4 ms·

Well, it certainly changes the equation from being a rogue element on a network to something that is just another management setting. I won't be truly happy un

Well, it certainly changes the equation from being a rogue element on a network to something that is just another management setting. I won't be truly happy until I can setup a DoH server of my own. Does anyone know if there is any value to adding DoH to the external servers that are only used by other name servers? Will anyone's name servers do their lookup with DoH? The less the outside world knows about what's on a private network the better. Information leaking be it the processor or to someone's servers is just another problem waiting to happen.

zamadatix 7y ago
What's stopping you from setting up a DoH server of your own today? DoH is only focusing to encrypt the first hop for now as it was easiest to hit and where the majority of the problem is.
- protomyth 7y ago
  Because no OS would use it. I'm against web browsers (or frankly any other client program) using a DNS other than what the OS is set for.
  - psanford 7y ago
    Its really not that hard. I've got /etc/resolv.conf pointed at 127.0.0.1 and a local stub resolver forwarding to an upstream DOH server. Boom! everything using gethostbyname is now using DOH.
    - protomyth 7y ago
      We have a private network with many internal servers and many operating systems. Having browsers skip our name servers is a problem.
      - zamadatix 7y ago
        The above solution has nothing to do with browsers.
        protomyth 7y ago
        but it doesn't work on a bunch of machines - this is not about individual machines but a network.
tptacek 7y ago
You can set up a DoH server today. You can then configure Firefox to use that server by configuring it as a "custom provider" (Chrome is even simpler, and never defaulted you to an alternate DNS server to begin with).
- protomyth 7y ago
  I realize I can configure Firefox, but I am against my browser not using what the OS provides. Since no OS currently uses DoH, I have no real incentive to set one up. Plus, the number of DNS software that has added DoH is pretty small.

zamadatix 7y ago

What's stopping you from setting up a DoH server of your own today? DoH is only focusing to encrypt the first hop for now as it was easiest to hit and where the majority of the problem is.

protomyth 7y ago
Because no OS would use it. I'm against web browsers (or frankly any other client program) using a DNS other than what the OS is set for.
- psanford 7y ago
  Its really not that hard. I've got /etc/resolv.conf pointed at 127.0.0.1 and a local stub resolver forwarding to an upstream DOH server. Boom! everything using gethostbyname is now using DOH.
  - protomyth 7y ago
    We have a private network with many internal servers and many operating systems. Having browsers skip our name servers is a problem.
    - zamadatix 7y ago
      The above solution has nothing to do with browsers.
      - protomyth 7y ago
        but it doesn't work on a bunch of machines - this is not about individual machines but a network.

tptacek 7y ago

You can set up a DoH server today. You can then configure Firefox to use that server by configuring it as a "custom provider" (Chrome is even simpler, and never defaulted you to an alternate DNS server to begin with).

protomyth 7y ago
I realize I can configure Firefox, but I am against my browser not using what the OS provides. Since no OS currently uses DoH, I have no real incentive to set one up. Plus, the number of DNS software that has added DoH is pretty small.