Seen quite a few guides on enabling DNS over HTTPS (DoH) but nothing yet talking about it working internally. I want to have my android phone be able to use local hostnames. Worst case I spin up a pi-hole docker container but be nice to be able to have it native. Does the Hex S support this or is it only for getting DNS for itself?
I don’t know whether you’re overthinking matters or overlooking something obvious, but there’s no obscurity here at all. You set the router up to use DoH as documented, enable an externally-responding DNS server on same with your DoH as the upstream, then pass your router’s IP out with DHCP requests as the LAN’s DNS server:
/ip dhcp-server network
add address=192.168.88.0/24 gateway=192.168.88.1 \
dns-server=192.168.88.1 ntp-server=192.168.88.1
/ip dns
set allow-remote-requests=yes \
servers=1.1.1.2,1.0.0.2 verify-doh-cert=yes \
use-doh-server=https://security.cloudflare-dns.com/dns-query \
Voilà, all LAN hosts using DHCP start using DoH via your router.
I will give it a try, and I might be over thinking it. Nothing claimed the internal hosts would be getting and using DOH. Does it allow fallback for hosts that cannot use DOH?
The internal hosts don’t use DoH themselves. They ask the router questions via plain old DNS, and it asks Cloudflare (in this case) questions via DoH on their behalf.
OK, so that is what I was looking for. So Mikrotik routers can only be DoH clients, not servers. What a shame, seems to be a huge miss in the entire market space. Pi-Hole and eventually building my own opnsense box it is. Thanks that helps.
Seriously? Encrypting DNS across the private LAN is a “huge miss in the entire market space”? That seems a rather niche requirement.
Encrypting over the Internet is the bulk of the market need, and for that, the current facilities suffice.
Tend to agree. If concerned about privacy on the LAN, you should just encrypt all data using a VPN to router – still enough HTTP and other protocols that “leak” information if one can snoop the wire on a LAN.
Well… AFAIK only Window 11 even supports setting DoH… Mac and Linux desktop (and older Windows) do not even allow it. And even on Win11, it’s still manual configuration… since RFC-9463 for “DHCP and Router Advertisement Options for the Discovery of Network-designated Resolvers (DNR)” was only ratified THIS YEAR and Win11 does not support it yet.
If Mikrotik were going to offer some secure DNS server for client OS, DNS-over-QUIC (DoQ) be better thing to support than plain DoH. TCP-based DoH seems ill suited for LAN since it so much slower than plain UDP-based DNS. At least DoQ uses UDP and quicker secure handshake.