4 ms·

I predict that DoH will break many enterprise infrastructures that rely on custom DNS servers. Unwary sysadmins that update Firefox will be in a lot of trouble

I predict that DoH will break many enterprise infrastructures that rely on custom DNS servers. Unwary sysadmins that update Firefox will be in a lot of trouble when they switch this on by default. We ourselves have a custom DNS setup with an only internally resolvable TLD as a security measure, so this change will break our infra for all Firefox users (thankfully we’re in the EU so we’re spared, for now). Good thing that Cloudflare wants to centralize DNS and access control anyway, so those enterprises can just switch to their proprietary DNS service and VPN replacement, I guess ;)

snek 7y ago
There is already support for enterprise situations like you describe: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
- ThePhysicist 7y ago
  Well, ok, but this requires updating all company DNS servers so it’s still far from ideal I would say. They should have done it the other way around: if the DNS returns a specific response enable DoH, otherwise leave it alone.
qmarchi 7y ago
Firefox by default is configured with a fallback option, where if resolution would fail, it will fallback to the system-provided DNS servers. So your internal TLDs are safe. Additionally, if you've setup Firefox to be installed with Firefox for Enterprise, DoH is disabled by default and you've got nothing to worry about. DOH is able to be configured through GPO as well, allowing the use of a custom server.
- alerighi 7y ago
  And that is even more dangerous, it would mean that if for some reason an identical domain extists on the internet (or somebody registers it to do an attack) then all the hosts will connect to the malicious external domain and not the correct host in the internal network. Local hosts should be resolved FIRST. Also cloudfare this way gets the DNS names of your internal hosts, you are leaking information that otherwise would be private, and system administrator will probably not think about that! Also with that option is not really secure at all, if somebody wants to intercept your DNS requests he can simply block the IPs of Cloudfare DNS over HTTPS server and then read the DNS requests unencrypted.
  - qmarchi 7y ago
    In all reality, your Enterprise should own the domain externally. What happens if one day a configuration flag is flipped and you're no longer resolving internally the domain? If you have a problem with Cloudflare, go setup your own, it's just BIND9 with some SSL certs.
  - blackearl 7y ago
    You should only use a domain you own or something that isn't routable. You can't blame FF for that
    - rovr138 7y ago
      That was an issue with .dev and then google acquired the TLD.
      - qw3rty01 7y ago
        .dev isn't an rfc2606 reserved TLD, so it shouldn't have been used for internal domains in the first place
        rovr138 7y ago
        Replying to the part about ‘something that isn’t routable’ Not because something is not routable means that there won’t be issues.

snek 7y ago

There is already support for enterprise situations like you describe: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...

ThePhysicist 7y ago
Well, ok, but this requires updating all company DNS servers so it’s still far from ideal I would say. They should have done it the other way around: if the DNS returns a specific response enable DoH, otherwise leave it alone.

qmarchi 7y ago

Firefox by default is configured with a fallback option, where if resolution would fail, it will fallback to the system-provided DNS servers. So your internal TLDs are safe. Additionally, if you've setup Firefox to be installed with Firefox for Enterprise, DoH is disabled by default and you've got nothing to worry about. DOH is able to be configured through GPO as well, allowing the use of a custom server.

alerighi 7y ago
And that is even more dangerous, it would mean that if for some reason an identical domain extists on the internet (or somebody registers it to do an attack) then all the hosts will connect to the malicious external domain and not the correct host in the internal network. Local hosts should be resolved FIRST. Also cloudfare this way gets the DNS names of your internal hosts, you are leaking information that otherwise would be private, and system administrator will probably not think about that! Also with that option is not really secure at all, if somebody wants to intercept your DNS requests he can simply block the IPs of Cloudfare DNS over HTTPS server and then read the DNS requests unencrypted.
- qmarchi 7y ago
  In all reality, your Enterprise should own the domain externally. What happens if one day a configuration flag is flipped and you're no longer resolving internally the domain? If you have a problem with Cloudflare, go setup your own, it's just BIND9 with some SSL certs.
- blackearl 7y ago
  You should only use a domain you own or something that isn't routable. You can't blame FF for that
  - rovr138 7y ago
    That was an issue with .dev and then google acquired the TLD.
    - qw3rty01 7y ago
      .dev isn't an rfc2606 reserved TLD, so it shouldn't have been used for internal domains in the first place
      - rovr138 7y ago
        Replying to the part about ‘something that isn’t routable’ Not because something is not routable means that there won’t be issues.