1

I have a DNS server running inside our private network on IP 10.10.0.10. The DNS servers resolves URL’s to private IP’s also inside our network. SSL for all URL’s is handled by a wildcard cert for a .BIZ domain. But recently Chrome & Firefox began enabling DNS-over-HTTPS during recent updates. Since our DNS server is not DOH compliant, users cannot navigate to our URL’s unless they disable the DOH feature inside their browser.

Ideally I would like our users to keep DOH enabled inside their browsers and still rely on the local DNS server to resolve URL’s to our private IP’s. In an attempt to achieve this I looked at doh-proxy. I spun up a Centos-7 VM on IP 10.10.0.20, installed doh-proxy, and opened up port 443. I then executed:

/usr/local/bin/doh-proxy --upstream-resolver=10.10.0.10 --certfile=/etc/pki/public/mycompany.bundle.biz.crt --keyfile=/etc/pki/private/mycompany.biz.pem

Using netstat I verified port 443 was listening. I then modified my VPN configuration to change the DNS setting from 10.10.0.10 to 10.10.0.20 (the new doh-proxy server). However I still could not navigate to our URL’s with DOH enabled in the browser.

Am I misunderstanding the intent behind doh-proxy?

1 Answer 1

1

I don't think that you misunderstand the intent behind doh-proxy, it appears to be a DoH frontend for a regular DNS resolver server, creating a way for DoH clients to query said resolver server.
There are several other such proxy solutions, if this particular implementation would turn out to not be suitable for whatever reason.

What I believe that you may have misunderstood/overlooked, however, is that to configure DoH, the client needs to know the URL for the DoH server (eg https://dns.quad9.net/dns-query, https://dns.google/dns-query, etc), having just an IP address does nothing for setting up DoH.

And, to make matters difficult, DoH currently has no proper discovery mechanism in place. (Which is the root cause behind a lot of the controversy around DoH, especially so with Mozilla's approach.)

Examples of how "DoH enabled by default" works at this point:

  • Firefox is set up to know the DoH server to use (Mozilla picks a DoH service on behalf of their users, disregarding OS configuration).
  • Chrome selectively upgrades from plain DNS to DoH based on a mapping table with well-known IP addresses of DNS services as the key, eg 8.8.8.8 -> https://dns.google/dns-query (Google maintains a mapping table for well-known DNS services and the DoH upgrade only occurs when the mapping table facilitates querying the same DNS service that the OS configuration indicates for plain DNS).

All in all, it's easy enough to run your own DoH service, not necessarily easy to make clients use it.

What you need to do is to somehow tell the clients to use https://dns.example.com/dns-query (if we assume this is the proper URL for your proxy) as their DoH endpoint, which in its simplest form probably means manual configuration on the clients (per application, no less).
You can certainly find ways of automating the configuration of a set of known applications, but at this point there is no established discovery method comparable to how for example DHCP can deliver the addresses for plain DNS.

1
  • This clarification really helped. All I needed to do was add dns.mycompany.biz/dns-query as a Custom DOH provider under Chrome's secure DNS setting.
    – Bob C.
    Aug 16, 2020 at 21:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.