[blacksmith_tb]

Couldn't you host pi-hole on a cheap VM and set it to be your DNS-over-TLS / DNS-over-HTTPS endpoint?

[Skunkleton]

This assumes that your software is doing what you asked it to do, not what some bigco or malware wanted it to do.

[silon42]

firewall anything that doesn't go through your DNS server... at least thay way the malware will be obviously detectable.

[Spivak]

But DoH is just any other HTTP request. This is the downside of networks blocking everything except 80/443 outbound and browsers not supporting SRV records.

[goatinaboat]

If I remember correctly Chrome already ignores your DNS and does it’s own over HTTPS.

[Xylakant]

I think you're misremembering. This is the most official documentation of the rollout plan for DoH that I can quickly ddg: https://www.chromium.org/developers/dns-over-https - in a gist: If the systems resolver is known to support DoH, the DNS query will get upgraded to DoH. That means chrome will still be using the configured systems resolver, but the connection will be encrypted.

I think you're remembering what firefox is rolling out: Firefox will by default, if DoH is enabled for your country by default use a specific provider that subjects to additional privacy controls. However, firefox respects network level settings (for example a specific canary domain that should resolve) and will disable DoH, even if the default is enabled - unless again, the user has overwritten that in a setting. That means that the network owner is still in full control of the network-wide default and PiHole supports this approach. So a stock firefox in a network that uses pi-hole will not use DoH.

[goatinaboat]

Thanks for clarifying that!