DNS over HTTPS is not what I thought

https://www.petefreitag.com/blog/dns-over-https/

by rmason • 2 years ago

87 25 2 years ago

jez• 2 years ago

In this case how is dns.google or cloudflare-dns.com resolved?

Maybe in this case, because the author of the post only cares to check whether certain domains resolve or not, having the DNS server be resolved by normal DNS not DNS over HTTPS is fine, and that in other cases you’d hardcode an IP like with normal DNS resolution?

remram2• 2 years ago

Those are hardcoded.

dns.google is 8.8.8.8 and cloudflare-dns.com is 1.1.1.1. You can replace the names with those IPs in the curl commands if you want, the certificates are valid for the IPs too.

pyuser583• 2 years ago

How are certificates valid for IPs!?!

AlexSW• 2 years ago

Hard-coded in what? Every DoH client?

Astraco• 2 years ago

They're not. I see queries to dns.google in my pihole all the time.

navigate8310• 2 years ago

You usually provide an upstream all IP DNS to query the DoH provider which ultimately resolves whatever queries need resolution.

QuinnyPig• 2 years ago

Ooh, this is awesome! I can start using DNS as a database for even more things with what amounts to an automatic JSON endpoint handled for me.

arielcostas2• 2 years ago

Ah, yes, Route53, AWS' dirty-cheap globally-replicated database with a 100% uptime SLA.

loevborg2• 2 years ago

Well, uhm, actually, what's stopping me from using this as a simple feature-flagging service?

loevborg2• 2 years ago

I think the google example should read

    curl -H 'Accept: application/dns-json' 'https://dns.google/resolve?name=example.com&type=A'

pfreitag• 2 years ago

yes, you're right - my bad - post updated

melomac• 2 years ago

Lovely, made a fish shell function out of it:

    # https://www.petefreitag.com/blog/dns-over-https/

    function dnsq --description "Query DNS name(s) over HTTPs using JSON"

        argparse --ignore-unknown 'h/help' 'd/dns=' 'n/name=+' 't/type=+' -- $argv

        if set -q _flag_help
            echo "Usage: $_ example.com"
            echo '  -n --name    DNS query name(s)'
            echo '  -t --type    DNS query type(s), ex: A (default), MX, TXT...'
            echo '  -d --dns     DNS query endpoint: cloudflare (default), google'
            echo '  -h --help    Print this help message and exit'
            return 0
        end

        if not set -q _flag_name && test (count $argv) -eq 0
            echo 'Missing name parameter.'
            return 1
        end

        if not set -q _flag_type
            set _flag_type 'A'
        end

        switch $_flag_dns
            case 'google'
                set url 'https://dns.google/resolve'
            case 'cloudflare' '*'
                set url 'https://cloudflare-dns.com/dns-query'
        end

        for type in $_flag_type
            for name in $_flag_name $argv
                set query (string join '&' (string join '=' 'name' $name) (string join '=' 'type' $type))

                if isatty stdout && type -q jq
                    curl --header 'Accept: application/dns-json' --silent (string join '?' $url $query) | jq -r
                else
                    curl --header 'Accept: application/dns-json' --silent (string join '?' $url $query)
                end
            end
        end

    end

tionis• 2 years ago

And I made it into a bash script (with a header to have stacktraces in bash):

  #!/bin/env bash
  #--------------------------------------------
  set -Eeuo pipefail
  if [[ -n "${DEBUG:-}" ]]; then
    set -x
  fi
  trap stack_trace ERR
  function stack_trace() {
    echo -e "\nThe command '$BASH_COMMAND' triggerd a stacktrace:\nStack Trace:"
    for (( i = 1; i < ${#FUNCNAME[@]}; i++ )); do
      echo "    ($i) ${FUNCNAME[$i]:-(top level)} ${BASH_SOURCE[$i]:-(no file)}:${BASH_LINENO[$(( i - 1 ))]}"
    done
  }
  error(){ echo "${1:-error message missing}" && trap true ERR && exit 1; }
  SCRIPT_DIR="$(dirname "$(readlink -f "$0")")"
  export SCRIPT_DIR
  #--------------------------------------------
  function dnsq {
    # https://www.petefreitag.com/blog/dns-over-https/
    while [[ $# -gt 0 ]]; do
      case "$1" in
        -h|--help)
          echo "Usage: $0 example.com"
          echo '  -n --name    DNS query name(s)'
          echo '  -t --type    DNS query type(s), ex: A (default), MX, TXT...'
          echo '  -d --dns     DNS query endpoint: cloudflare (default), google'
          echo '  -h --help    Print this help message and exit'
          return 0
          ;;
        -n|--name)
          shift
          _flag_name+=("$1")
          ;;
        -t|--type)
          shift
          _flag_type+=("$1")
          ;;
        -d|--dns)
          shift
          _flag_dns="$1"
          ;;
        \*)
          _flag_name+=("$1")
          ;;
      esac
      shift
    done

    if [[ ${_flag_name:-} = "" ]]; then
      echo 'Missing name parameter.'
      return 1
    fi

    if [[ ${_flag_type:-} = "" ]]; then
      _flag_type=("A")
    fi

    case ${_flag_dns:-cloudflare} in
      "google")
        url="https://8.8.8.8/resolve"
        ;;
      "cloudflare")
        url="https://1.1.1.1/dns-query"
        ;;
    esac

    for type in "${_flag_type[@]}"; do
      for name in "${_flag_name[@]}"; do
        query="name=$name&type=$type"
        if [[ -t 1 ]] && command -v jq >/dev/null; then
          curl --header 'Accept: application/dns-json' --silent "$url?$query" | jq -r
        else
          curl --header 'Accept: application/dns-json' --silent "$url?$query"
        fi
      done
    done
  }

  dnsq "$@"

DNS over HTTPS is not what I thought

Related Stories