Prevent client auto DoH

[Xboxsx4life]

Hello. I'm running AX86U Pro with latest Merlin release. I've reviewed this thread...

Prevent client auto DoH

Hi, with regards the setting for Prevent client auto DoH, wanted to be sure I understand what the "Yes" option means. I see the release notes say: Added option to prevent automatic DoH upgrade by Firefox. By default this option will only prevent automatic upgrade if you use DNSFilter or...

www.snbforums.com

...but I'm still not clear on the difference between "Auto" and "Yes" for the "Prevent client auto DoH" setting when using a DNS filter with DoT.

I currently have DoT enabled in strict mode with Cloudflare's resolvers. And I have Prevent client auto DoH set to "Auto". Should this be changed to "Yes"?

 

[dave14305]

If DNS Privacy or DNS Director are enabled, the Auto option means “Yes.” If neither are enabled, Auto means “No.”

 

[Xboxsx4life]

Perfect. Thank you.

 

[RMerlin]

Many Asuswrt settings will display a context help popup if you click on the label:

 

[sfx2000]

Just note that DoH depends on a white/black list of hosts...

 

[RMerlin]

Just note that DoH depends on a white/black list of hosts...

The way my Prevent auto DoH works is through the APIs used by Windows and Firefox.

In Firefox's case, it won't auto-promote to DoH if the use-application-dns.net hostname resolves to NXDOMAIN or no valid record.

Canary domain - use-application-dns.net | Firefox Help

Network administrators may configure their networks to modify DNS requests for the following special-purpose domain, called a ''canary domain''.

support.mozilla.org

In Windows' case, it works by preventing DDR (Discovery of Designed Resolver) from working:

Making DoH Discoverable: Introducing DDR

Discovery of Designated Resolvers (DDR) is available to Windows Insiders to dynamically discover DoH configurations

techcommunity.microsoft.com

 

[Xboxsx4life]

Thanks for everyone’s responses. Much appreciated. Final follow up question…

How valuable would it be to enable rebind protection? I understand what it does but not sure how much additional security it would add given that it can break certain services from what I’ve read. I’m using DoT in strict mode with ‘DNSSEC’ and ‘validate unsigned replies’ both enabled. Just not sure if it’s worth enabling rebind protection too.

Thanks again.