3 ms·
The only pushback I saw on DoH was from network admins who want DoT so they can MITM/block it easily. Firefox lets you set the DoH endpoint anyways so you can
by brobinson 4y ago
The only pushback I saw on DoH was from network admins who want DoT so they can MITM/block it easily. Firefox lets you set the DoH endpoint anyways so you can run your own resolver (dnscrypt-proxy or whatever).
- thayne 4y agoIt caused a lot of problems for me, because of employees who complained that they couldn't reach anything on the internal network because firefox switched to using the default DoH instead of the system DNS. We configured the canary domain, but the heuristic for using that was pretty buggy in the beginning, and still isn't completely reliable. Sure we can tell them to disable DoH or change the DoH endpoint, but that's one more thing to worry about onboarding. And if you don't already have enterprise policies set up, then configuring that just for DoH is a huge pain.
- brobinson 4y agoI'm not sure what size your company is, but Mozilla adds/changes stuff in new releases fairly frequently so you may want to get on the policy train sooner rather than later if your size makes it sensible to do so.