5 ms·

Nice to see they'll be making it easy to opt out. I use a Pihole on my network and this would be an enormous PITA if it was hard (or worse, impossible) to disa

Nice to see they'll be making it easy to opt out. I use a Pihole on my network and this would be an enormous PITA if it was hard (or worse, impossible) to disable... Edit: I forgot, as another commenter pointed out, they also have a canary domain (use-application-dns.net) that you can blackhole to disable this at the network level (unless the user manually enables DoH).

warhorse10_9 5y ago
You can also just set the policy to disable this in registry or using policy.json on Linux. Mac has a similar setup, i'm just not familiar with it.
- CarelessExpert 5y ago
  Yeah, I ended up going the canary domain route, and then setting up my pihole itself to use DoH using cloudflared outbound. Best of both worlds!
  - iso1210 5y ago
    Yes, canary domain is fine - at least while it still works. I don't want to have to configure DNS for 50 different applications on 20 different machines. My OS does DNS, and my DHCP server doles out the DNS server I want my machines to use.
    - CarelessExpert 5y ago
      The Mozilla page on the topic (https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...) notes that: > The use of this domain is specified by Mozilla, as a limited-time measure until a method for signaling the presence of DNS-based content filtering is defined and adopted by an Internet standards body. Presumably that'd be the IETF, and I have no idea which committee would be working on this, if there's a draft RFC in the works, etc. But it's clear the expectation is some sort of standard mechanism will eventually replace the canary domain that yields the same functionality but in a less hacky way.
      - Arnavion 5y ago
        There was [1] which would've allowed websites to specify custom DoH resolvers for their subdomains, but it expired some time ago. The same authors are now working on [2] instead, which AFAICT is basically for the same thing. There's also [3] which is a way for the DHCP server to also provide DoT and DoH servers to the LAN (in addition to the usual DNS servers). [1]: https://datatracker.ietf.org/doc/draft-pauly-add-resolver-discovery/ https://datatracker.ietf.org/doc/draft-pauly-add-resolver-di... [2]: https://datatracker.ietf.org/doc/draft-ietf-add-ddr/ https://datatracker.ietf.org/doc/draft-ietf-add-ddr/ [3]: https://datatracker.ietf.org/doc/draft-ietf-add-dnr/ https://datatracker.ietf.org/doc/draft-ietf-add-dnr/
Arnavion 5y ago
PSA for network admins: Note that use-application-dns.net must return NXDOMAIN, not (successfully) resolve to 0.0.0.0. I see plenty of people just adding it to their hosts file blacklists / DNS overrides like they do for other ad and malware domains, such that it resolves to a bad IP like 0.0.0.0. That's not what you should be doing in this case.

warhorse10_9 5y ago

You can also just set the policy to disable this in registry or using policy.json on Linux. Mac has a similar setup, i'm just not familiar with it.

CarelessExpert 5y ago
Yeah, I ended up going the canary domain route, and then setting up my pihole itself to use DoH using cloudflared outbound. Best of both worlds!
- iso1210 5y ago
  Yes, canary domain is fine - at least while it still works. I don't want to have to configure DNS for 50 different applications on 20 different machines. My OS does DNS, and my DHCP server doles out the DNS server I want my machines to use.
  - CarelessExpert 5y ago
    The Mozilla page on the topic (https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...) notes that: > The use of this domain is specified by Mozilla, as a limited-time measure until a method for signaling the presence of DNS-based content filtering is defined and adopted by an Internet standards body. Presumably that'd be the IETF, and I have no idea which committee would be working on this, if there's a draft RFC in the works, etc. But it's clear the expectation is some sort of standard mechanism will eventually replace the canary domain that yields the same functionality but in a less hacky way.
    - Arnavion 5y ago
      There was [1] which would've allowed websites to specify custom DoH resolvers for their subdomains, but it expired some time ago. The same authors are now working on [2] instead, which AFAICT is basically for the same thing. There's also [3] which is a way for the DHCP server to also provide DoT and DoH servers to the LAN (in addition to the usual DNS servers). [1]: https://datatracker.ietf.org/doc/draft-pauly-add-resolver-discovery/ https://datatracker.ietf.org/doc/draft-pauly-add-resolver-di... [2]: https://datatracker.ietf.org/doc/draft-ietf-add-ddr/ https://datatracker.ietf.org/doc/draft-ietf-add-ddr/ [3]: https://datatracker.ietf.org/doc/draft-ietf-add-dnr/ https://datatracker.ietf.org/doc/draft-ietf-add-dnr/

Arnavion 5y ago

PSA for network admins: Note that use-application-dns.net must return NXDOMAIN, not (successfully) resolve to 0.0.0.0. I see plenty of people just adding it to their hosts file blacklists / DNS overrides like they do for other ad and malware domains, such that it resolves to a bad IP like 0.0.0.0. That's not what you should be doing in this case.