Lightboard Lessons: DNS over HTTPS

[JRahm]

DNS over HTTPS (DoH for short) is making a name for itself in the news lately. It seems like everyone except the end user is a little up in arms over the push in Chrome and Firefox to default to DoH for lookups. In this Lightboard Lesson, Jason covers what DoH is, options to configure it in BIG-IP, and some of the industry concerns over adoption.

Resources

F5 Related

• Unbreaking the Internet. In this article, Eric Chen covers how to get around internal use of 1.1.1.1 so Cloudflare DNS can still be reached, as well as BIG-IP configuration options for clients unable to support DoH.
• Inbound DoH (and DoT) iRules Solution. This GitHub repository is a solution from Greg Robinson to handle inbound DoH requests with iRules and iRulesLX.

Related Industry News

• ISPs Seek Hill Intervention in Encryption-Related Google DNS Change
• Why big ISPs aren't happy about Google's plans for encyrpted DNS
• DoH is the Wrong Partial Solution
• Everything You Need to Know About DNS Encryption - And Why Google May Not Be Doing Evil

[chaim]

Hi, if i work with DOH in F5 , The client need change something?

[David_Doucette]

Yes, the client will need a DOH compliant browser or OS that supports it.

[chaim]

Also if its form API service ?

[Nesro]

Hi is thee a guide or tutorial to deploy DoH on big ip link controler?

[Nesro]

Well what i meant was if a big ip product like LC or others can be configured as a DoH server resolver, how can we do that?

[JRahm]

no native config, yet. These are iRules/iRulesLX implementations.