Re:DNS Queries over HTTPS
by jimktrains2 on Monday November 26, 2018 @10:49AM
(#18534117)
I think gp was concerned more with not leaking internal dns names as DoH isn't using the system resolver and hence requires each application to be configured individually to point to an internal DoH server.
[ Parent
| on HN ]
Re:DNS Queries over HTTPS
by LinuxBender on Monday November 26, 2018 @10:57AM
(#18534189)
Exactly. If DoH included a change or extension to DHCP or could leverage an existing feature of DHCP, then this could be solved for corporate use. I would imagine something like the Proxy PAC "option wpad-url" using a different code to signify DoH. Even then, only browsers would be addressed by wpad. There would still need to be a mechanism to set DoH for non browsers.
We would also need all OS providers to get in front of this and have a package that supports internal DoH easily. i.e. AD snap-in for windows AD controllers. Perhaps an extension to sssd and/or Unbound and/or dhcp for Linux. That needs to happen before all the browsers start supporting this.