https://blogs.damiendye.uk/en/tags/doh/ Recent content in Doh on Damien Dye's Blog Hugo en-GB Sun, 27 Sep 2026 09:00:00 +0100 https://blogs.damiendye.uk/en/dns/resolved-the-resolver-you-are-already-running/ Sun, 27 Sep 2026 09:00:00 +0100 https://blogs.damiendye.uk/en/dns/resolved-the-resolver-you-are-already-running/ systemd-resolved is on most Linux desktops, caching every lookup and validating none of them. What the stub on 127.0.0.53 does, measured cache figures, turning DNSSEC on, why DNS over TLS works but DNS over HTTPS does not exist, what Fedora, Ubuntu, Debian and RHEL each ship, and why you almost certainly do not need a custom build. https://blogs.damiendye.uk/en/dns/dns-over-https-walks-past-your-controls/ Thu, 24 Sep 2026 09:00:00 +0100 https://blogs.damiendye.uk/en/dns/dns-over-https-walks-past-your-controls/ DoH sends your DNS lookup to a resolver of the client's choosing on port 443, which your own resolver never sees, so it cannot block a bad name or log it. Sold as privacy, but DoT gave you that in 2016. What DoH really adds is bypassing the network admin. The mechanism, the malware, who pushed it, the courts now suing the resolvers, and the fix.