Prevent client auto DoH

[Xboxsx4life]

Hello. I'm running AX86U Pro with latest Merlin release. I've reviewed this thread...

Prevent client auto DoH

Hi, with regards the setting for Prevent client auto DoH, wanted to be sure I understand what the "Yes" option means. I see the release notes say: Added option to prevent automatic DoH upgrade by Firefox. By default this option will only prevent automatic upgrade if you use DNSFilter or...

www.snbforums.com

...but I'm still not clear on the difference between "Auto" and "Yes" for the "Prevent client auto DoH" setting when using a DNS filter with DoT.

I currently have DoT enabled in strict mode with Cloudflare's resolvers. And I have Prevent client auto DoH set to "Auto". Should this be changed to "Yes"?

 

[dave14305]

If DNS Privacy or DNS Director are enabled, the Auto option means “Yes.” If neither are enabled, Auto means “No.”

 

[Xboxsx4life]

Perfect. Thank you.

 

[RMerlin]

Many Asuswrt settings will display a context help popup if you click on the label:

 

[sfx2000]

Just note that DoH depends on a white/black list of hosts...

 

[RMerlin]

Just note that DoH depends on a white/black list of hosts...

The way my Prevent auto DoH works is through the APIs used by Windows and Firefox.

In Firefox's case, it won't auto-promote to DoH if the use-application-dns.net hostname resolves to NXDOMAIN or no valid record.

Canary domain - use-application-dns.net | Firefox Help

Network administrators may configure their networks to modify DNS requests for the following special-purpose domain, called a ''canary domain''.

support.mozilla.org

In Windows' case, it works by preventing DDR (Discovery of Designed Resolver) from working:

Making DoH Discoverable: Introducing DDR | Microsoft Community Hub

Discovery of Designated Resolvers (DDR) is available to Windows Insiders to dynamically discover DoH configurations

techcommunity.microsoft.com

 

[Xboxsx4life]

Thanks for everyone’s responses. Much appreciated. Final follow up question…

How valuable would it be to enable rebind protection? I understand what it does but not sure how much additional security it would add given that it can break certain services from what I’ve read. I’m using DoT in strict mode with ‘DNSSEC’ and ‘validate unsigned replies’ both enabled. Just not sure if it’s worth enabling rebind protection too.

Thanks again.

 

[Intrepid]

The way my Prevent auto DoH works is through the APIs used by Windows and Firefox.

In Firefox's case, it won't auto-promote to DoH if the use-application-dns.net hostname resolves to NXDOMAIN or no valid record.

Canary domain - use-application-dns.net | Firefox Help

Network administrators may configure their networks to modify DNS requests for the following special-purpose domain, called a ''canary domain''.

support.mozilla.org

In Windows' case, it works by preventing DDR (Discovery of Designed Resolver) from working:

Making DoH Discoverable: Introducing DDR | Microsoft Community Hub

Discovery of Designated Resolvers (DDR) is available to Windows Insiders to dynamically discover DoH configurations

techcommunity.microsoft.com

Hi. Do you know how Asus implements this: "Prevent client auto DoH" and exactly how it works? Also are there any cons or side effects when set to Yes? Thank You very much for your insight.
I have an RT-AX86U Pro with the latest Asus firmware 3.0.0.6.102_34313 and with Filter Mode: Safe Quad9.

 

[RMerlin]

Hi. Do you know how Asus implements this: "Prevent client auto DoH" and exactly how it works?

Asus didn't implement this, I did.

All it does is sinkhole a few specific domains that are used by various clients to determine if automatic promotion to DoH should be done or not.

address=/use-application-dns.net/
address=/_dns.resolver.arpa/
address=/mask.icloud.com/mask-h2.icloud.com/

First one is for Firefox, second one is for Windows, and third one is for iOS.

 

[Intrepid]

Asus didn't implement this, I did.

All it does is sinkhole a few specific domains that are used by various clients to determine if automatic promotion to DoH should be done or not.

address=/use-application-dns.net/
address=/_dns.resolver.arpa/
address=/mask.icloud.com/mask-h2.icloud.com/

First one is for Firefox, second one is for Windows, and third one is for iOS.

Thanks! Several people last year claim it broke Apple iCloud. But I don't see an iCloud issue after testing two Windows PCs.
See: https://zentalk.asus.com/t5/network...ffecting-icloud-connection/td-p/379654/page/2
Any side effects we should be aware of when "Prevent client auto DoH" is set to Yes using stock Asus firwmware?
"Asus didn't implement this, I did." Does this mean you wrote the code and Asus adopted it?
Thank You again.

 

[RMerlin]

Several people last year claim it broke Apple iCloud.

It does not. What it does is prevent iCloud Private Relay from bypassing your router's configured DNS servers, which is the point behind this toggle option.

Does this mean you wrote the code and Asus adopted it?

Yes. There's quite a few pieces of code in upstream Asuswrt that originally came from Asuswrt-Merlin, it's nothing really exceeptional here. Although Asus only prevents Firefox' auto DoH promotion from working, they didn't implement (so far) the additional sinkholes.

 

[Linuxer]

Just note that DoH depends on a white/black list of hosts...

I use this list in my AdGuard Home config.