Hacker News Reader

Comment by ThePhysicist | Hacker News Reader

I predict that DoH will break many enterprise infrastructures that rely on custom DNS servers. Unwary sysadmins that update Firefox will be in a lot of trouble when they switch this on by default.

We ourselves have a custom DNS setup with an only internally resolvable TLD as a security measure, so this change will break our infra for all Firefox users (thankfully we’re in the EU so we’re spared, for now).

Good thing that Cloudflare wants to centralize DNS and access control anyway, so those enterprises can just switch to their proprietary DNS service and VPN replacement, I guess ;)

View on HN

Firefox by default is configured with a fallback option, where if resolution would fail, it will fallback to the system-provided DNS servers. So your internal TLDs are safe.

Additionally, if you've setup Firefox to be installed with Firefox for Enterprise, DoH is disabled by default and you've got nothing to worry about. DOH is able to be configured through GPO as well, allowing the use of a custom server.

And that is even more dangerous, it would mean that if for some reason an identical domain extists on the internet (or somebody registers it to do an attack) then all the hosts will connect to the malicious external domain and not the correct host in the internal network. Local hosts should be resolved FIRST.

Also cloudfare this way gets the DNS names of your internal hosts, you are leaking information that otherwise would be private, and system administrator will probably not think about that!

Also with that option is not really secure at all, if somebody wants to intercept your DNS requests he can simply block the IPs of Cloudfare DNS over HTTPS server and then read the DNS requests unencrypted.

You should only use a domain you own or something that isn't routable. You can't blame FF for that

That was an issue with .dev and then google acquired the TLD.

.dev isn't an rfc2606 reserved TLD, so it shouldn't have been used for internal domains in the first place

Replying to the part about ‘something that isn’t routable’

Not because something is not routable means that there won’t be issues.

In all reality, your Enterprise should own the domain externally. What happens if one day a configuration flag is flipped and you're no longer resolving internally the domain?

If you have a problem with Cloudflare, go setup your own, it's just BIND9 with some SSL certs.

There is already support for enterprise situations like you describe: https://support.mozilla.org/en-US/kb/canary-domain-use-appli...

Well, ok, but this requires updating all company DNS servers so it’s still far from ideal I would say. They should have done it the other way around: if the DNS returns a specific response enable DoH, otherwise leave it alone.

Reply on news.ycombinator.com