News for hackers. Stuff that matters.

A comment on DNS-over-HTTPS Policy Requirements for Resolvers. Parent comment

Re:DNS-over-HTTPS Policy Requirements for Resolvers by cpeterso on Wednesday April 10, 2019 @12:49PM (#19626507)
Not to Mozilla, but to whichever DoH service Firefox is configured to use, by default or by the user. Mozilla isn't running a DoH service.
[ Parent | on HN ]
Re:DNS-over-HTTPS Policy Requirements for Resolvers by protomyth on Wednesday April 10, 2019 @01:41PM (#19627027)
What is the default?
[ Parent | on HN ]
Re:DNS-over-HTTPS Policy Requirements for Resolvers by moosingin3space on Wednesday April 10, 2019 @02:04PM (#19627236)
Cloudflare 1.1.1.1 is the default.
[ Parent | on HN ]
Re:DNS-over-HTTPS Policy Requirements for Resolvers by protomyth on Wednesday April 10, 2019 @02:19PM (#19627378)
So, when the user types in internal.mydomain.com, it gets sent to Cloudflare then they query my public domain server which doesn't have the entry so it falls back to checking the DNS the system has listed. Is Firefox going to cache the IP like the OS does?
[ Parent | on HN ]
Re:DNS-over-HTTPS Policy Requirements for Resolvers by moosingin3space on Wednesday April 10, 2019 @02:29PM (#19627473)
The behaviour depends on a few preferences:

* network.trr.mode can be set to 0 (disabled), 1 (race native vs TRR), 2 (TRR first, OS DNS as fallback), 3 (TRR only), 4 (run native and TRR in parallel but use native results, save TRR timings for telemetry), or 5 (off by choice)

* network.trr.uri configures which DoH endpoint is queried

Firefox does maintain a DNS cache, even if you use the native DNS resolver. You can view the cache at about:networking#dns.

[ Parent | on HN ]
Re:DNS-over-HTTPS Policy Requirements for Resolvers by protomyth on Wednesday April 10, 2019 @11:21PM (#19630888)
So, I really need to set 5 because 0 will probably later become default consent to use DNS-over-HTTPS.
[ Parent | on HN ]