Why isn't this being solved on an operating system level instead?
That would be the best outcome, but until then Mozilla is making an effort to fill the gap until OSes supports DoH, DoT or DNScrypt out of the box and by default.
Mozilla’s DNS over HTTPs
41–50 of 777 posts
Re: Mozilla’s DNS over HTTPs
#42Can someone at Mozilla explain why they present what is purely textual content as a PNG? I mean, this is ridiculous: https://ffp4g1ylyit3jdyti1hqcvtb-wpengine.netdna-ssl.com/net...
For sharing on social media / chat apps.
Re: Mozilla’s DNS over HTTPs
#43If you are a network administrator and want none of this, look at that:
https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
Basically, make use-application-dns.net. return an error (any kind will do). Filter it in your recursor for example.
Having the browser change a fundamental behaviour that used to stand for decades is highly problematic. If nothing else, it is the network administrator who should have the final say on WHEN (if ever) DoH will get deployed inside their network.
Re: Mozilla’s DNS over HTTPs
#44Questions I couldn’t find answers to in the post or linked info about the Trusted Resolver Program:
What’s in it for the Cloudflare & NextDNS?
Are they getting paid to handle this traffic or paying to have the opportunity to access this data?
Can users outside the US opt-in?
The comment about having “no plans” to enable this outside the USA seems a bit disingenuous. Hard to believe they built this program / feature and have no plan to eventually roll out to all users. Perhaps what they wanted to say was they have no fixed timeline for roll out to other locations.
Re: Mozilla’s DNS over HTTPs
#45Can someone please explain why there can’t be a DHCP or RA option for which DoH server to use? Why are we going out of our way to make sure the sysadmin has to configure each and every piece of software on each and every single PC rather than just set it one in a centralized location, like every other networking option? DoH will leave my machines unable to resolve all my internal domain names, right?
https://support.mozilla.org/en-US/kb/canary-domain-use-appli... There is. You configure your DNS resolve this "canary" domain to disable it.
All that does is block DoH entirely, right? Not allow me to say “use this DoH server” or “don’t use DoH for this domain.”
Re: Mozilla’s DNS over HTTPs
#46Doth protest too much. People don’t take issue with DoH, they take issue with an advertising supported browser like Mozilla’s unicast (and now bicast) centralization of DNS traffic that was previously distributed. We invented DNSCrypt. There’s also DNS over TLS. Lots of ways to encrypt DNS without centralization. They make this about DoH when really the primary issues are with how they went about it.
DNS over TLS and DNSCrypt both depend on servers... exactly as centralized as DoH. They are just different wire protocols that in the end do the exact same thing with a centralized DNS server.
Re: Mozilla’s DNS over HTTPs
#47Can someone please explain why there can’t be a DHCP or RA option for which DoH server to use? Why are we going out of our way to make sure the sysadmin has to configure each and every piece of software on each and every single PC rather than just set it one in a centralized location, like every other networking option? DoH will leave my machines unable to resolve all my internal domain names, right?
Is it a big deal to have your internal domain names accessible externally? Many (though not all) DNS server allow private IPs in DNS.
It means making my internal name sever accept recursive calls from the internet at large. You’re proposing degrading my network security for this.
Re: Mozilla’s DNS over HTTPs
#48Earlier quoted context omitted.
https://support.mozilla.org/en-US/kb/canary-domain-use-appli... There is. You configure your DNS resolve this "canary" domain to disable it.
All that does is block DoH entirely, right? Not allow me to say “use this DoH server” or “don’t use DoH for this domain.”
I think if you want to get that detailed you'd be pushing a custom managed Firefox profile.
Re: Mozilla’s DNS over HTTPs
#49Earlier quoted context omitted.
DNS over TLS is just DoH but with an easily blocked separate port
Which is great from a local sysadmin perspective. With DoH I have no control of what various apps on devices on my devices are querying.
https://support.mozilla.org/en-US/kb/canary-domain-use-appli..., also if you can block it this easily so can the government. The difference with a canary domain is that mozilla can disable it if its misused.
Re: Mozilla’s DNS over HTTPs
#50Can someone please explain why there can’t be a DHCP or RA option for which DoH server to use? Why are we going out of our way to make sure the sysadmin has to configure each and every piece of software on each and every single PC rather than just set it one in a centralized location, like every other networking option? DoH will leave my machines unable to resolve all my internal domain names, right?
https://support.mozilla.org/en-US/kb/canary-domain-use-appli... There is. You configure your DNS resolve this "canary" domain to disable it.
You missunderstood.
He wants to tell his devices that they should use a specific DoH reaolver, instead of their default.