5 ms·

As a sysadmin for an organization with our own internal DNS servers that clients need to hit, how will this impact us? Do I need to deploy a GPO to disable DoH

As a sysadmin for an organization with our own internal DNS servers that clients need to hit, how will this impact us? Do I need to deploy a GPO to disable DoH in order to force FF to keep using our DNS servers?

chaz6 5y ago
This is answered in the FAQ at https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs#w_how-will-doh-impact-enterprises-with-custom-dns-solutions https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs...
- justusthane 5y ago
  Ah, thank you.
gnabgib 5y ago
There's a windows GPO key[0] and a canary domain[1] you can NXDOMAIN (use-application-dns.net). Both of these only control the default (it won't override a user personally choosing the setting). [0]: https://github.com/mozilla/policy-templates/blob/master/README.md#DNSOverHTTPS https://github.com/mozilla/policy-templates/blob/master/READ... [1]: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
- pbhjpbhj 5y ago
  Ah, so users can choose to override the local network administration? I didn't realise that. No way to prevent my family browsing to undesirable and unsafe sites without personally admin-ing each device and/or directly monitoring use? I realise this is currently all leaky, my attitude was to put controls in place (DNS based) and if they learnt to hack around it then they're probably old enough to handle what they find ... doesn't work for malware, etc., however. Presumably enabling DoH makes malware, advertising, etc., impossible to block? When is MS Windows going to use DoH to force access for monitoring, currently I block a few domains.
  - Xylakant 5y ago
    > When is MS Windows going to use DoH to force access for monitoring, currently I block a few domains. Microsoft doesn’t need DoH to circumvent DNS-based blocking. They control the OS and can make it do anything.
    - pbhjpbhj 5y ago
      Have you seen this, MS running network traffic tunneled secretly over other people's networks? Seems like it would be a CMA/CFAA infringement?
      - judge2020 5y ago
        Microsoft has over 125 billion cash on hand[0]. I think they could spare some Azure compute to simply VPN all Windows DNS requests if they wanted (regardless of rfc8484). 0: https://www.microsoft.com/en-us/Investor/earnings/FY-21-Q3/press-release-webcast#:~:text=Total%20cash%2C%20cash%20equivalents%2C%20and%20short-term%20investments https://www.microsoft.com/en-us/Investor/earnings/FY-21-Q3/p... (ctrl f "total cash")
      - Xylakant 5y ago
        I’m not saying they do. They wouldn’t even need to - they control the resolver. They could hardcode IP addresses, use domain fronting, use a CDN to proxy, load a list of IP addresses on every update check, … There are so many ways to circumvent DNS based blocking for someone that controls the resolver and network stack that it’s not even funny any more. The fact that no one has shown that they do any of this tells you that they’re not trying very hard to circumvent blocks. Why would that change with DoH?
  - josephcsible 5y ago
    > No way to prevent my family browsing to undesirable and unsafe sites without personally admin-ing each device No there's not, for good reason. From a technical perspective, this is indistinguishable from an abusive spouse or oppressive government trying to block sites.
tremon 5y ago
You will want to employ DPI anyway, to make sure no other apps/devices on your network subvert your internal security. DoH is just another signature to detect and block.
ocdtrekkie 5y ago
I recommend using Firefox's GPOs anyways: Not just to ensure users can't override disabling DoH, but also to turn off arbitrary extension install (a major malware vector) and other protocols designed to circumvent security inspection like QUIC. If you operate any network security appliances of any kind, browsers are basically built-by-default now to circumvent them, so you need to be configuring them heavily via group policy. Firefox, Chrome, and Edge all offer ADMX templates to add support for their policies pretty much drop-in to Active Directory.
josephcsible 5y ago
Do you use split-horizon DNS, or do all of your internal domains fail to resolve externally? If the former, then add your organization's domains to network.trr.excluded-domains. If the latter, everything will still work without you needing to do anything.
shawnz 5y ago
It will automatically fall back to the internal DNS for names that don't resolve externally, so you might not need to do anything
- SilverRed 5y ago
  This is how it was for me. Our internal names used the network dns and the real domains used DoH

chaz6 5y ago

This is answered in the FAQ at https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs#w_how-will-doh-impact-enterprises-with-custom-dns-solutions https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs...

justusthane 5y ago
Ah, thank you.

gnabgib 5y ago

There's a windows GPO key[0] and a canary domain[1] you can NXDOMAIN (use-application-dns.net). Both of these only control the default (it won't override a user personally choosing the setting). [0]: https://github.com/mozilla/policy-templates/blob/master/README.md#DNSOverHTTPS https://github.com/mozilla/policy-templates/blob/master/READ... [1]: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...

pbhjpbhj 5y ago
Ah, so users can choose to override the local network administration? I didn't realise that. No way to prevent my family browsing to undesirable and unsafe sites without personally admin-ing each device and/or directly monitoring use? I realise this is currently all leaky, my attitude was to put controls in place (DNS based) and if they learnt to hack around it then they're probably old enough to handle what they find ... doesn't work for malware, etc., however. Presumably enabling DoH makes malware, advertising, etc., impossible to block? When is MS Windows going to use DoH to force access for monitoring, currently I block a few domains.
- Xylakant 5y ago
  > When is MS Windows going to use DoH to force access for monitoring, currently I block a few domains. Microsoft doesn’t need DoH to circumvent DNS-based blocking. They control the OS and can make it do anything.
  - pbhjpbhj 5y ago
    Have you seen this, MS running network traffic tunneled secretly over other people's networks? Seems like it would be a CMA/CFAA infringement?
    - judge2020 5y ago
      Microsoft has over 125 billion cash on hand[0]. I think they could spare some Azure compute to simply VPN all Windows DNS requests if they wanted (regardless of rfc8484). 0: https://www.microsoft.com/en-us/Investor/earnings/FY-21-Q3/press-release-webcast#:~:text=Total%20cash%2C%20cash%20equivalents%2C%20and%20short-term%20investments https://www.microsoft.com/en-us/Investor/earnings/FY-21-Q3/p... (ctrl f "total cash")
    - Xylakant 5y ago
      I’m not saying they do. They wouldn’t even need to - they control the resolver. They could hardcode IP addresses, use domain fronting, use a CDN to proxy, load a list of IP addresses on every update check, … There are so many ways to circumvent DNS based blocking for someone that controls the resolver and network stack that it’s not even funny any more. The fact that no one has shown that they do any of this tells you that they’re not trying very hard to circumvent blocks. Why would that change with DoH?
- josephcsible 5y ago
  > No way to prevent my family browsing to undesirable and unsafe sites without personally admin-ing each device No there's not, for good reason. From a technical perspective, this is indistinguishable from an abusive spouse or oppressive government trying to block sites.

tremon 5y ago

You will want to employ DPI anyway, to make sure no other apps/devices on your network subvert your internal security. DoH is just another signature to detect and block.

ocdtrekkie 5y ago

I recommend using Firefox's GPOs anyways: Not just to ensure users can't override disabling DoH, but also to turn off arbitrary extension install (a major malware vector) and other protocols designed to circumvent security inspection like QUIC. If you operate any network security appliances of any kind, browsers are basically built-by-default now to circumvent them, so you need to be configuring them heavily via group policy. Firefox, Chrome, and Edge all offer ADMX templates to add support for their policies pretty much drop-in to Active Directory.

josephcsible 5y ago

Do you use split-horizon DNS, or do all of your internal domains fail to resolve externally? If the former, then add your organization's domains to network.trr.excluded-domains. If the latter, everything will still work without you needing to do anything.

shawnz 5y ago

It will automatically fall back to the internal DNS for names that don't resolve externally, so you might not need to do anything

SilverRed 5y ago
This is how it was for me. Our internal names used the network dns and the real domains used DoH