Mozilla’s DNS over HTTPs
One point I haven't seen covered yet is split-horizon DNS where there are actually servers listening on both sides of the horizon (though possibly different ones).<p>Example #1: I have a personal server running at home that is reachable from the internet through a PageKite tunnel. It's reachable through a public address of the form <a href="https://xyz.pagekite.me" rel="nofollow">https://xyz.pagekite.me</a>. The connection is secured by a Let's Encrypt certificate, which means I <i>have</i> to use this address to avoid HTTPS errors and the domain has to be reachable from the internet so I can fulfill challenges.<p>However, I'd also like to access the server from my LAN without an unnecessary round-trip through the internet: I might want to avoid unnecessary data costs or display certain content only available to LAN clients. So from the internet, the domain should resolve to the PageKite tunnel, but inside the LAN, the domain should resolve directly to the server's LAN address.<p>This is relatively easy to accomplish using traditional DNS: Just set up a local DNS server that serves the LAN address. However, how do you do that with DoH?<p>Example #2: You want to set up an internet router at home. The instructions ask you to connect to www.routerlogin.net to pull up the web interface. The domain is split-horizon: When requested through the router, it will resolve to the router's internal address and be served by the router's internal web server. When requested from the internet, it will point to a generic info page from the vendor.<p>Now with DoH, you'd always see the generic info page, even when connecting through the router.