Hacker News new | ask | show | jobs
by CarelessExpert 1809 days ago
Yeah, I ended up going the canary domain route, and then setting up my pihole itself to use DoH using cloudflared outbound. Best of both worlds!
1 comments

Yes, canary domain is fine - at least while it still works. I don't want to have to configure DNS for 50 different applications on 20 different machines. My OS does DNS, and my DHCP server doles out the DNS server I want my machines to use.
The Mozilla page on the topic (https://support.mozilla.org/en-US/kb/canary-domain-use-appli...) notes that:

> The use of this domain is specified by Mozilla, as a limited-time measure until a method for signaling the presence of DNS-based content filtering is defined and adopted by an Internet standards body.

Presumably that'd be the IETF, and I have no idea which committee would be working on this, if there's a draft RFC in the works, etc. But it's clear the expectation is some sort of standard mechanism will eventually replace the canary domain that yields the same functionality but in a less hacky way.

There was [1] which would've allowed websites to specify custom DoH resolvers for their subdomains, but it expired some time ago. The same authors are now working on [2] instead, which AFAICT is basically for the same thing.

There's also [3] which is a way for the DHCP server to also provide DoT and DoH servers to the LAN (in addition to the usual DNS servers).

[1]: https://datatracker.ietf.org/doc/draft-pauly-add-resolver-di...

[2]: https://datatracker.ietf.org/doc/draft-ietf-add-ddr/

[3]: https://datatracker.ietf.org/doc/draft-ietf-add-dnr/