Hacker News Reader

If the possibility of having the DNS packets rewritten was a concern for them, any junior developer could have easily implemented a proprietary REST web service to get the IPs over HTTPS just like DoH. Standardization of DoH in browsers isn't really furthering that issue.

View on HN

How would they get the first IP for the REST client to contact?

That problem isn't solved by DoH, you still need to hardcode the DoH server IP there too if you intend to bypass the network level settings. So a proprietary system would be no different.

All the major appliance vendors (Google, Amazon) already have huge fixed IP ranges to devote to this purpose, which are effectively unblockable because they might be shared with important cloud services.

Reply on news.ycombinator.com