Hacker News Reader

Comment by vetinari | Hacker News Reader

The thing that is still being ignored is the configuration mechanism for the DoH resolver.

Currently, the only way to configure it is manual and application-specific; there's no way to configure it for all apps and automatically, like DHCP for the normal, 53/udp DNS. Nobody is going to manually reconfigure their DNS every time they switch network (e.g. home -> office -> customer).

View on HN

Currently, the only way to configure DoH for everything is one-time setting local dnscrypt-proxy as the only resolver. Easy on Android 9+ and Linux with systemd, on Windows you have to override DNS settings for all NICs because it has a weird process of resolving. Don't know about macOS, iOS is definitely out.

edit P.S: I'd never trust ISP's DNS servers, because it's the easiest way to track what customers does.

For iOS, you can check out DNSCloak, Adguard, NextDNS, Cloudflare 1.1.1.1, etc. which are all system wide resolver.

I may trust Comcast as far as I can throw them. I still prefer that they get my data, rather than even more of my browsing data go straight to Google.

The point of DoH is that you don't have to send your DNS queries to either of those entities.

Is DHCP useful to enforce network policy? What about users who manually set their DNS servers?

Wouldn't be a proxy checking the SNI of connections you open better?

Enforcement is step 2. Proxy with a blacklist of hostnames would do, but unfortunately, with encrypted SNIs on the horizon, full blown https proxy with custom CA enrolled on all machines would be necessary.

Step 1 is a mechanism for those, who do not want to fight the network policy, just want the autoconfiguration.

Reply on news.ycombinator.com