> and I should be able to tell devices where to send DNS requests But you can't. Even if DoH went away today, even if Mozilla and everyone else dropped the tec

> and I should be able to tell devices where to send DNS requests But you can't. Even if DoH went away today, even if Mozilla and everyone else dropped the technology, you still don't actually have the ability to do that. Devices will still be able to ignore you. It's not DoH's fault if devices on your network don't use your network-wide DNS resolver. IOT devices were going to move in that direction regardless. Increasingly, your smart TVs are going to ignore your network settings. They might not even make DNS requests over the correct port. They might hide them in normal Internet traffic. They might cache them locally. They might make a request for a domain that looks safe, and then use a different IP address that they have cached locally. They might even ship with their own embedded 5G chip and use it for specific exfiltration requests and updates. They might join your local network, read all of your unencrypted traffic, and then use a 5G chip to separately send data out. If you think that blocking DoH will solve these kinds of problems, I feel like you are putting way, way too much faith into your existing DNS setup. > Anything that does not do what I tell it to do is malware IMHO Okay, that seems completely reasonable. However, my perspective is that any network that will MITM my requests or monitor what websites I visit without my permission is malicious IMHO. It sounds like the answer here is to block access to your network for devices that you don't trust, or to try and quarantine them -- not to demand that my personal device stop respecting my own entered DNS settings whenever it joins a new network. To argue that my installation of Firefox or that my OS shouldn't be able to ignore network settings anywhere and that I shouldn't be able to choose how my requests are encrypted, just because it makes it easier for you specifically to enforce your network's security policy without explicit opt-in or consent -- I don't know, it just seems pretty backwards to me from how this kind of security stuff is normally supposed to work. I know that this stuff will make it harder for some network operators to do their jobs but... so did HTTPS. I heard literally the exact same complaints during the early push to get every website encrypted. But we live with it, and now if you want to monitor my unencrypted network traffic, you need to get my permission to install a certificate. Control and consent slowly moves away from networks and onto devices over time, closer to the users themselves.