3 ms·

> You can add an A/AAAA record for use-application-dns.net and Firefox won't turn on DoH on your network unless the user overrides it. Out of curiosity, is the

> You can add an A/AAAA record for use-application-dns.net and Firefox won't turn on DoH on your network unless the user overrides it. Out of curiosity, is there any other software that respects this by default?

jeroenhd 5y ago
So far, Firefox is the only browser that has announced support for this. Chrome takes another approach, which is to test the system DNS server for DoH capabilities and to switch to DoH when the resolver supports it. Chrome does have a fallback to Google's DNS if it determines that your DNS server is broken, but you should be able to disable that. That means you can secure your network by picking an existing DNS server that also provides a DoH server and Chrome should pick it up by default! I believe Microsoft announced a similar approach to Google, but from what I can find you still need to enable DoH manually anyway. In all cases, the end user can override your domain settings unless your group policies (or similar) lock these settings.
- lxgr 5y ago
  Does that really work for arbitrary DNS servers? If so, how? I thought there‘s just a short, hardcoded list of known DoH-supporting DNS IPs.
  - jeroenhd 5y ago
    That's the Firefox approach, yes: provide a list of trusted DoH servers and use that to avoid scummy ISP servers that might monitor, intercept, or mess with DNS records. Chrome has a separate list of DNS servers that it knows can also do DoH. It doesn't change the DNS server, it just changes the mechanism in which the server is queried: - https://blog.chromium.org/2020/05/a-safer-and-more-private-browsing-DoH.html https://blog.chromium.org/2020/05/a-safer-and-more-private-b... - https://blog.chromium.org/2020/09/a-safer-and-more-private-browsing.html https://blog.chromium.org/2020/09/a-safer-and-more-private-b... I believe their intent was to auto upgrade existing all DNS servers if they support DoH, but I'm not so sure anymore; perhaps some other product was doing that instead. In theory it shouldn't be too difficult: send a TLS request to dns.server:443, extract the hostname from the TLS handshake, and do a lookup through https://hostname/dns-query https://hostname/dns-query (with the IP address hardcoded for the socket to prevent redirect attacks).
    - deleted 5y ago
      [deleted]
    - lxgr 5y ago
      Yes, it shouldn't be difficult, but if Chrome isn't doing it, my point is that that would put DNS servers not on that internal list, such as Pi-hole, at a disadvantage.

jeroenhd 5y ago

So far, Firefox is the only browser that has announced support for this. Chrome takes another approach, which is to test the system DNS server for DoH capabilities and to switch to DoH when the resolver supports it. Chrome does have a fallback to Google's DNS if it determines that your DNS server is broken, but you should be able to disable that. That means you can secure your network by picking an existing DNS server that also provides a DoH server and Chrome should pick it up by default! I believe Microsoft announced a similar approach to Google, but from what I can find you still need to enable DoH manually anyway. In all cases, the end user can override your domain settings unless your group policies (or similar) lock these settings.

lxgr 5y ago
Does that really work for arbitrary DNS servers? If so, how? I thought there‘s just a short, hardcoded list of known DoH-supporting DNS IPs.
- jeroenhd 5y ago
  That's the Firefox approach, yes: provide a list of trusted DoH servers and use that to avoid scummy ISP servers that might monitor, intercept, or mess with DNS records. Chrome has a separate list of DNS servers that it knows can also do DoH. It doesn't change the DNS server, it just changes the mechanism in which the server is queried: - https://blog.chromium.org/2020/05/a-safer-and-more-private-browsing-DoH.html https://blog.chromium.org/2020/05/a-safer-and-more-private-b... - https://blog.chromium.org/2020/09/a-safer-and-more-private-browsing.html https://blog.chromium.org/2020/09/a-safer-and-more-private-b... I believe their intent was to auto upgrade existing all DNS servers if they support DoH, but I'm not so sure anymore; perhaps some other product was doing that instead. In theory it shouldn't be too difficult: send a TLS request to dns.server:443, extract the hostname from the TLS handshake, and do a lookup through https://hostname/dns-query https://hostname/dns-query (with the IP address hardcoded for the socket to prevent redirect attacks).
  - deleted 5y ago
    [deleted]
  - lxgr 5y ago
    Yes, it shouldn't be difficult, but if Chrome isn't doing it, my point is that that would put DNS servers not on that internal list, such as Pi-hole, at a disadvantage.