3 ms·

If you follow the DNS specs this will not a problem. If you use *.local for local domain names DoH will never be triggered From Mozilla documentation. "loc

If you follow the DNS specs this will not a problem. If you use *.local for local domain names DoH will never be triggered From Mozilla documentation. "localhost" and names in the ".local" TLD will never be resolved via DOH. [1] Lan based services are pretty common use case. Mozilla is hardly going to release this feature without considering this. The Cloudflare / Archive.is point is esoteric debate and not a common occurence, DoH does support other providers than Cloudflare so not sure if this really a major concern [1] https://wiki.mozilla.org/Trusted_Recursive_Resolver https://wiki.mozilla.org/Trusted_Recursive_Resolver

bscphil 6y ago
> If you follow the DNS specs this will not a problem. If you use *.local for local domain names DoH will never be triggered I don't think PFsense + Unbound supports appending .local to every hostname automatically, so I'd have to change every last one of my hostnames to whatever.local and that seems like a real pain. (Surely most people are not using whatever.local in their /etc/hostname, right?) > The Cloudflare / Archive.is point is esoteric debate and not a common occurence, DoH does support other providers than Cloudflare so not sure if this really a major concern Sure, but my general point is that there's all sorts of different reasons why it can be useful for a LAN administrator to override the remote DNS response in certain specific cases. Given that Firefox is using Cloudflare by default, the fact that you can change it also doesn't really help anything, since after all the thing I'm specifically complaining about is that stuff randomly breaks for any of your guests using Firefox.
- manquer 6y ago
  It is perhaps reason for you(and others) not wanting migrate, however there is nothing wrong in the way DoH functionality is implemented. Cloudflare broke a lot of traffic when the 1.1.1.1 dns server came up, google broke lot of dev setups when they got the . dev TLD, however it is not theit fault though.
- shawnz 6y ago
  Yes it does, you set it in System > General Setup: https://docs.netgate.com/pfsense/en/latest/config/general.html https://docs.netgate.com/pfsense/en/latest/config/general.ht... Then it will automatically register them in DNS with that name: https://docs.netgate.com/pfsense/en/latest/services/dns/resolver.html https://docs.netgate.com/pfsense/en/latest/services/dns/reso... > The domain name from System > General Setup is used as the domain name on the hosts. Then in the DHCP configuration, you set the domain name as well (defaults to using the general setting): https://docs.netgate.com/pfsense/en/latest/services/dhcp/ipv4.html#general-options https://docs.netgate.com/pfsense/en/latest/services/dhcp/ipv... > Specifies the domain name passed to the client to form its fully qualified hostname. If the Domain Name is left blank, then the domain name of the firewall it sent to the client. The client will automatically try adding the domain when looking up hostnames. Normally on Linux the FQDN is not specified in /etc/hostname but only in /etc/hosts.

bscphil 6y ago

> If you follow the DNS specs this will not a problem. If you use *.local for local domain names DoH will never be triggered I don't think PFsense + Unbound supports appending .local to every hostname automatically, so I'd have to change every last one of my hostnames to whatever.local and that seems like a real pain. (Surely most people are not using whatever.local in their /etc/hostname, right?) > The Cloudflare / Archive.is point is esoteric debate and not a common occurence, DoH does support other providers than Cloudflare so not sure if this really a major concern Sure, but my general point is that there's all sorts of different reasons why it can be useful for a LAN administrator to override the remote DNS response in certain specific cases. Given that Firefox is using Cloudflare by default, the fact that you can change it also doesn't really help anything, since after all the thing I'm specifically complaining about is that stuff randomly breaks for any of your guests using Firefox.

manquer 6y ago
It is perhaps reason for you(and others) not wanting migrate, however there is nothing wrong in the way DoH functionality is implemented. Cloudflare broke a lot of traffic when the 1.1.1.1 dns server came up, google broke lot of dev setups when they got the . dev TLD, however it is not theit fault though.
shawnz 6y ago
Yes it does, you set it in System > General Setup: https://docs.netgate.com/pfsense/en/latest/config/general.html https://docs.netgate.com/pfsense/en/latest/config/general.ht... Then it will automatically register them in DNS with that name: https://docs.netgate.com/pfsense/en/latest/services/dns/resolver.html https://docs.netgate.com/pfsense/en/latest/services/dns/reso... > The domain name from System > General Setup is used as the domain name on the hosts. Then in the DHCP configuration, you set the domain name as well (defaults to using the general setting): https://docs.netgate.com/pfsense/en/latest/services/dhcp/ipv4.html#general-options https://docs.netgate.com/pfsense/en/latest/services/dhcp/ipv... > Specifies the domain name passed to the client to form its fully qualified hostname. If the Domain Name is left blank, then the domain name of the firewall it sent to the client. The client will automatically try adding the domain when looking up hostnames. Normally on Linux the FQDN is not specified in /etc/hostname but only in /etc/hosts.