4 ms·

I don’t completely understand this. Isn’t the purpose of DoH to increase privacy? But then if I go to a coffee shop that wants to inspect my DNS queries, they

I don’t completely understand this. Isn’t the purpose of DoH to increase privacy? But then if I go to a coffee shop that wants to inspect my DNS queries, they can respond for this mentioned domain in a certain way, and it will result in DoH being disabled and leaving the coffee shop free to inspect the unencrypted DNS I am making?

opheliate 3y ago
Not entirely certain, but I think to some degree this is a way for the network to say, “I will not respect your privacy, so don’t try”. If a network implements DNS-based content filtering and blocks DOH requests, not responding to a query for this domain could allow an application to know to not bother trying DOH, since it will definitely fail every time. I could be totally off the mark here, though.
- donmcronald 3y ago
  > and blocks DOH requests It’s on port 443, probably to the IP of a huge CDN. How would you block it?
  - LinuxBender 3y ago
    This comes up in discussions quite a bit but in practice I have never seen that become a thing. There is technically nothing stopping a DNS provider from using random CDN nodes but unless you have found a working exception they all have well defined static IP addresses, sometimes even novelty IP's. Perhaps some day they will do this at the risk of CDN nodes getting blocked. I block DoH/DoT quite successfully on my network, not to invade privacy but to block privacy invading sites and usage statistics that the current DoH/DoT providers gather. Thus far it has not been an issue. I was surprised to find that cell phones automagically discover my DoT 853 listener on my firewall that is served up by Unbound. I do have a "_dns.resolver.arpa" hint record but nothing has ever queried it.
    - donmcronald 3y ago
      > This comes up in discussions quite a bit but in practice I have never seen that become a thing. How would you even know it’s happening? Is it even possible to snoop on HTTPS traffic if you have a mobile device like an iPhone? Making it impossible to see is the entire point AFAIK.
      - LinuxBender 3y ago
        I have physical access to the devices and I can also see every device that is registered in DHCP making queries to Unbound. Unless a specific application is leaking requests to 443 I can say with certainty that they are using my DNS server. People on my network appreciate the ad blocking and I would hear about it if that stopped working. [Edit] I should also add that I do not block VPN's. If someone wants to manually bypass my DNS they can do so with a VPN client. Perhaps some day all the browsers will start creating VPN tunnels to random CDN's on 443.
        donmcronald 3y ago
        So you can tell they’re not using your DNS server, but you said: > I block DoH/DoT quite successfully on my network How do you block encrypted traffic that’s mixed in with normal HTTPS? I get that you can block the well known IPs, but that’s only a partial solution.
  - opheliate 3y ago
    Ah of course, sorry, teaches me to speak without thinking.
johnklos 3y ago
DoH only increases privacy if the DoH provider is demonstrably more honest and privacy concerned than the network you're on. Mozilla defaults to Cloudflare, and Cloudflare are deceptive, disingenuous, and scammer friendly. Plus, many of us who care about privacy believe Cloudflare would sell access to the data they collect (the DNS lookups) to the US government for the right price. The argument for this is specious at best - people who don't care enough to change their own DNS servers on their own networks apparently have to be saved from themselves, which is why Firefox decided to turn it on without prompting the user, in spite of many people complaining about changing the default without asking. Enabling this canary domain doesn't disable DoH, if you've explicitly turned it and/or configured DoH with your own settings. DoH still stays on.
- traceroute66 3y ago
  > many of us who care about privacy believe Cloudflare would sell access to the data they collect The Cloudflare DoH privacy policy is already one of the least privacy friendly, so anyone who remotely cares about their privacy should not be using Cloudflare DoH. For example, "transactional and debug log data" is stored for 25 hours at Cloudflare.
traceroute66 3y ago
> But then if I go to a coffee shop that wants to inspect my DNS queries If you're in a coffee shop and not using a VPN then, well.... But in direct answer to your question. No. If you setup DoH correctly then you are not reliant on the initial DNS lookup. For example 9.9.9.9 has a valid cert for 9.9.9.9, so no initial DNS lookup needs to be done.
- remram 3y ago
  It seems like you misunderstood the question, which was about the coffee shop messing with queries about the canary domain, not queries about the DoH endpoint.
WirelessGigabit 3y ago
`use-application-dns.net` to me means: As an application, don't do your own DNS lookups but respect the ones from the OS. Which makes me wonder, does Windows respect `use-application-dns.net` when I enable DoH?
- remram 3y ago
  It doesn't seem relevant to that situation: > The canary domain only applies to users who have DoH enabled as the default option. It does not apply for users who have made the choice to turn on DoH by themselves.
AviationAtom 3y ago
This domain has zero to do with home use and everything to do with enterprise. DNS is one of the best tools for detecting and sinkhole'ing malicious domains using threat intelligence feeds. If the systems on your network are bypassing your DNS servers then you lose that visibility and ability to filter malicious DNS traffic.

opheliate 3y ago

Not entirely certain, but I think to some degree this is a way for the network to say, “I will not respect your privacy, so don’t try”. If a network implements DNS-based content filtering and blocks DOH requests, not responding to a query for this domain could allow an application to know to not bother trying DOH, since it will definitely fail every time. I could be totally off the mark here, though.

donmcronald 3y ago
> and blocks DOH requests It’s on port 443, probably to the IP of a huge CDN. How would you block it?
- LinuxBender 3y ago
  This comes up in discussions quite a bit but in practice I have never seen that become a thing. There is technically nothing stopping a DNS provider from using random CDN nodes but unless you have found a working exception they all have well defined static IP addresses, sometimes even novelty IP's. Perhaps some day they will do this at the risk of CDN nodes getting blocked. I block DoH/DoT quite successfully on my network, not to invade privacy but to block privacy invading sites and usage statistics that the current DoH/DoT providers gather. Thus far it has not been an issue. I was surprised to find that cell phones automagically discover my DoT 853 listener on my firewall that is served up by Unbound. I do have a "_dns.resolver.arpa" hint record but nothing has ever queried it.
  - donmcronald 3y ago
    > This comes up in discussions quite a bit but in practice I have never seen that become a thing. How would you even know it’s happening? Is it even possible to snoop on HTTPS traffic if you have a mobile device like an iPhone? Making it impossible to see is the entire point AFAIK.
    - LinuxBender 3y ago
      I have physical access to the devices and I can also see every device that is registered in DHCP making queries to Unbound. Unless a specific application is leaking requests to 443 I can say with certainty that they are using my DNS server. People on my network appreciate the ad blocking and I would hear about it if that stopped working. [Edit] I should also add that I do not block VPN's. If someone wants to manually bypass my DNS they can do so with a VPN client. Perhaps some day all the browsers will start creating VPN tunnels to random CDN's on 443.
      - donmcronald 3y ago
        So you can tell they’re not using your DNS server, but you said: > I block DoH/DoT quite successfully on my network How do you block encrypted traffic that’s mixed in with normal HTTPS? I get that you can block the well known IPs, but that’s only a partial solution.
- opheliate 3y ago
  Ah of course, sorry, teaches me to speak without thinking.

johnklos 3y ago

DoH only increases privacy if the DoH provider is demonstrably more honest and privacy concerned than the network you're on. Mozilla defaults to Cloudflare, and Cloudflare are deceptive, disingenuous, and scammer friendly. Plus, many of us who care about privacy believe Cloudflare would sell access to the data they collect (the DNS lookups) to the US government for the right price. The argument for this is specious at best - people who don't care enough to change their own DNS servers on their own networks apparently have to be saved from themselves, which is why Firefox decided to turn it on without prompting the user, in spite of many people complaining about changing the default without asking. Enabling this canary domain doesn't disable DoH, if you've explicitly turned it and/or configured DoH with your own settings. DoH still stays on.

traceroute66 3y ago
> many of us who care about privacy believe Cloudflare would sell access to the data they collect The Cloudflare DoH privacy policy is already one of the least privacy friendly, so anyone who remotely cares about their privacy should not be using Cloudflare DoH. For example, "transactional and debug log data" is stored for 25 hours at Cloudflare.

traceroute66 3y ago

> But then if I go to a coffee shop that wants to inspect my DNS queries If you're in a coffee shop and not using a VPN then, well.... But in direct answer to your question. No. If you setup DoH correctly then you are not reliant on the initial DNS lookup. For example 9.9.9.9 has a valid cert for 9.9.9.9, so no initial DNS lookup needs to be done.

remram 3y ago
It seems like you misunderstood the question, which was about the coffee shop messing with queries about the canary domain, not queries about the DoH endpoint.

WirelessGigabit 3y ago

`use-application-dns.net` to me means: As an application, don't do your own DNS lookups but respect the ones from the OS. Which makes me wonder, does Windows respect `use-application-dns.net` when I enable DoH?

remram 3y ago
It doesn't seem relevant to that situation: > The canary domain only applies to users who have DoH enabled as the default option. It does not apply for users who have made the choice to turn on DoH by themselves.

AviationAtom 3y ago

This domain has zero to do with home use and everything to do with enterprise. DNS is one of the best tools for detecting and sinkhole'ing malicious domains using threat intelligence feeds. If the systems on your network are bypassing your DNS servers then you lose that visibility and ability to filter malicious DNS traffic.