To the extent feasible, I'd like to be able to use a Pi-hole to block DNS over HTTPS (DoH), using approaches similar to those outlined here: [image] GitHub - bambenek/block-doh: RPZ Zone Files to Block DNS-over-HTTPS RPZ Zone Files to Block DNS-over-HTTPS …

Pi-hole is focused on being a DNS server which can block DNS queries based on predefined filters. It is not meant to be a security product, although it may be used to block malicious domains with certain blocklists. Pi-hole is also a project run by volunteers, and we do not have the manpower to ext…

[image] tychotithonus: To the extent feasible, I’d like to be able to use a Pi-hole to block DNS over HTTPS (DoH) Read my feature request here , my argument here (referring this feature request - fully supporting options to add security features), to reconsider the IP blocking feature, and vot…

+1. See also this active work to disable Firefox's DoH.

As I understand it, DoH in itself cannot be blocked by Pi-hole. Pi-hole is build to handle DNS requests only, and as such, it never sees anything else than DNS requests. This is achieved by configuring your router (or your Pi-hole, if you chose to setup your Pi-hole as your local network's DHCP se…

[image] Bucking_Horn: For now, Pi-hole users could try adding DoH servers to their block lists should they wish to thwart DoH. Why should they query for the IP addresses of DoH servers? This would be the most obvious vulnerability I could imagine in such a system. Hard-wiring the IP addresses…

[image] DL6ER: Why should they query for the IP addresses of DoH servers? This would be the most obvious vulnerability I could imagine in such a system. Hard-wiring the IP addresses of DNS servers is something that has always been done. You are right- assuming a sufficient amount of malevolen…

[image] Bucking_Horn: Sadly, this does not invalidate your objection in the least: The browser could still be made to contact a hard-coded IP address for initial DNS resolution over DoH, potentially paving the way for all successive DoH DNS requests over port 443 As long as we'd know that the…

I personally do not see any privacy benefit of DoH over DoT. The only thing that I see is that the application is now able to perform DNS queries without the oversight of the operator. In Android the ability to modify HTTPS traffic on the fly was neutered some time ago with the introduction of only…

Whether anyone likes DoH or not, it is here and its usage will only grow. Android 9 and 10 already have the client built in and win10 has it coming very soon. iOS is going to support DoH this fall. If Pi-Hole is not going to support DoH any time soon it will simply become irrelevant to users. In…

[image] bramko: Please, face the reality and do not let this project to die in 6-12 months. Don't worry, it won't. Edit: No, that isn't saying that we will support DoH.

Pi-hole Userspace

Blocking DNS-over-HTTPS (DoH)

Feature Requests Closed or Out Of Scope

show post in topic

Home
Categories
Guidelines
Terms of Service
Privacy Policy

Powered by Discourse, best viewed with JavaScript enabled