Quick question about DNS and DoH that I thought about after reading this post:
https://packmates.org/@silvereagle@furry.engineer/111176886781705659
Wouldn’t it make sense for Firefox or another third party to bundle and transparently forward all DoH requests to cloudflare so that:
A) Cloudflare doesn’t know who made what request due to not knowing the origin
B) Firefox doesn’t know who made what request due to TLS
That’s somewhat similar to how apple private relay works.
Just an fyi. DoH is a fucking nightmare for network management. For example, if you use a pihole on your network, you 100% do NOT want devices using encrypted DNS.
Is it possible for devices to ask the pihole without doh, and the pi-hole to forward the request with doh if the domain isn’t in the cache?
I’m not an expert but I’m pretty sure no.
I have a mini PC that is always on that runs my NTP and DNS, and it’s upstream DNS is quad nine out of Switzerland. (9.9.9.9). I tend toward the same usage patterns daily, and about a third of my requests never leave my home DNS to get resolved.
@Wander @privacyguides I think that’s what ODoH is. Apple also does something like that with their private relay service.
However, it still allows the last DNS provider in the chain to see all queries, even if they don’t know the exact source.