Is there a "canary domain" to signify per-app encrypted DNS should not be used?

Question

Created Jun ’20

Replies 1

Boosts 0

Participants 2

Mozilla employs encrypted DNS now in browsers.

If in the case such DNS cannot be used, maybe users need corporate DNS for example, a "canary domain" can be resolved first and if it is successful, encrypted DNS is used by the application. However, if is is unresolved with a known and expected DNS error response, encrypted DNS is not used.

Does Apple have or plan to have a "canary domain" that would allow a VPN on device to "notify" the system a per-app encrypted DNS usage is not allowed?

How does Apple plan on allowing a user on a corporate network to access everything needed on their own DNS without forcibly adopting a per-app encrypted DNS usage?

Thank you,
Logan

Boost

Answer 1

Engineer OP

Apple

Jun ’20

No canary domain or similar network-based mechanism can disable user-configured DNS settings. That’s the same as how a network cannot tell a device to not use a VPN the user installed.

Protocols for discovering locally hosted DoH servers have not yet been standardized, so at this point, Apple devices will not automatically enable or disable DoH in such scenarios. However, protocols for doing this are being discussed in the IETF, and Apple is participating in those discussions.

0