Mozilla’s DNS over HTTPs
I&#x27;m so sad to see Mozilla move forward with this massive attack on user privacy.<p>Firefox DoH is snake oil, plain and simple.  It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user&#x27;s traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens of thousands of individual ISPs.<p>Simultaneously, it does not protect the user from monitoring by their ISP or parties situated there because the user&#x27;s destination IPs remain unencrypted, as well as the hostnames via SNI (for cases of shared hosting, e.g. on cloudflare, where the IP alone wouldn&#x27;t be enough).<p>At the moment you can disable this across your whole lan by blocking traffic to 104.16.248.249, 104.16.249.249, 2606:4700::6810:f8f9, and 2606:4700::6810:f9f9 and by DNS blackholing use-application-dns.net and cloudflare-dns.com.<p>iptables -t raw -A PREROUTING -d 104.16.248.249 -j DROP<p>iptables -t raw -A PREROUTING -d 104.16.249.249 -j DROP<p>ip6tables -t raw -A PREROUTING -d 2606:4700::6810:f8f9 -j DROP<p>ip6tables -t raw -A PREROUTING -d 2606:4700::6810:f9f9 -j DROP<p>And if you&#x27;re using bind:<p>zone &quot;use-application-dns.net&quot; {
        type master;
        file &quot;&#x2F;etc&#x2F;bind&#x2F;db.empty&quot;;
};<p>zone &quot;cloudflare-dns.com&quot; {
       type master;
       file &quot;&#x2F;etc&#x2F;bind&#x2F;db.empty&quot;;
};<p>Or unbound:<p>local-zone: &quot;use-application-dns.net&quot; static<p>local-zone: &quot;cloudflare-dns.com&quot; static<p>But there is no guarantee that these mitigations will continue to work.<p>[Edit: Aside, this comment and many&#x2F;most(?) comments on this thread were moved from a more recent thread with a headline &quot;Firefox turns on DoH as default for US users&quot;.  The new title which omits the on-as-default, is kinda burying the lead.]