What’s Next in Making Encrypted DNS-over-HTTPS the Default
blog.mozilla.org
What’s Next in Making Encrypted DNS-over-HTTPS the Default
1–10 of 191 posts
Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default
#2So what will be « safer » ?
Using a pi-hole or equivalent, or using this ?
IIRC all DoH requests are sent to Cloudflare. Is there a way to host your own DNS server and use it with DoH instead ?
Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default
#3At first, I was sceptical of DNS over HTTPS and thought that it gave Cloudflare, who already control too much access over the internet, even more control.
However, other DNS providers are available. For instance Google[1] and Quad 9 [2] both provide free DNS over HTTPS services.
[1] https://developers.google.com/speed/public-dns/docs/doh/
Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default
#4So what will be « safer » ? Using a pi-hole or equivalent, or using this ? IIRC all DoH requests are sent to Cloudflare. Is there a way to host your own DNS server and use it with DoH instead ?
AFAIK a pi-hole can use dns-over-https if configured correctly so there’s no either/or.
Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default
#5I didn't see it mentioned in the article. Has Mozilla said whose servers they will be sending unsuspecting users queries to by default? (IIRC, it was Cloudflare previously. Any reason to believe this has changed?)
---
If, like me, you already have a solution in place you are happy with and don't like the idea of others (deciding they know what's best for you and) circumventing it, simply ensure that your existing resolvers are configured as described in [0]:
> Network administrators may configure their networks as follows to signal that their local DNS resolver implemented special features that make the network unsuitable for DoH:
> DNS queries for the A and AAAA records for the domain “use-application-dns.net” must respond with NXDOMAIN rather than the IP address retrieved from the authoritative nameserver.
[0]: https://support.mozilla.org/en-US/kb/configuring-networks-di...
Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default
#6The article is not clear about one issue: are all applications expected to disregard the OS DNS? Is there an option to tell all applications that they should not bypass it?
I will be pretty pissed if I wake up one day and find that Firefox decided to stop using my DNS server and instead started sending my requests to a third-party.
Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default
#7The article is not clear about one issue: are all applications expected to disregard the OS DNS? Is there an option to tell all applications that they should not bypass it? I will be pretty pissed if I wake up one day and find that Firefox decided to stop using my DNS server and instead started sending my requests to a third-party.
That's exactly what their plan is -- and if you have experiments enabled, they may have already started sending your DNS queries to Cloudflare.
Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default
#8At first, I was sceptical of DNS over HTTPS and thought that it gave Cloudflare, who already control too much access over the internet, even more control. However, other DNS providers are available. For instance Google[1] and Quad 9 [2] both provide free DNS over HTTPS services. [1] https://developers.google.com/speed/public-dns/docs/doh/ [2] https://www.quad9.net/doh-quad9-dns-servers/
> For instance Google[1] and Quad 9 [2] both provide free DNS over HTTPS services.
Using Google is giving your browsing history to an Ad company, why? At least Quad9 is non-profit. It also provides DNS over TLS, DoT service, which I'm using.
Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default
#9So what will be « safer » ? Using a pi-hole or equivalent, or using this ? IIRC all DoH requests are sent to Cloudflare. Is there a way to host your own DNS server and use it with DoH instead ?
They are not mutually exclusive. Pi-hole supports dns-over-https. My concern with this technology is my port 53 masquerade rule on my router will no longer grab all dns requests when this becomes common practice. I imagine there will be a solution but I'm not sure what it is.
Re: What’s Next in Making Encrypted DNS-over-HTTPS the Default
#10So what will be « safer » ? Using a pi-hole or equivalent, or using this ? IIRC all DoH requests are sent to Cloudflare. Is there a way to host your own DNS server and use it with DoH instead ?
Yeah, you can re-configure Pi-Hole to use DoH (with your preferred servers). unbound can be configured to use DoH as well.