Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I wonder what can this be used for?


Not the author of this app, but I found this to be very useful for circumventing domain blocks made by ISPs / sovereign entities[0].

Let's say that the government / some central entity takes the blocking a step further by blocking Cloudflare's DNS-over-HTTPS (DoH) endpoint. I could just spin up a new instance on fly.io (or really any other service of your choosing), and use the new endpoint as the new DoH endpoint.

What I like about this service is the fact that I can still use a blocklist to block trackers & ads, just like how you would with NextDNS. Most of the services listed in the example page are pretty generous with their free plans, so the whole setup may end up being cheaper than the Pro plan[1] of NextDNS.

[0]: A number of quite essential services just got blocked by the government where I live, so this is a very real possibility.

[1]: https://nextdns.io/pricing


My ISP analyzes the SNI headers. I really need Encrypted Client Hello.


For others not familiar with SNI vs ECH, Cloudflare has a post on it:

https://blog.cloudflare.com/encrypted-client-hello/


I really really like how your username looks.


Cloudflare Workers supports ECH out of the box. Also, one can deploy serverless-dns against any sub-domain that's available with underlying provider (mydoh.workers.dev, yourdoh.deno.dev, dohapp.fly.dev, etc) and keep changing the sub-domain for free to defeat SNI-based censorship.


Not this project specifically, but a DoH resolver of your own is pretty nice. It's almost impossible for someone to reliably block it by filtering DNS packets (many public networks do for some reason), you can do your own crazy levels of caching (I ignore TTLs and serve stale responses for speed), in general my setup for this just works very pleasantly.


If you want PiHole at all times - at home, while traveling - but don't have a Raspberry Pi.

Use cases: Block ads and tracking domains. Block malware domains. Parental control.

Bonus: Do all that over DoH/DoT to avoid ISP/government/hotel snooping or censoring.


Probably more for privacy reasons. And maybe if you set it to resolve to an adguard or pihole instance it could be for adblocking on the DNS level. Which really is quite effective a lot of the more spammy ads, even though it can't really do anything about Youtube (since they use the same domains for content and ads so blocking ads blocks content too).


Hosting your own DNS resolver.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: