In the short term yes. DoH is emerging which will cause some problems for some of the less respectable clients. I also overheard a conversation the other day regarding circumventing this by using ephemeral elastic IPs in AWS and having rotating app versions every few days which change the "good" EIP list. Difficult to shoot that thinking down unfortunately. It's a bad situation when you have to consider that the attack vector is inside your network and comes from your operating system, applications and browsers
.
Working from home today and they've started digging bloody holes outside my house with a fibre seeking backhoe
[/quote]
So far, Mozilla are the only ones implementing DoH, with the idiot fanboys who think it is "TCP/HTTP" cheering along and Cloudflare getting all the queries. Here, I've taken the more conservative approach to implement a NXDOMAIN-answering setting for the canary domain, so everything compliant should revert to proper DNS.
On the bottom line, a self-run full-service resolver, with DNSSEC validation, is a much more secure and privacy-keeping setup than DoH. Even if it is vanilla UDP/TCP 53 queries with no encryption.
In other news, the boss cheers on my TE desires at work. Time- and opto-nuttery in one device, for insane amounts of money.
Måns, thinks about another IP protocol (not TCP or UDP, but something /different/, so different that the app devloprs With Frameworks And New Cool Languages That Are Insane Security Holes will have a hard time understand it.
Whaddyamean Network Byte Order? I think JSON is low-level enough!)