4 ms·

Why not extent the existing protocol and keep it on port 53, which DNS already uses?

snuxoll 7y ago
Because some companies run with an effective iptables -t filter -A FORWARD -p udp --dport 53 -j DROP And prevent anything from their own internal resolvers from accessing outside DNS services, especially now that encrypted SNI is moving more web filtering to the DNS layer.
- mlyle 7y ago
  But that one is OK. DNS over HTTPS doesn't exist to circumvent enterprise content filtering (hence why you can hint you don't want it to run with a DNS entry, making it vulnerable to downgrade attacks). Easier to make the orgs internal recursive resolver "does the right thing" than all clients, too.
  - growse 7y ago
    > DNS over HTTPS doesn't exist to circumvent enterprise content filtering Replace "enterprise" with "ISP" or "nation state", and that's closer to what the DoH aims are.
- unionpivo 7y ago
  Sure, if you have internal only sites, you pretty much have to, and this is used even in small and medium shops. DOH will cause so much drama when internal sites wont resolve any more.
  - lazylizard 7y ago
    Its perfectly ok to let your internal sites be resolved outside your network? Abc.internal resolves to 192.168.0.101 is fine?
    - growse 7y ago
      What's the risk?
    - isostatic 7y ago
      How do you do PTR records? (what hostname is 10.12.43.122) How do you do split DNS? (Inside my network I want it pointing to my internal server) Now you could argue that the fault in both of those cases is IPv4 and the natting that comes with it.
      - lazylizard 7y ago
        i don't get the ptr problem. My internal sites already have ptr records. My dns server sits facing the internet. Ptr records too. But yes. If u have a domain that is supposed to resolve different depending on the source ip that'd be..interesting... Now u need a website that displays different content depending on source ip or something like that...
        isostatic 7y ago
        If your machine is pointing to doh on the Internet, how does a reverse lookup for an rfc1918 address work? One issue with doh is that it’s inconsistent - some applications use one resolver, some use another. The network (via dhcp) can’t hint at which resolver to use.
    - unionpivo 7y ago
      i'd prefer not to. We work for a number of different clients, and its common to have pg11-clientanme.* and node-clientname.* ... I have over 200 domains internally, that i don't have externally. but its also flexibility. We often when we develop, want to redirect certain domains to our endpoints, for testing or whatever, and do that on DNS so that not everyone has to edit host files etc. we have pfsense internally, with number of people that can and do add/remove hosts/domains on daily basis, but host our external DNS on CF, and only 2 people have access to that.
baroffoos 7y ago
Middleboxes like to drop any data they don't understand. No doubt there is one out there that is checking that all data on the dns port looks like dns and when encrypted dns is used it gets dropped. Using https for everything means middleboxes can't tell what is going on and just allow it.
- zrm 7y ago
  DNSCurve is specifically designed to look like UDP DNS. The problem isn't that the packets don't validate as DNS, it's that some of the middleboxes modify them, or don't send them to the appropriate server at all and try to answer the query themselves. The protocol then detects that MitM attack and rejects the response -- as well it should, but detecting the attack doesn't get you to working DNS. HTTPS can't save you from that, though, because the same networks that modify DNS queries to third party DNS servers also do things like require you to install a root certificate and then MitM your TLS connections, and drop connections that don't accept their root certificate. In both cases it's the same thing. You can detect the attack but that doesn't get you through.
darkhorn 7y ago
Because some totaliterian governments block illegal web sites like wikipedia.org
marcosdumay 7y ago
My home ISP, for example, will replace anything you request on port 53 by their DNS results, with ads and sites blocked by incompetence.

Because some companies run with an effective iptables -t filter -A FORWARD -p udp --dport 53 -j DROP And prevent anything from their own internal resolvers from accessing outside DNS services, especially now that encrypted SNI is moving more web filtering to the DNS layer.

mlyle 7y ago
But that one is OK. DNS over HTTPS doesn't exist to circumvent enterprise content filtering (hence why you can hint you don't want it to run with a DNS entry, making it vulnerable to downgrade attacks). Easier to make the orgs internal recursive resolver "does the right thing" than all clients, too.
- growse 7y ago
  > DNS over HTTPS doesn't exist to circumvent enterprise content filtering Replace "enterprise" with "ISP" or "nation state", and that's closer to what the DoH aims are.
unionpivo 7y ago
Sure, if you have internal only sites, you pretty much have to, and this is used even in small and medium shops. DOH will cause so much drama when internal sites wont resolve any more.
- lazylizard 7y ago
  Its perfectly ok to let your internal sites be resolved outside your network? Abc.internal resolves to 192.168.0.101 is fine?
  - growse 7y ago
    What's the risk?
  - isostatic 7y ago
    How do you do PTR records? (what hostname is 10.12.43.122) How do you do split DNS? (Inside my network I want it pointing to my internal server) Now you could argue that the fault in both of those cases is IPv4 and the natting that comes with it.
    - lazylizard 7y ago
      i don't get the ptr problem. My internal sites already have ptr records. My dns server sits facing the internet. Ptr records too. But yes. If u have a domain that is supposed to resolve different depending on the source ip that'd be..interesting... Now u need a website that displays different content depending on source ip or something like that...
      - isostatic 7y ago
        If your machine is pointing to doh on the Internet, how does a reverse lookup for an rfc1918 address work? One issue with doh is that it’s inconsistent - some applications use one resolver, some use another. The network (via dhcp) can’t hint at which resolver to use.
  - unionpivo 7y ago
    i'd prefer not to. We work for a number of different clients, and its common to have pg11-clientanme.* and node-clientname.* ... I have over 200 domains internally, that i don't have externally. but its also flexibility. We often when we develop, want to redirect certain domains to our endpoints, for testing or whatever, and do that on DNS so that not everyone has to edit host files etc. we have pfsense internally, with number of people that can and do add/remove hosts/domains on daily basis, but host our external DNS on CF, and only 2 people have access to that.

baroffoos 7y ago

Middleboxes like to drop any data they don't understand. No doubt there is one out there that is checking that all data on the dns port looks like dns and when encrypted dns is used it gets dropped. Using https for everything means middleboxes can't tell what is going on and just allow it.

zrm 7y ago
DNSCurve is specifically designed to look like UDP DNS. The problem isn't that the packets don't validate as DNS, it's that some of the middleboxes modify them, or don't send them to the appropriate server at all and try to answer the query themselves. The protocol then detects that MitM attack and rejects the response -- as well it should, but detecting the attack doesn't get you to working DNS. HTTPS can't save you from that, though, because the same networks that modify DNS queries to third party DNS servers also do things like require you to install a root certificate and then MitM your TLS connections, and drop connections that don't accept their root certificate. In both cases it's the same thing. You can detect the attack but that doesn't get you through.

darkhorn 7y ago

Because some totaliterian governments block illegal web sites like wikipedia.org

marcosdumay 7y ago

My home ISP, for example, will replace anything you request on port 53 by their DNS results, with ads and sites blocked by incompetence.