3 ms·
If you are a stubborn troglodyte like me and have your own secure DNS solution in place, then you can add the following domain to your local DNS to always NXDOM
by LinuxBender 7y ago
If you are a stubborn troglodyte like me and have your own secure DNS solution in place, then you can add the following domain to your local DNS to always NXDOMAIN: use-application-dns.net to tell the resolver to use local network DNS settings. And then of course, null route all the DoH resolvers.
I am somewhat curious what the fallout would be if ISP's decided to NXDOMAIN that domain. Would they get in any trouble?
- EvanAnderson 7y agoIf your DNS server doesn't easily allow you to return an NXDOMAIN (the DNS server in Windows Server is this way, for example) you can also just create an empty zone for "use-application-dns.net". As long as no "A" or "AAAA" records are returned the conditions for the canary will be satisfied.
- asveikau 7y agoI added that after I read about it from mozilla. Is there cross-vendor support for that same canary? It would be nice if implementers standardize on that.
- jlgaddis 7y agoMozilla stated previously that if the bypassing was "abused" (such as by ISPs), they'd effectively just ignore it (paraphrasing) and continue to use DoH anyways.