Hacker News new | ask | show | jobs
by scoutt 2408 days ago
> DNS over HTTPS will prevent clients in your network from using the default local DNS services.

Relevant: Windows will improve user privacy with DNS over HTTPS

https://news.ycombinator.com/item?id=21562295

1 comments

Mozilla added a feature to allow users to disable DOH network wide (also supported by the notracking list).

Info from notracking: https://github.com/notracking/hosts-blocklists#dns-over-http... Info from Mozilla: https://support.mozilla.org/en-US/kb/configuring-networks-di...

Not sure if Microsoft will do something similar? Else there is still the option to set up your own (local) DOH server and let your router route all DOH traffic to your local DOH instance.

AFAIK, being HTTP, you won't be able to differentiate and/or route it. And it can be done outside the control of the OS or browser (with js embedded in a page, application, etc.) so even if you configure your browser/system, it still will pass through filters unless whole domains are filtered?

Since pihole and dnsmasq are already requiring disabling DoH, I see DoH as the dead of these kinds of adblock systems.

You will know on forehand what the fixed DOH servers will be, how else would you be able to locate them?

If for example they will use the 1.1.1.1 DOH instance, you can simply redirect all localnet 1.1.1.1 (80/53) traffic to your own local (DOH)DNS(masq).

Besides that there must be a fallback option for network admins, since using dns filtering and localnet dns is very common in enterprise. Firefox implemented a canary domain, specifically designed for this purpose, see: https://support.mozilla.org/en-US/kb/canary-domain-use-appli...