5 ms·

Why? Don't you know how to disable or point to your own DoH?

est31 4y ago
If the device e.g. your smart TV, has an option for it, then you can do that. If it hardcodes a bunch of resolvers, you can't do much about it.
- darkhorn 4y ago
  In Android you can disable it or point it to your own DoH. Classic DNS resolvers can have same "hardcoded" problem.
  - est31 4y ago
    With classic DNS resolvers you can modify the responses on the fly as long as you provide the box its network. Not possible with DoH.
  - iso1631 4y ago
    You just nat UDP/53 traffic and resolve it yourself. Now you have to identify the specific DoH server they're using and block it, and hope it falls back to something you can control.
- Melatonic 4y ago
  Theoretically you can run a firewall that blocks all common resolvers but its more work
WesolyKubeczek 4y ago
There have been devices that used 8.8.8.8 no matter what your network said. Now, you can obviously make your own 8.8.8.8 for your network, but good luck also supply proper TLS certificates for the encrypted DNS traffic. Yeah, you _still_ can tweak this and you _still_ can configure that, but it’s getting more finicky ever so slightly every time. “Still” is the key, to hint at how volatile it all is.
- madeofpalk 4y ago
  that feels like a separate issue. You should be able to configure DNS servers and the device should respect that.
  - cogman10 4y ago
    The point of DoH is bypassing the network configuration for DNS because of bad network operators (IE, ISPs deciding to play god)
    - madeofpalk 4y ago
      The point of DoH is preventing 'others' - such as ISPs - from snooping and interfering with plain-text DNS queries. Encrypting network traffic is generally good. Anything that hijacks DNS requests is going to no longer work, as designed. Devices should still allow setting a custom DoH server, and they should use it. You should still be able to run your own DoH server and use that. Any device/software that ignores your network settings (such as classic DNS or DoH) is bad, just like an ISP intercepting your DNS requests is bad.
      - magicalhippo 4y ago
        So which DHCP option do I use for DoH? All I can find is some expired RFC draft[1]. [1]: https://tools.ietf.org/id/draft-peterson-doh-dhcp-01.html https://tools.ietf.org/id/draft-peterson-doh-dhcp-01.html
        detaro 4y ago
        https://datatracker.ietf.org/doc/draft-ietf-add-ddr/ https://datatracker.ietf.org/doc/draft-ietf-add-ddr/ is the current approach
        magicalhippo 4y ago
        Thanks! More involved but more flexible it seems.

If the device e.g. your smart TV, has an option for it, then you can do that. If it hardcodes a bunch of resolvers, you can't do much about it.

darkhorn 4y ago
In Android you can disable it or point it to your own DoH. Classic DNS resolvers can have same "hardcoded" problem.
- est31 4y ago
  With classic DNS resolvers you can modify the responses on the fly as long as you provide the box its network. Not possible with DoH.
- iso1631 4y ago
  You just nat UDP/53 traffic and resolve it yourself. Now you have to identify the specific DoH server they're using and block it, and hope it falls back to something you can control.
Melatonic 4y ago
Theoretically you can run a firewall that blocks all common resolvers but its more work

WesolyKubeczek 4y ago

There have been devices that used 8.8.8.8 no matter what your network said. Now, you can obviously make your own 8.8.8.8 for your network, but good luck also supply proper TLS certificates for the encrypted DNS traffic. Yeah, you _still_ can tweak this and you _still_ can configure that, but it’s getting more finicky ever so slightly every time. “Still” is the key, to hint at how volatile it all is.

madeofpalk 4y ago
that feels like a separate issue. You should be able to configure DNS servers and the device should respect that.
- cogman10 4y ago
  The point of DoH is bypassing the network configuration for DNS because of bad network operators (IE, ISPs deciding to play god)
  - madeofpalk 4y ago
    The point of DoH is preventing 'others' - such as ISPs - from snooping and interfering with plain-text DNS queries. Encrypting network traffic is generally good. Anything that hijacks DNS requests is going to no longer work, as designed. Devices should still allow setting a custom DoH server, and they should use it. You should still be able to run your own DoH server and use that. Any device/software that ignores your network settings (such as classic DNS or DoH) is bad, just like an ISP intercepting your DNS requests is bad.
    - magicalhippo 4y ago
      So which DHCP option do I use for DoH? All I can find is some expired RFC draft[1]. [1]: https://tools.ietf.org/id/draft-peterson-doh-dhcp-01.html https://tools.ietf.org/id/draft-peterson-doh-dhcp-01.html
      - detaro 4y ago
        https://datatracker.ietf.org/doc/draft-ietf-add-ddr/ https://datatracker.ietf.org/doc/draft-ietf-add-ddr/ is the current approach
        magicalhippo 4y ago
        Thanks! More involved but more flexible it seems.