Also, moving DNS to the application instead of the OS just makes managing my well behaved applications harder. It used to be possible to set this automatically through DHCP, now I have to audit every application and make sure it is using my preferred DNS and also manually configure those applications.

DNS-over-HTTPS in Firefox doesn't really benefit me. DNS-over-HTTPS with a DHCP configured server in my OS would be a beneficial option.

Really I would prefer something like DNS over TLS because that solves everything. DNS keeps working, intermediate parties can't read my DNS requests and I can reason about my network traffic, at least on devices I trust.

The only other way would be MITM all https traffic and sign with your own certificate, but many iot devices won’t allow you to install a new certificate store.

Will a canary domain on an edge device prevent my smart TV from using DoH to get the IP of a tracking server?

If your smart tv checks to see if it should disable DOH then it would work.

I wouldn’t bank on it doing so though. Best to block all iot devices.

> The use of this domain is specified by Mozilla, as a limited-time measure until a method for signaling the presence of DNS-based content filtering is defined and adopted by an Internet standards body.

More than anything I am disappointed in Mozilla for shipping such a half-baked anti-feature. I can't even trust Firefox to do the right thing anymore.

Intimately DoH isn’t needed to make IoT transparent, an IoT device can establish a TLS tunnel to a CDN, and unless that’s blocked you have no way of knowing what is being sent where.

An in-line https proxy is the only solution, if iot devices fail to check certificates (which wouldn’t surprise me)

If they do check, and you can’t provide your our root, then you can’t trust them. Read GNU manifesto and realise why it’s important.

I am conflicted over DoH. As an end user I want to be protected against rogue networks - especially in hotels. As a network admin I want to be protected against rogue end devices.

As both I want to be able to deploy split dns servers due to Nat, not to force users (including me), but to don’t to them where to go.

DoH should have been implemented at the OS level and driven by DHCP unless overridden, as with normal DNS.

It's much harder (or impossible) to block only some of the IoT device traffic (like ads). If I want it to function at all I have to let it spy on me and do other rude things.

My solution is to just not have IoT things but in the long run I think that will become impossible. Consumers seem to have made their choice and everything needs an IP address now.

I don't like how DNS-over-HTTPS smells and I wish there was less momentum behind it. This should be solved by OS vendors, not application developers. DNS doesn't belong at this part of the stack.

OTOH I expect non-malicious code to just use the platform/language/framework-standard mechanism to resolve hostnames, and I expect such mechanisms to provide all the necessary customization points, just as they did for DNS.

The solutions are different but a device like a Pi-hole probably has a part to play in both.

I avoid phone banking as it is...

1) https://support.mozilla.org/en-US/kb/canary-domain-use-appli...