3 ms·

What are some reasons why someone would prefer to or need to disable it. Just curious.

StreamBright 7y ago
I have Pi-hole on my network and I do not want to use any other DNS provider other than my own (with my own blacklist/whitelist).
djsumdog 7y ago
I'm not sure if disabling it is the right way to go, but I do not plan on letting Firefox ship all my DNS queries to CloudFlare. I do not trust Cloudflare any more (and maybe a little less honestly) than my ISP. I do want a container with my own DNS-over-HTTP running on my own hosted VM (or Digital Ocean, or Vultr or Linode or whoever) and I'll ship my DNS queries there.
- hilbert- 7y ago
  There is an interesting guide (in French) on best-practices to get DoH up and running with dnsdist (https://dnsdist.org https://dnsdist.org) here: https://www.bortzmeyer.org/doh-mon-resolveur.html https://www.bortzmeyer.org/doh-mon-resolveur.html. You might also be interested in looking at https://dnsdist.org/guides/dns-over-https.html https://dnsdist.org/guides/dns-over-https.html
asveikau 7y ago
A lot of networks run their own DNS. You can give resolvable hostnames to hosts internal to the LAN. You can cache queries on an organization-wide boundary and only go to the internet with those queries when the TTL expires. In my home setup I'm already using DNS over TLS to talk to the internet, but on the LAN requests go to my DNS server, get cached there, etc.
jasonjayr 7y ago
Some folks have a dnscrypt server for their LAN already, and/or use Split-Horizon DNS on their networks. Systems are already configured to use those setups at the system level, and having to have per-app dns settings now is madness. I'm in the "this should be done by the system resolver" camp, and I hope they figure out how to push that for all the major platforms ...
rasz 7y ago
My computer, my User agent, my rules. I want to be in 100% control over DNS queries (logging/blocking).
deleted 7y ago
[deleted]
cortesoft 7y ago
To use their etc/hosts entries, to use pihole, to run their own DNS server, etc
Youden 7y ago
It's essentially the same question as "why would you choose another DNS server?" There are numerous other options like Google, Quad9, OpenDNS, OpenNIC, DNSWatch or Verisign, each of which have pros and cons like speed, privacy, reliability or accuracy. Many people also use VPNs which provide DNS servers that are perceived to increase privacy. I know this is currently US only but were it to roll out worldwide, personally I'm in a country with strong legal privacy protections and trust my ISP far more than any American company.
alerighi 7y ago
Why do you want to not disable it I would say. Having DNS over HTTPS not only completely breaks local name resolution (e.g. http://fileserver http://fileserver) and you must manually specify IP addresses in the browser to connect to local hosts, but also if you already have (like I have on my LAN) a local DNS server that does DNS over TLS is useless and also you don't benefit from for example query filtration (I filter out ad servers and trackers from DNS requests)

I have Pi-hole on my network and I do not want to use any other DNS provider other than my own (with my own blacklist/whitelist).

djsumdog 7y ago

I'm not sure if disabling it is the right way to go, but I do not plan on letting Firefox ship all my DNS queries to CloudFlare. I do not trust Cloudflare any more (and maybe a little less honestly) than my ISP. I do want a container with my own DNS-over-HTTP running on my own hosted VM (or Digital Ocean, or Vultr or Linode or whoever) and I'll ship my DNS queries there.

hilbert- 7y ago
There is an interesting guide (in French) on best-practices to get DoH up and running with dnsdist (https://dnsdist.org https://dnsdist.org) here: https://www.bortzmeyer.org/doh-mon-resolveur.html https://www.bortzmeyer.org/doh-mon-resolveur.html. You might also be interested in looking at https://dnsdist.org/guides/dns-over-https.html https://dnsdist.org/guides/dns-over-https.html

asveikau 7y ago

A lot of networks run their own DNS. You can give resolvable hostnames to hosts internal to the LAN. You can cache queries on an organization-wide boundary and only go to the internet with those queries when the TTL expires. In my home setup I'm already using DNS over TLS to talk to the internet, but on the LAN requests go to my DNS server, get cached there, etc.

jasonjayr 7y ago

Some folks have a dnscrypt server for their LAN already, and/or use Split-Horizon DNS on their networks. Systems are already configured to use those setups at the system level, and having to have per-app dns settings now is madness. I'm in the "this should be done by the system resolver" camp, and I hope they figure out how to push that for all the major platforms ...

rasz 7y ago

My computer, my User agent, my rules. I want to be in 100% control over DNS queries (logging/blocking).

deleted 7y ago

[deleted]

cortesoft 7y ago

To use their etc/hosts entries, to use pihole, to run their own DNS server, etc

Youden 7y ago

It's essentially the same question as "why would you choose another DNS server?" There are numerous other options like Google, Quad9, OpenDNS, OpenNIC, DNSWatch or Verisign, each of which have pros and cons like speed, privacy, reliability or accuracy. Many people also use VPNs which provide DNS servers that are perceived to increase privacy. I know this is currently US only but were it to roll out worldwide, personally I'm in a country with strong legal privacy protections and trust my ISP far more than any American company.

alerighi 7y ago

Why do you want to not disable it I would say. Having DNS over HTTPS not only completely breaks local name resolution (e.g. http://fileserver http://fileserver) and you must manually specify IP addresses in the browser to connect to local hosts, but also if you already have (like I have on my LAN) a local DNS server that does DNS over TLS is useless and also you don't benefit from for example query filtration (I filter out ad servers and trackers from DNS requests)