3 ms·

> DNS over HTTPS will prevent clients in your network from using the default local DNS services. Relevant: Windows will improve user privacy with DNS over HTTP

by scoutt 7y ago

> DNS over HTTPS will prevent clients in your network from using the default local DNS services. Relevant: Windows will improve user privacy with DNS over HTTPS https://news.ycombinator.com/item?id=21562295 https://news.ycombinator.com/item?id=21562295

rndomsrmn 7y ago
Mozilla added a feature to allow users to disable DOH network wide (also supported by the notracking list). Info from notracking: https://github.com/notracking/hosts-blocklists#dns-over-https-doh https://github.com/notracking/hosts-blocklists#dns-over-http... Info from Mozilla: https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di... Not sure if Microsoft will do something similar? Else there is still the option to set up your own (local) DOH server and let your router route all DOH traffic to your local DOH instance.
- scoutt 7y ago
  AFAIK, being HTTP, you won't be able to differentiate and/or route it. And it can be done outside the control of the OS or browser (with js embedded in a page, application, etc.) so even if you configure your browser/system, it still will pass through filters unless whole domains are filtered? Since pihole and dnsmasq are already requiring disabling DoH, I see DoH as the dead of these kinds of adblock systems.
  - rndomsrmn 7y ago
    You will know on forehand what the fixed DOH servers will be, how else would you be able to locate them? If for example they will use the 1.1.1.1 DOH instance, you can simply redirect all localnet 1.1.1.1 (80/53) traffic to your own local (DOH)DNS(masq). Besides that there must be a fallback option for network admins, since using dns filtering and localnet dns is very common in enterprise. Firefox implemented a canary domain, specifically designed for this purpose, see: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...

by scoutt 7y ago

rndomsrmn 7y ago

Mozilla added a feature to allow users to disable DOH network wide (also supported by the notracking list). Info from notracking: https://github.com/notracking/hosts-blocklists#dns-over-https-doh https://github.com/notracking/hosts-blocklists#dns-over-http... Info from Mozilla: https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di... Not sure if Microsoft will do something similar? Else there is still the option to set up your own (local) DOH server and let your router route all DOH traffic to your local DOH instance.

scoutt 7y ago
AFAIK, being HTTP, you won't be able to differentiate and/or route it. And it can be done outside the control of the OS or browser (with js embedded in a page, application, etc.) so even if you configure your browser/system, it still will pass through filters unless whole domains are filtered? Since pihole and dnsmasq are already requiring disabling DoH, I see DoH as the dead of these kinds of adblock systems.
- rndomsrmn 7y ago
  You will know on forehand what the fixed DOH servers will be, how else would you be able to locate them? If for example they will use the 1.1.1.1 DOH instance, you can simply redirect all localnet 1.1.1.1 (80/53) traffic to your own local (DOH)DNS(masq). Besides that there must be a fallback option for network admins, since using dns filtering and localnet dns is very common in enterprise. Firefox implemented a canary domain, specifically designed for this purpose, see: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...