Isn’t the purpose of DoH to increase privacy?
But then if I go to a coffee shop that wants to inspect my DNS queries, they can respond for this mentioned domain in a certain way, and it will result in DoH being disabled and leaving the coffee shop free to inspect the unencrypted DNS I am making?
The argument for this is specious at best - people who don't care enough to change their own DNS servers on their own networks apparently have to be saved from themselves, which is why Firefox decided to turn it on without prompting the user, in spite of many people complaining about changing the default without asking.
Enabling this canary domain doesn't disable DoH, if you've explicitly turned it and/or configured DoH with your own settings. DoH still stays on.
The Cloudflare DoH privacy policy is already one of the least privacy friendly, so anyone who remotely cares about their privacy should not be using Cloudflare DoH.
For example, "transactional and debug log data" is stored for 25 hours at Cloudflare.
If you're in a coffee shop and not using a VPN then, well....
But in direct answer to your question. No.
If you setup DoH correctly then you are not reliant on the initial DNS lookup. For example 9.9.9.9 has a valid cert for 9.9.9.9, so no initial DNS lookup needs to be done.
As an application, don't do your own DNS lookups but respect the ones from the OS.
Which makes me wonder, does Windows respect `use-application-dns.net` when I enable DoH?
> The canary domain only applies to users who have DoH enabled as the default option. It does not apply for users who have made the choice to turn on DoH by themselves.
If a network implements DNS-based content filtering and blocks DOH requests, not responding to a query for this domain could allow an application to know to not bother trying DOH, since it will definitely fail every time.
I could be totally off the mark here, though.
It’s on port 443, probably to the IP of a huge CDN. How would you block it?
I block DoH/DoT quite successfully on my network, not to invade privacy but to block privacy invading sites and usage statistics that the current DoH/DoT providers gather. Thus far it has not been an issue.
I was surprised to find that cell phones automagically discover my DoT 853 listener on my firewall that is served up by Unbound. I do have a "_dns.resolver.arpa" hint record but nothing has ever queried it.
How would you even know it’s happening? Is it even possible to snoop on HTTPS traffic if you have a mobile device like an iPhone? Making it impossible to see is the entire point AFAIK.
[Edit] I should also add that I do not block VPN's. If someone wants to manually bypass my DNS they can do so with a VPN client. Perhaps some day all the browsers will start creating VPN tunnels to random CDN's on 443.
> I block DoH/DoT quite successfully on my network
How do you block encrypted traffic that’s mixed in with normal HTTPS? I get that you can block the well known IPs, but that’s only a partial solution.