What’s Next in Making Encrypted DNS-over-HTTPS the Default

Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by JeanMarcS on Saturday September 07, 2019 @02:46AM (#20902189)

So what will be « safer » ?

Using a pi-hole or equivalent, or using this ?

IIRC all DoH requests are sent to Cloudflare. Is there a way to host your own DNS server and use it with DoH instead ?

[ Parent | on HN ]

Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by iforgotpassword on Saturday September 07, 2019 @03:17AM (#20902313)

For now I'm blocking traffic to Google's and cloudflare's DNS and plan on also following the advice about that special domain from https://support.mozilla.org/en-US/kb/configuring-networks-di... that someone posted here.

[ Parent | on HN ]

Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by milofeynman on Saturday September 07, 2019 @03:03AM (#20902254)

They are not mutually exclusive. Pi-hole supports dns-over-https. My concern with this technology is my port 53 masquerade rule on my router will no longer grab all dns requests when this becomes common practice. I imagine there will be a solution but I'm not sure what it is.

[ Parent | on HN ]

Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by mtsr on Saturday September 07, 2019 @07:21AM (#20903112)

I don't really see a solution without installing root CA's to MitM HTTPS traffic. I too would be interested in solutions for this.

[ Parent | on HN ]

Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by jlgaddis on Saturday September 07, 2019 @03:04AM (#20902256)

Yeah, you can re-configure Pi-Hole to use DoH (with your preferred servers). unbound can be configured to use DoH as well.

[ Parent | on HN ]

Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by mike-cardwell on Sunday September 08, 2019 @06:20AM (#20909611)

For unbound, I just dropped this in my /etc/unbound/unbound.conf.d/02-block-doh.conf

  local-zone: "use-application-dns.net" static

[ Parent | on HN ]

Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by mtsr on Thursday September 12, 2019 @06:21AM (#20949852)

Exactly what I did.

[ Parent | on HN ]

Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by mtsr on Saturday September 07, 2019 @07:22AM (#20903113)

For forwarding yes, but not for recursive resolution.

[ Parent | on HN ]

Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default by pletnes on Saturday September 07, 2019 @02:50AM (#20902200)

AFAIK a pi-hole can use dns-over-https if configured correctly so there’s no either/or.

[ Parent | on HN ]