4 ms·

How does DoH work? Somehow you need to know the IP of cloudflare-dns.com first. Maybe your router uses 1.1.1.1 for this.

nelox 1y ago
[flagged]
- k1t 1y ago
  Smells like AI and completely fails to answer the question. How is the IP address of the DoH server obtained?
  - MayeulC 1y ago
    Firefox accepts a bootstrap IP, or uses the system resolver: > network.trr.bootstrapAddress > (default: none) by setting this field to the IP address of the host name used in "network.trr.uri", you can bypass using the system native resolver for it. Use this to get the IPs of the cloudflare server: https://dns.google/query?name=mozilla.cloudflare-dns.com https://dns.google/query?name=mozilla.cloudflare-dns.com > Starting with Firefox 74 setting the bootstrap address is no longer required in mode 3. Firefox will attempt to use regular DNS in order to get the IP address of the trusted resolver. However, if DNS resolution of the resolver domain fails, setting the bootstrap address is again necessary. Source: https://wiki.mozilla.org/Trusted_Recursive_Resolver https://wiki.mozilla.org/Trusted_Recursive_Resolver
ta1243 1y ago
And even if you have already resolved it the TTL is only 5 minutes
deleted 1y ago
[deleted]
stavros 1y ago
Are we meant to use a domain? I've always just used the IP.
- landgenoot 1y ago
  You need a domain in order to get the s in https to work
  - federiconafria 1y ago
    What about a reverse DNS lookup?
  - yread 1y ago
    what about certificate for IP address?
    - landgenoot 1y ago
      What about a route that gets hijacked? There is no HSTS for IP addresses.
      - sathackr 1y ago
        Presumably the route hijacker wouldn't have a valid private key for the certificate so they wouldn't pass validation
  - bigiain 1y ago
    That's not correct. LetEncrypt are trialling ip address https/TLS certificates right now: https://letsencrypt.org/2025/07/01/issuing-our-first-ip-address-certificate/ https://letsencrypt.org/2025/07/01/issuing-our-first-ip-addr... They say: "In principle, there’s no reason that a certificate couldn’t be issued for an IP address rather than a domain name, and in fact the technical and policy standards for certificates have always allowed this, with a handful of certificate authorities offering this service on a small scale."
    - noduerme 1y ago
      right, this was announced about two weeks ago to some fanfare. So in principle there was no reason not to do it two decades ago? It would've been nice back then. I never heard of any certificate authority offering that.
stingraycharles 1y ago
Yeah I don’t understand this part either, maybe it’s supposed to be bootstrapped using your ISP’s DNS server?
- tom1337 1y ago
  Pretty much that. You set up a bootstrap DNS server (could be your ISPs or any other server) which then resolves the IP of the DoH server which then can be used for all future requests.
maxloh 1y ago
Yeah, your operating system will first need to resolve cloudflare-dns.com. This initial resolution will likely occur unencrypted via the network's default DNS. Only then will your system query the resolved address for its DoH requests. Note that this introduces one query overhead per DNS request if the previous cache has expired. For this reason, I've been using https://1.1.1.1/dns-query https://1.1.1.1/dns-query instead. In theory, this should eliminate that overhead. Your operating system can validate the IP address of the DNS response by using the Subject Alternative Name (SAN) field within the CA certificate presented by the DoH server: https://g.co/gemini/share/40af4514cb6e https://g.co/gemini/share/40af4514cb6e

nelox 1y ago

[flagged]

k1t 1y ago
Smells like AI and completely fails to answer the question. How is the IP address of the DoH server obtained?
- MayeulC 1y ago
  Firefox accepts a bootstrap IP, or uses the system resolver: > network.trr.bootstrapAddress > (default: none) by setting this field to the IP address of the host name used in "network.trr.uri", you can bypass using the system native resolver for it. Use this to get the IPs of the cloudflare server: https://dns.google/query?name=mozilla.cloudflare-dns.com https://dns.google/query?name=mozilla.cloudflare-dns.com > Starting with Firefox 74 setting the bootstrap address is no longer required in mode 3. Firefox will attempt to use regular DNS in order to get the IP address of the trusted resolver. However, if DNS resolution of the resolver domain fails, setting the bootstrap address is again necessary. Source: https://wiki.mozilla.org/Trusted_Recursive_Resolver https://wiki.mozilla.org/Trusted_Recursive_Resolver

ta1243 1y ago

And even if you have already resolved it the TTL is only 5 minutes

deleted 1y ago

[deleted]

stavros 1y ago

Are we meant to use a domain? I've always just used the IP.

landgenoot 1y ago
You need a domain in order to get the s in https to work
- federiconafria 1y ago
  What about a reverse DNS lookup?
- yread 1y ago
  what about certificate for IP address?
  - landgenoot 1y ago
    What about a route that gets hijacked? There is no HSTS for IP addresses.
    - sathackr 1y ago
      Presumably the route hijacker wouldn't have a valid private key for the certificate so they wouldn't pass validation
- bigiain 1y ago
  That's not correct. LetEncrypt are trialling ip address https/TLS certificates right now: https://letsencrypt.org/2025/07/01/issuing-our-first-ip-address-certificate/ https://letsencrypt.org/2025/07/01/issuing-our-first-ip-addr... They say: "In principle, there’s no reason that a certificate couldn’t be issued for an IP address rather than a domain name, and in fact the technical and policy standards for certificates have always allowed this, with a handful of certificate authorities offering this service on a small scale."
  - noduerme 1y ago
    right, this was announced about two weeks ago to some fanfare. So in principle there was no reason not to do it two decades ago? It would've been nice back then. I never heard of any certificate authority offering that.

stingraycharles 1y ago

Yeah I don’t understand this part either, maybe it’s supposed to be bootstrapped using your ISP’s DNS server?

tom1337 1y ago
Pretty much that. You set up a bootstrap DNS server (could be your ISPs or any other server) which then resolves the IP of the DoH server which then can be used for all future requests.

maxloh 1y ago

Yeah, your operating system will first need to resolve cloudflare-dns.com. This initial resolution will likely occur unencrypted via the network's default DNS. Only then will your system query the resolved address for its DoH requests. Note that this introduces one query overhead per DNS request if the previous cache has expired. For this reason, I've been using https://1.1.1.1/dns-query https://1.1.1.1/dns-query instead. In theory, this should eliminate that overhead. Your operating system can validate the IP address of the DNS response by using the Subject Alternative Name (SAN) field within the CA certificate presented by the DoH server: https://g.co/gemini/share/40af4514cb6e https://g.co/gemini/share/40af4514cb6e