3 ms·

>It’s one of the few things that hasn’t changed much and it’s operation is fairly straightforward. It's relatively straightforward, ignoring all of the potenti

>It’s one of the few things that hasn’t changed much and it’s operation is fairly straightforward. It's relatively straightforward, ignoring all of the potential ways that things can go wonky, e.g. random servers not respecting TTL. But I'll never forget when Firefox put out an update with DNS-over-HTTPS turned on by default. All of a sudden, I was inundated with "Email is gone! Everything is broken!" because we run an internal DNS server handed out to workstations by DHCP. We have internal webmail and intranet Web servers that were just gone. It took a lot longer than it should to figure out what was happening, partially because it's DNS! Why should things go blooey? But it's pretty clear that Mozilla did not anticipate this (easily forseen, IMO) sort of issue.

throw0101b 3y ago
> But I'll never forget when Firefox put out an update with DNS-over-HTTPS turned on by default. Plenty of DNS old timers / neckbeards (e.g., Paul Vixie) warning that DoH was not a good idea; there was lively discussion on HN at the time. We used split-horizon DNS as well and I implemented the "disable DoH" canary where I was working at the time. * https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di... * https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...