7 ms·

> Private DNS on Android refers to 'DNS over HTTPS' Yes, sorry, I did not mention it. So if you want to use DNS over HTTPS on Android, it is not possible to p

by rom1v 1y ago

> Private DNS on Android refers to 'DNS over HTTPS' Yes, sorry, I did not mention it. So if you want to use DNS over HTTPS on Android, it is not possible to provide a fallback.

ignoramous 1y ago
> So if you want to use DNS over HTTPS on Android, it is not possible to provide a fallback. Not true. If the (DoH) host has multiple A/AAAA records (multiple IPs), any decent DoH client would retry its requests over multiple or all of those IPs.
- lxgr 1y ago
  Does Cloudflare offer any hostname that also resolves to a different organization’s resolver (which must also have a TLS certificate for the Cloudflare hostname or DoH clients won’t be able to connect)?
  - ignoramous 1y ago
    Usually, for plain old DNS, primary and secondary resolvers are from the same provider, serving from distinct IPs.
    - lxgr 1y ago
      Yes, but you were talking about DoH. I don’t know how that could plausibly work.
      - ignoramous 1y ago
        > but you were talking about DoH DoH hosts can resolve to multiple IPs (and even different IPs for different clients)? Also see TFA It's worth noting that DoH (DNS-over-HTTPS) traffic remained relatively stable as most DoH users use the domain cloudflare-dns.com, configured manually or through their browser, to access the public DNS resolver, rather than by IP address. DoH remained available and traffic was mostly unaffected as cloudflare-dns.com uses a different set of IP addresses.
        lxgr 1y ago
        > DoH hosts can resolve to multiple IPs (and even different IPs for different clients)? Yes, but not from a different organization. That was GPs point with > So if you want to use DNS over HTTPS on Android, it is not possible to provide a fallback. A cross-organizational fallback is not possible with DoH in many clients, but it is with plain old DNS. > It's worth noting that DoH (DNS-over-HTTPS) traffic remained relatively stable as most DoH users use the domain cloudflare-dns.com Yes, but that has nothing to do with failovers to an infrastructurally/operationally separate secondary server.
        ignoramous 1y ago
        > A cross-organizational fallback is not possible with DoH in many clients, but it is with plain old DNS. That's client implementation lacking, not some issue inherent to DoH? The DoH client is configured with a URI Template, which describes how to construct the URL to use for resolution. Configuration, discovery, and updating of the URI Template is done out of band from this protocol. Note that configuration might be manual (such as a user typing URI Templates in a user interface for "options") or automatic (such as URI Templates being supplied in responses from DHCP or similar protocols). DoH servers MAY support more than one URI Template. This allows the different endpoints to have different properties, such as different authentication requirements or service-level guarantees. https://datatracker.ietf.org/doc/html/rfc8484#section-3 https://datatracker.ietf.org/doc/html/rfc8484#section-3
        lxgr 1y ago
        Yes, but this restriction of only a single DoH URL seems to be the norm for many popular implementations. The protocol theoretically allowing better behavior doesn't really help people using these.

by rom1v 1y ago

> Private DNS on Android refers to 'DNS over HTTPS' Yes, sorry, I did not mention it. So if you want to use DNS over HTTPS on Android, it is not possible to provide a fallback.

ignoramous 1y ago

> So if you want to use DNS over HTTPS on Android, it is not possible to provide a fallback. Not true. If the (DoH) host has multiple A/AAAA records (multiple IPs), any decent DoH client would retry its requests over multiple or all of those IPs.

lxgr 1y ago
Does Cloudflare offer any hostname that also resolves to a different organization’s resolver (which must also have a TLS certificate for the Cloudflare hostname or DoH clients won’t be able to connect)?
- ignoramous 1y ago
  Usually, for plain old DNS, primary and secondary resolvers are from the same provider, serving from distinct IPs.
  - lxgr 1y ago
    Yes, but you were talking about DoH. I don’t know how that could plausibly work.
    - ignoramous 1y ago
      > but you were talking about DoH DoH hosts can resolve to multiple IPs (and even different IPs for different clients)? Also see TFA It's worth noting that DoH (DNS-over-HTTPS) traffic remained relatively stable as most DoH users use the domain cloudflare-dns.com, configured manually or through their browser, to access the public DNS resolver, rather than by IP address. DoH remained available and traffic was mostly unaffected as cloudflare-dns.com uses a different set of IP addresses.
      - lxgr 1y ago
        > DoH hosts can resolve to multiple IPs (and even different IPs for different clients)? Yes, but not from a different organization. That was GPs point with > So if you want to use DNS over HTTPS on Android, it is not possible to provide a fallback. A cross-organizational fallback is not possible with DoH in many clients, but it is with plain old DNS. > It's worth noting that DoH (DNS-over-HTTPS) traffic remained relatively stable as most DoH users use the domain cloudflare-dns.com Yes, but that has nothing to do with failovers to an infrastructurally/operationally separate secondary server.
        ignoramous 1y ago
        > A cross-organizational fallback is not possible with DoH in many clients, but it is with plain old DNS. That's client implementation lacking, not some issue inherent to DoH? The DoH client is configured with a URI Template, which describes how to construct the URL to use for resolution. Configuration, discovery, and updating of the URI Template is done out of band from this protocol. Note that configuration might be manual (such as a user typing URI Templates in a user interface for "options") or automatic (such as URI Templates being supplied in responses from DHCP or similar protocols). DoH servers MAY support more than one URI Template. This allows the different endpoints to have different properties, such as different authentication requirements or service-level guarantees. https://datatracker.ietf.org/doc/html/rfc8484#section-3 https://datatracker.ietf.org/doc/html/rfc8484#section-3
        lxgr 1y ago
        Yes, but this restriction of only a single DoH URL seems to be the norm for many popular implementations. The protocol theoretically allowing better behavior doesn't really help people using these.