Re:Experimenting with same-provider DNS-over-HTTPS upgrade
by fulafel on Thursday September 12, 2019 @09:47AM
(#20951373)
DNSmasq needs to be replaced with something more secure in any event. Hopefully implemented in a memory-safe programming language.
https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
Re:Experimenting with same-provider DNS-over-HTTPS upgrade
by portmanteaufu on Thursday September 12, 2019 @09:13AM
(#20951024)
PiHole has already merged a patch[1] to disable DoH via the global canary[2].
[1] https://github.com/pi-hole/pi-hole/pull/2915 [2] https://use-application-dns.net/
Re:Experimenting with same-provider DNS-over-HTTPS upgrade
by kchamplewski on Thursday September 12, 2019 @09:06AM
(#20950958)
Pi Hole already has documentation on how to use DoH with it, and it already works:
https://docs.pi-hole.net/guides/dns-over-https/
Note: this is using cloudflared but that's just a DoH, it can and happily will query whatever provider you tell it to.
Re:Experimenting with same-provider DNS-over-HTTPS upgrade
by icebraining on Thursday September 12, 2019 @09:58AM
(#20951494)
That's for upstream queries, I think we're talking about the connection from the devices to the PiHole.
We'll see.
Pi Hole uses DNSmasq as its DNS (and DHCP) server, and the few DNSmasq mailing list threads I've seen on the topic seem to indicate that the DNSmasq developers are not interested in either DoT or DoH. One said that it would be difficult to implement because of architectural issues IIRC.
It may be necessary to use a front-end proxy:
* https://dnsdist.org/