DNS over HTTPS

DoH

• rfc8484RFCRFC 8484IETF Request for Comments standard document.RFC
• Server
  • dns.cloudflare.com/dns-query 被墙
  • dns.alidns.com/dns-query 不支持 application/dns+json
  • adh.avpclub.gq/dns-query
  • dns.futa.gg/dns-query
  • 1.1.1.1/dns-query
  • 1.0.0.1/dns-query
  • dns.cloudflare.com
  • dns.google.com
  • 9.9.9.9
• Client
  • macOS 11 Big Sur+
    • apple.nextdns.io
  • dnscrypt-proxy笔记DNSCryptDNSCrypt/dnscrypt-proxy 是什么？ · DNS 客户端和 Resolver 之间的通信协议 · 支持加密，认证，匿名 · dnscrypt.info · 在线服务列表 · dnscrypt/dnscrypt-resolvers打开：/notes/service/dns/dnscrypt - 代理 - DoH -> DNS
  • Chrome
    • chrome://settings/security -> Use Secure DNS
  • Browser developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/encrypted-dns-browsers
• 参考
  • dns.google
  • curl/curl/wiki/DNS-over-HTTPSGitHubcurl/curl/wiki/DNS-over-HTTPSrfc8484 · Server · https://dns.cloudflare.com/dns-query 被墙 · https://dns.alidns.com/dns-query 不支持 application/dns+json · https://adh.avpclub.gq/dns-query笔记：DNS over HTTPS
  • wikipedia DNS-over-HTTPSWikipediaDNS over HTTPS
  • developers.google.com/speed/public-dns/docs/doh

# curl 使用 DoT 解析
curl --doh-url https://dns.cloudflare.com/dns-query https://wener.me
# 直接解析
curl -s -H 'accept: application/dns-json' 'https://dns.cloudflare.com/dns-query?name=wener.me&type=A' | jq
curl -s -H 'accept: application/dns+json' 'https://dns.google.com/resolve?name=wener.me&type=A' | jq
# 不支持
curl -s -H 'accept: application/dns-json' 'https://dns.alidns.com/dns-query?name=wener.me&type=A'

cloudflared proxy-dns --port 5553

dig +short @127.0.0.1 -p5553 cloudflare.com AAAA

dnscrypt-proxy -resolve cloudflare-dns.com

Wireformat

• 最大 65535 bytes
• base64url encode
• binary 同 DNS over UDP - rfc1035
• ?dns
  • application/dns-message
  • 格式 RFC 1035RFCRFC 1035IETF Request for Comments standard document.RFC
• developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/make-api-requests/dns-wireformat