, 53/udp DNS. Nobody is going to manually reconfigure their DNS every time they switch network (e.g. home -> office -> customer).
- Znafon 7y agoIs DHCP useful to enforce network policy? What about users who manually set their DNS servers? Wouldn't be a proxy checking the SNI of connections you open better?
- vetinari 7y agoEnforcement is step 2. Proxy with a blacklist of hostnames would do, but unfortunately, with encrypted SNIs on the horizon, full blown https proxy with custom CA enrolled on all machines would be necessary. Step 1 is a mechanism for those, who do not want to fight the network policy, just want the autoconfiguration.
- chupasaurus 7y agoCurrently, the only way to configure DoH for everything is one-time setting local dnscrypt-proxy as the only resolver. Easy on Android 9+ and Linux with systemd, on Windows you have to override DNS settings for all NICs because it has a weird process of resolving. Don't know about macOS, iOS is definitely out. edit P.S: I'd never trust ISP's DNS servers, because it's the easiest way to track what customers does.
- fragmede 7y agoI may trust Comcast as far as I can throw them. I still prefer that they get my data, rather than even more of my browsing data go straight to Google.
- tptacek 7y agoThe point of DoH is that you don't have to send your DNS queries to either of those entities.
- alibert 7y agoFor iOS, you can check out DNSCloak, Adguard, NextDNS, Cloudflare 1.1.1.1, etc. which are all system wide resolver.