I think it's worse than having a ton of crappy ISPs doing DNS. Yeah, they probably sold my data to shady businesses, but DoH has the potential to be a much better mass surveillance and censorship system. Is it easier to get a US court order for Cloudflare and Google to block the pirate bay via DNS or to get 1k court orders from 1k jurisdictions around the world?
And the "benefit" we're going to get as users is un-blockable ads because that's the ultimate goal of DoH. Instead of my Roku trying to use 8.8.8.8 it'll use some DoH server at a CDN that's hard/impossible to block.
They're literally building the next generation surveillance / censorship system and selling it to us as "for your protection".
Can you not set the DNS server just as you do today? Or are you rewriting the IP for 8.8.8.8 to a private server and worried that HTTPS will prevent this?
With DoH it’ll be impossible to block and I think there’s a good chance they’ll flat out ignore local dns at that point.
When someone hosts a DoH server on a cdn/AWS/Azure/Google shared IP address, you can't block it by IP; and if the client uses ESNI, you can't block it by HTTP header inspection either.
Already done...something is still sneaking through...or cloudflares test is unreliable (or my iptables rules are wrong lol)
When you think you've got a grip on it there are leaks. pihole and cloudflared tunnel set up? Nope FF just bypasses it. Something still leaking? oh that's ipv6. Still no good? Oh DNS can bypass your port 53 firewall rule cause udp fallback. etc etc.
Oh and good luck testing it. Different results in FF/Chrome/Edge...and sometimes even variability between tests per browser. Hows that even possible with 53 FW blocked? No idea