Hacker News Reader

Comment by csunbird | Hacker News Reader

How hard would it be to run a private DoH server? (This is a serious question, not a snarky comment)

Easy: https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Clients#D...

I want to add, that you can't run your own public DNS server nowadays, because it can be misused for DOS and hosting providers scan for open DNS servers.

So if you want your own public DNS resolver, DOH is much easier.

> because it can be misused for DOS and hosting providers scan for open DNS servers

Can you elaborate? I am thinking of doing exactly that, in case of need.

https://blog.cloudflare.com/deep-inside-a-dns-amplification-...

Very, very interesting… I forgot the fact that ip addresses can be spoofed in the UDP packets, essentially making DNS resolvers to carry out the attack for botnets.

DNS servers can be used in an DOS amplification attack by sending requests with spoofed ip addresses. So if you don’t take measures to prevent this it’s likely your server will be used in DOS attacks.

https://us-cert.cisa.gov/ncas/alerts/TA13-088A

You could try to run an IPv6 only DNS server, harder to find.

One reason is that DNS is UDP based, on which source IP spoofing is possible.

But it's not possible to configure via DHCP/network level autoconfiguration, is it?

No and it probably shouldn’t be going forward, by default the local network administrator is an untrusted assumed-malicious entity.

Can you imagine if your network administrator could just tell your computer to send all your unencrypted HTTP traffic to a proxy they control?

I run it on my pihole with Dnscryptproxy.

https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Local-DoH

It isn't too hard.

Reply on news.ycombinator.com