4 ms·
I’m not sure why I’d ever want DoH, I block as much as I can at my firewall and have a canary domain. I want my devices to use my defined dns sever on my netwo
by chgs 2y ago
I’m not sure why I’d ever want DoH, I block as much as I can at my firewall and have a canary domain.
I want my devices to use my defined dns sever on my network, not some ad company (and all tech companies eventually become ad companies)
- unsnap_biceps 2y agoI want pihole to talk encrypted to the upstream dns server. I don't actually care if my devices talk encrypted to pihole. I just don't want to leak dns requests to my isp. If there's a way to do this without DoH or DoT, I'd happily learn more about it.
- bjoli 2y agoDoT has a standard port, meaning blocking (conforming) requests simple. DoH uses 443. Nothing says clients need to confirm to the port requirements, but most companies will be lazy and assume 853 will work.
- unethical_ban 2y agoIIRC, there is not a native GUI method for Pihole to talk encrypted to DoH providers. You have to set up a daemon locally and configure via CLI, then set that as your "upstream" DNS provider in Pihole admin. Obviously the goal is to have your local clients talking to Pihole, but the goal of having remote DNS queries encrypted is to prevent ISP snooping. Though if you really want to prevent ISP snooping you have all clients using VPN or configure your router to send all outbound traffic to a VPN endpoint.
- ndriscoll 2y agoSpeaking of not wanting DoH to exist on the local network, does anyone know if there is anything pre-existing that can hook into firewall rules to default deny outgoing traffic and only allow (until TTL expiry) in response to a DNS lookup? That way things cannot bypass your DNS filtering with DoH or hardcoded IPs.
- kube-system 2y agoPeople use DoH/DoT so that their upstream DNS lookups are not transmitted in plaintext across the open internet. You can do this and still run your own DNS server on your network. The parent commenter is asking about Pihole with DoH, which is exactly this.
- chgs 2y agoDoT sure. The whole “tunnel everything over http” is a terrible pattern
- kube-system 2y agoHostile firewalls that block and/or intercept DNS traffic are also a bad pattern, but people don't always control their local network these days. You can't always count on 853 being open. There are valid use cases for both.
- chgs 2y agoits far easier to control your network than it is to control your devices on that network - far too many closed source devices nowadays, and it’s extremely difficult to avoid all of them
- kube-system 2y agoMaybe that is true about your devices, and your use cases, on your home network, but that is far from the only use case in the world.