5 ms·

In this case blocking outgoing traffic to port 853 would be enough, but it won't stop DNS over HTTP. I've not found a good way to deal with that one if you wan

In this case blocking outgoing traffic to port 853 would be enough, but it won't stop DNS over HTTP. I've not found a good way to deal with that one if you want to control things, other than requiring all devices support your CA and you inspect for it.

dsr_ 4y ago
Things that do DNS over HTTP are asked to respect the use-application-dns.net canary. If use-application-dns.net queries are blocked by the local resolver, the thing should use the local resolver, unless there is a manual override by the human user.
- ghotli 4y ago
  First I've heard of this. Is this in a spec somewhere you happen to be aware of?
  - yagibear 4y ago
    It's mentioned in an expired Internet Draft https://www.ietf.org/archive/id/draft-schwartz-add-ddr-forwarders-01.txt https://www.ietf.org/archive/id/draft-schwartz-add-ddr-forwa... which refers to https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
- codedokode 4y ago
  This is a bad idea. ISPs will use this to force users to send queries in plain text. There is no need for this feature. One might say that a corporation might need this. But why should we care about corporations? Let them use Internet Explorer that sends everything in plain text. Or they could configure using unencrypted DNS in group policy. Encrypted DNS should be indistinguishable from any other HTTPS traffic.
  - dsr_ 4y ago
    Let's suppose that I have a home network, from which I make certain things available to the Internet. Those have public DNS records and appropriate ports are passed through the firewall. I also have a bunch of machines that I like to have names for, but I don't want the Internet as a whole to enumerate them. Why? Because I like my privacy. So I run my DNS in a split-horizon mode: everyone sees www and mail and blog, but only IPs inside my house get to see the A, AAAA and CNAME records for spike and splorch and sporty, den-tv and lr-tv, music and video. But then Firefox and Chrome enable DoH. I can provide DoH, no problem, though I prefer DoTLS. The problem is that they don't ask my local DNS servers via DoH, they ask 1.1.1.1 and 8.8.8.8 or such. And those servers, nice as they are, aren't allowed to see the record for den-tv. So I tell my DNS server to return an error for use-application-dns.net, and everything continues to work. Meanwhile, my friend comes over and sits in my living room, using my wifi, but my friend is paranoid. They don't trust me at all. So they use a VPN back home. Oh, sorry: they trust me enough to be their next hop, but not enough to use my DNS. So they tell their browser affirmatively that it should use DoH to somebody off in The Cloud That Is Certainly Trustworthy, and that works too.
  - noptd 4y ago
    I couldn't disagree more. I'm far more concerned about device vendors leveraging encrypted DNS in order to remove my ability to intercept and filter DNS resolution on my own network. For example, I'm sure Google and pretty much every Smart TV vendor would love it if we could no longer easily block traffic for streaming ads, sending telemetry, etc.

dsr_ 4y ago

Things that do DNS over HTTP are asked to respect the use-application-dns.net canary. If use-application-dns.net queries are blocked by the local resolver, the thing should use the local resolver, unless there is a manual override by the human user.

ghotli 4y ago
First I've heard of this. Is this in a spec somewhere you happen to be aware of?
- yagibear 4y ago
  It's mentioned in an expired Internet Draft https://www.ietf.org/archive/id/draft-schwartz-add-ddr-forwarders-01.txt https://www.ietf.org/archive/id/draft-schwartz-add-ddr-forwa... which refers to https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
codedokode 4y ago
This is a bad idea. ISPs will use this to force users to send queries in plain text. There is no need for this feature. One might say that a corporation might need this. But why should we care about corporations? Let them use Internet Explorer that sends everything in plain text. Or they could configure using unencrypted DNS in group policy. Encrypted DNS should be indistinguishable from any other HTTPS traffic.
- dsr_ 4y ago
  Let's suppose that I have a home network, from which I make certain things available to the Internet. Those have public DNS records and appropriate ports are passed through the firewall. I also have a bunch of machines that I like to have names for, but I don't want the Internet as a whole to enumerate them. Why? Because I like my privacy. So I run my DNS in a split-horizon mode: everyone sees www and mail and blog, but only IPs inside my house get to see the A, AAAA and CNAME records for spike and splorch and sporty, den-tv and lr-tv, music and video. But then Firefox and Chrome enable DoH. I can provide DoH, no problem, though I prefer DoTLS. The problem is that they don't ask my local DNS servers via DoH, they ask 1.1.1.1 and 8.8.8.8 or such. And those servers, nice as they are, aren't allowed to see the record for den-tv. So I tell my DNS server to return an error for use-application-dns.net, and everything continues to work. Meanwhile, my friend comes over and sits in my living room, using my wifi, but my friend is paranoid. They don't trust me at all. So they use a VPN back home. Oh, sorry: they trust me enough to be their next hop, but not enough to use my DNS. So they tell their browser affirmatively that it should use DoH to somebody off in The Cloud That Is Certainly Trustworthy, and that works too.
- noptd 4y ago
  I couldn't disagree more. I'm far more concerned about device vendors leveraging encrypted DNS in order to remove my ability to intercept and filter DNS resolution on my own network. For example, I'm sure Google and pretty much every Smart TV vendor would love it if we could no longer easily block traffic for streaming ads, sending telemetry, etc.