Is there a "canary domain" to signify per-app encrypted DNS should not be used?

Mozilla employs encrypted DNS now in browsers.

If in the case such DNS cannot be used, maybe users need corporate DNS for example, a "canary domain" can be resolved first and if it is successful, encrypted DNS is used by the application. However, if is is unresolved with a known and expected DNS error response, encrypted DNS is not used.

Does Apple have or plan to have a "canary domain" that would allow a VPN on device to "notify" the system a per-app encrypted DNS usage is not allowed?

How does Apple plan on allowing a user on a corporate network to access everything needed on their own DNS without forcibly adopting a per-app encrypted DNS usage?

Thank you,
Logan
Up vote post of logan_covenanteyes Down vote post of logan_covenanteyes
906 views
Posted by
logan_covenanteyes
Reply
Add a Comment

Replies

No canary domain or similar network-based mechanism can disable user-configured DNS settings. That’s the same as how a network cannot tell a device to not use a VPN the user installed.

Protocols for discovering locally hosted DoH servers have not yet been standardized, so at this point, Apple devices will not automatically enable or disable DoH in such scenarios. However, protocols for doing this are being discussed in the IETF, and Apple is participating in those discussions.
Posted by
Frameworks Engineer
Up vote reply of Frameworks Engineer Down vote reply of Frameworks Engineer
Add a Comment