3 ms·
Hm, so I'm a little new to DoH, and I have it set up on my pi-hole with cloudflared and https://1.1.1.1/dns-query https://1.1.1.1/dns-query. But Mullvad shows
by unethical_ban 4y ago
Hm, so I'm a little new to DoH, and I have it set up on my pi-hole with cloudflared and https://1.1.1.1/dns-query https://1.1.1.1/dns-query.
But Mullvad shows https://doh.mullvad.net/dns-query https://doh.mullvad.net/dns-query.
How does their domain get resolved if it is the resolver? They only show using it for Firefox and Android, so does the OS use "regular" DNS to resolve mullvad, then use DoH for all others? Still seems prime for a misconfiguration.
- DistractionRect 4y agoYes, you usually have to bootstrap DoT or DoH with an unencrypted DNS query. If the IP is static you can add the domain to the hosts file or use the IP in place of the domain (as you can get signed tls certs for the IP address). Cloudflare does this with 1.1.1.1
- interroboink 4y agoIt is a little small on the page[1], but see the "IP-addresses, ports and hostnames" section. In particular: > Note that the hostname is the same for both DoH and DoT despite that the subdomain is “doh”. > > DoT only uses port 853, while DoH uses port 443. > > Without ad blocking: > doh.mullvad.net has address 194.242.2.2 > doh.mullvad.net has IPv6 address 2a07:e340::2 > > With ad blocking: > adblock.doh.mullvad.net has address 194.242.2.3 > adblock.doh.mullvad.net has IPv6 address 2a07:e340::3 So, you can use hardcoded IP addresses (presumably they're static), to avoid that chicken-and-egg problem. [1] https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/ https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/