Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I use my PiHole to do balancing like this. I've set it up with DoT and DoH so that DNS requests are spread across several servers.

Then, I expose my PiHole as a DoT + DoH server (DoT for Linux and Android, DoH for Firefox) so that I can always use my ad block lists and secured DNS traffic.



Doesn't this just result in more organizations having your data? Presumably most DNS entries have some finite TTL, such as a few minutes / hours / days. Let's say one of your favorite websites has a TTL of 10 hours, and you visit this website once per day. Then eventually (soon!) you will have asked most or all of your servers for that domain, so now they all have your data. Or do you have your PiHole configured that it always asks the same server for the same domain?


You're right that this is the case. I set it up so that I can use the double encryption system with a DoH proxy when I eventually resolve this issue. In practice, 60% is my traffic ends up at cloudflare already, so I might as well use their DNS until then.

It's also an availability thing. There's that one archive website on a vendetta against cloudflare for not forwarding enough data in DNS requests (eDNS or something?) that I can access by using alternative servers as well. In the rare case of a cloudflare outage, this also ensures uptime.

DNS cannot be made fully anonymous, though that double encrypted DoH thing seems promising. Picking a few trusted providers isn't a problem for me personally.


You could share the namespaces using some consistent hashing so any given domain would hit the same server.

Maybe something exists for that already?


I don't understand.

I have a PiHole, and have the cloudflare DoH client installed on it.

Requests from my network go to the PiHole, and the PiHole is set to query localhost:5053, which then hits a DoH provider.

Why do you have separate setups for mobile vs. desktop web browser, why not have the OS do native DNS to your PiHole?


When I'm on my laptop, in the train, working on Windows, I can't use my home DNS without exposing it to the world and becoming part of every DDoS attack there is. So, for those situations, I've got Firefox set up to do DoH. Windows can do some DNS encryption through a complex setup of local DNS servers but it's nothing as easy as the standard Linux setup.

Similarly, I use DoT on my phone but if I want to connect to any hotspot, I have to disable DoT because the hotspot login detection fails with DoT configured. I think it's a Xiaomi thing. Regardless, I need to disable it to use. In one particular case (scanning groceries in the supermarket for the automated payout) I can't fall back to LTE like usual. Just in case I forget to turn DoT back on, I've also configured Firefox on my phone to use DoH because the mechanism is there and I might as well.

There's small edge cases where I just like to fall back to browser DoH. DoT and I'm network DNS still works fine, of course.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: