Hacker News Reader

Comment by mysterypie | Hacker News Reader

What are some reasons why someone would prefer to or need to disable it. Just curious.

I'm not sure if disabling it is the right way to go, but I do not plan on letting Firefox ship all my DNS queries to CloudFlare. I do not trust Cloudflare any more (and maybe a little less honestly) than my ISP.

I do want a container with my own DNS-over-HTTP running on my own hosted VM (or Digital Ocean, or Vultr or Linode or whoever) and I'll ship my DNS queries there.

There is an interesting guide (in French) on best-practices to get DoH up and running with dnsdist (https://dnsdist.org) here: https://www.bortzmeyer.org/doh-mon-resolveur.html.

You might also be interested in looking at https://dnsdist.org/guides/dns-over-https.html

Some folks have a dnscrypt server for their LAN already, and/or use Split-Horizon DNS on their networks. Systems are already configured to use those setups at the system level, and having to have per-app dns settings now is madness.

I'm in the "this should be done by the system resolver" camp, and I hope they figure out how to push that for all the major platforms ...

It's essentially the same question as "why would you choose another DNS server?"

There are numerous other options like Google, Quad9, OpenDNS, OpenNIC, DNSWatch or Verisign, each of which have pros and cons like speed, privacy, reliability or accuracy. Many people also use VPNs which provide DNS servers that are perceived to increase privacy.

I know this is currently US only but were it to roll out worldwide, personally I'm in a country with strong legal privacy protections and trust my ISP far more than any American company.

A lot of networks run their own DNS. You can give resolvable hostnames to hosts internal to the LAN. You can cache queries on an organization-wide boundary and only go to the internet with those queries when the TTL expires.

In my home setup I'm already using DNS over TLS to talk to the internet, but on the LAN requests go to my DNS server, get cached there, etc.

My computer, my User agent, my rules. I want to be in 100% control over DNS queries (logging/blocking).

Why do you want to not disable it I would say. Having DNS over HTTPS not only completely breaks local name resolution (e.g. http://fileserver) and you must manually specify IP addresses in the browser to connect to local hosts, but also if you already have (like I have on my LAN) a local DNS server that does DNS over TLS is useless and also you don't benefit from for example query filtration (I filter out ad servers and trackers from DNS requests)

To use their etc/hosts entries, to use pihole, to run their own DNS server, etc

I have Pi-hole on my network and I do not want to use any other DNS provider other than my own (with my own blacklist/whitelist).

Reply on news.ycombinator.com