3 ms·

> The use of this domain is specified by Mozilla, as a limited-time measure until a method for signaling the presence of DNS-based content filtering is defined

> The use of this domain is specified by Mozilla, as a limited-time measure until a method for signaling the presence of DNS-based content filtering is defined and adopted by an Internet standards body. Yeah. Once DoH succeeds in preventing DNS based blocking of ads, trackers, etc., I’m sure all the big tech companies will come back to the table and agree on a standard that gives that power back to users. /s for anyone that needs it.

542458 3y ago
> Once DoH succeeds in preventing DNS based blocking of ads, trackers, etc... I'm not sure how DoH dramatically changes this. Even absent DoH a device can always ignore your network's DNS settings and just query 8.8.8.8 or whatever "known good" DNS server they wanted. This isn't uncommon with IoT devices today, usually to avoid ISP tampering with DNS.
- djbusby 3y ago
  Routers can intercept your Port53 queries and inject their own replies.
jchw 3y ago
This is almost the exact opposite reason why browsers adopted DoH; the problem is that DNS providers and any intermediary that can MitM have been applying content filtering at the DNS level. It can also be used to track users to an extent. DoH is necessary to reduce the set of parties who are able to see what domains you are accessing, in conjunction with ECH. I actually think Chromium adopted the better solution. Chromium will "upgrade" to DoH when you are already connecting to a DNS server known to support DoH anyways. It also bothers to implement /etc/hosts resolution, as well. Of course Google could use DoH to defeat AdBlock, but they can do that regardless of whether or not DoH is adopted by browser vendors. You already have control over the DNS resolution on your browser/most devices, so it hardly does anything. If they really wanted to defeat DNS based filtering, there's no reason they need to use DNS in the first place. For some reason, unencrypted DNS has a lot of fans. I don't understand it. I can understand why Firefox's approach is not loved, but Chromium's approach seems entirely reasonable and has basically no conflict of interest whatsoever.
- eadmund 3y ago
  > the problem is that DNS providers and any intermediary that can MitM have been applying content filtering at the DNS level. It can also be used to track users to an extent. DoH is necessary to reduce the set of parties who are able to see what domains you are accessing, in conjunction with ECH. I am my DNS provider. I choose to apply content filtering. DoH just increases the set of parties who see my traffic.
  - jchw 3y ago
    > DoH just increases the set of parties who see my traffic. DNS-over-HTTPS has nothing to do with your traffic being sent to somewhere you didn't intend for it to. If you experienced something like this, it's because some software decided to ignore your configured DNS resolver, which has absolutely nothing to do with DNS-over-HTTPS and is not how it is implemented in all software. If a piece of software wishes to, it can use any name resolver it wants, and bypass the DNS system altogether. You can also run your own DNS-over-HTTPS resolver. It's probably even a good idea to.

542458 3y ago

> Once DoH succeeds in preventing DNS based blocking of ads, trackers, etc... I'm not sure how DoH dramatically changes this. Even absent DoH a device can always ignore your network's DNS settings and just query 8.8.8.8 or whatever "known good" DNS server they wanted. This isn't uncommon with IoT devices today, usually to avoid ISP tampering with DNS.

djbusby 3y ago
Routers can intercept your Port53 queries and inject their own replies.

jchw 3y ago

This is almost the exact opposite reason why browsers adopted DoH; the problem is that DNS providers and any intermediary that can MitM have been applying content filtering at the DNS level. It can also be used to track users to an extent. DoH is necessary to reduce the set of parties who are able to see what domains you are accessing, in conjunction with ECH. I actually think Chromium adopted the better solution. Chromium will "upgrade" to DoH when you are already connecting to a DNS server known to support DoH anyways. It also bothers to implement /etc/hosts resolution, as well. Of course Google could use DoH to defeat AdBlock, but they can do that regardless of whether or not DoH is adopted by browser vendors. You already have control over the DNS resolution on your browser/most devices, so it hardly does anything. If they really wanted to defeat DNS based filtering, there's no reason they need to use DNS in the first place. For some reason, unencrypted DNS has a lot of fans. I don't understand it. I can understand why Firefox's approach is not loved, but Chromium's approach seems entirely reasonable and has basically no conflict of interest whatsoever.

eadmund 3y ago
> the problem is that DNS providers and any intermediary that can MitM have been applying content filtering at the DNS level. It can also be used to track users to an extent. DoH is necessary to reduce the set of parties who are able to see what domains you are accessing, in conjunction with ECH. I am my DNS provider. I choose to apply content filtering. DoH just increases the set of parties who see my traffic.
- jchw 3y ago
  > DoH just increases the set of parties who see my traffic. DNS-over-HTTPS has nothing to do with your traffic being sent to somewhere you didn't intend for it to. If you experienced something like this, it's because some software decided to ignore your configured DNS resolver, which has absolutely nothing to do with DNS-over-HTTPS and is not how it is implemented in all software. If a piece of software wishes to, it can use any name resolver it wants, and bypass the DNS system altogether. You can also run your own DNS-over-HTTPS resolver. It's probably even a good idea to.