News for hackers. Stuff that matters.

A comment on DNS-over-HTTPS Policy Requirements for Resolvers. Parent comment

Re:DNS-over-HTTPS Policy Requirements for Resolvers by vetinari on Wednesday April 10, 2019 @02:07PM (#19627263)
> usually around Active Directory implementations where brain-damaged people have named the AD domain the same as a public Internet domain name

I don't like this one either, but often it is inherited from the past from other people and it is not going to change.

On the other hand, split-horizon DNS is going to stay with us, even if the AD domain is a subdomain of the public one. Records in the internal zone are not going to become public anytime soon.

[ Parent | on HN ]
Re:DNS-over-HTTPS Policy Requirements for Resolvers by selenamarie on Wednesday April 10, 2019 @07:24PM (#19629669)
A subdomain that doesn't resolve is handled properly -- meaning DoH is then disabled.
[ Parent | on HN ]
Re:DNS-over-HTTPS Policy Requirements for Resolvers by vetinari on Thursday April 11, 2019 @05:09AM (#19632298)
Didn't know that, great, thanks.

On the other of the common problems: I assume there is no way to blackhole existing, public records, other than extension ala uBlock/Adblock?

[ Parent | on HN ]
Re:DNS-over-HTTPS Policy Requirements for Resolvers by selenamarie on Friday April 12, 2019 @12:59AM (#19642098)
We're working on exceptions support, which would allow specific domains to be looked up via DNS instead of DoH. In that case, mirroring a blackhole list to the exceptions support would result in what you want (I mean, if I understand what you're asking).
[ Parent | on HN ]