Hacker News new | ask | show | jobs
by warhorse10_9 1807 days ago
You can also just set the policy to disable this in registry or using policy.json on Linux. Mac has a similar setup, i'm just not familiar with it.
1 comments

Yeah, I ended up going the canary domain route, and then setting up my pihole itself to use DoH using cloudflared outbound. Best of both worlds!
Yes, canary domain is fine - at least while it still works. I don't want to have to configure DNS for 50 different applications on 20 different machines. My OS does DNS, and my DHCP server doles out the DNS server I want my machines to use.
The Mozilla page on the topic (https://support.mozilla.org/en-US/kb/canary-domain-use-appli...) notes that:

> The use of this domain is specified by Mozilla, as a limited-time measure until a method for signaling the presence of DNS-based content filtering is defined and adopted by an Internet standards body.

Presumably that'd be the IETF, and I have no idea which committee would be working on this, if there's a draft RFC in the works, etc. But it's clear the expectation is some sort of standard mechanism will eventually replace the canary domain that yields the same functionality but in a less hacky way.

There was [1] which would've allowed websites to specify custom DoH resolvers for their subdomains, but it expired some time ago. The same authors are now working on [2] instead, which AFAICT is basically for the same thing.

There's also [3] which is a way for the DHCP server to also provide DoT and DoH servers to the LAN (in addition to the usual DNS servers).

[1]: https://datatracker.ietf.org/doc/draft-pauly-add-resolver-di...

[2]: https://datatracker.ietf.org/doc/draft-ietf-add-ddr/

[3]: https://datatracker.ietf.org/doc/draft-ietf-add-dnr/