News for hackers. Stuff that matters.
Re:DNS Queries over HTTPS by jimktrains2 on Monday November 26, 2018 @10:49AM (#18534117)
I think gp was concerned more with not leaking internal dns names as DoH isn't using the system resolver and hence requires each application to be configured individually to point to an internal DoH server.
Re:DNS Queries over HTTPS by LinuxBender on Monday November 26, 2018 @10:57AM (#18534189)
Exactly. If DoH included a change or extension to DHCP or could leverage an existing feature of DHCP, then this could be solved for corporate use. I would imagine something like the Proxy PAC "option wpad-url" using a different code to signify DoH. Even then, only browsers would be addressed by wpad. There would still need to be a mechanism to set DoH for non browsers.

We would also need all OS providers to get in front of this and have a package that supports internal DoH easily. i.e. AD snap-in for windows AD controllers. Perhaps an extension to sssd and/or Unbound and/or dhcp for Linux. That needs to happen before all the browsers start supporting this.

Re:DNS Queries over HTTPS by lwheelock on Monday November 26, 2018 @11:03AM (#18534236)
Certainly could. My assumption would be that the client implementation would have a way to exclude specific domains.