[FEATURE REQUEST] Private DNS integration of DoH (DNS-over-HTTPS)

Sindbad

Good day,

I switched from iOS to Graphene and love it.
One thing missing - many times requested but rejected by Google for Android - is custom DoH support over Private DNS.

Android supports only DoT which uses port TCP 853 and ist most times blocked in guest or corporate networks. The solution for me on my iPhone was using DoH which uses HTTPS.

Only specific hardcoded DoH URLs are supported on Android (Google and Cloudflare). So the integration of DoH exists in Android, but it's limited to non-private DNS resolvers.

It would be great if Graphene would allow the user to enter custom DoH URLs in addition to DoT. If the users enters a URL starting with "https://" in the custom Private DNS field, DoH should be used instead of DoT. Example URL:
https://dns.mullvad.net/dns-query

This feature would allow the usage of custom encrypted DNS servers including their adblocking and anti-tracking capabilities in nearly every network, since it's much harder to block DoH compared to DoT.

GrapheneOS

Sindbad It's already being implemented upstream and will be able to automatically detect support for it in the future. We don't want to enable the experimental feature too early and have bugs from it.

angela

Great suggestion.

argante

GrapheneOS Is there a chance for DNSCrypt protocol support? Generally, this requires deeper integration with the OS.

And the second question: Block connections without VPN option. This was introduced because of DNS leaks. Would there be a chance to individually grant applications exceptions to this block? For example, if you use Tor, it is difficult to make a voice call if it is over UDP.

Sindbad

Really excited for DoH with custom DNS servers!
I host my own DoH server and it's just great to use DoH instead of DoT, since it never gets blocked by public networks. Such a bad design decision by Google to allow DoH only for it's own Google DNS, so GOS was my last hope to change this behavior on Android.

Hope custom DoH support will be integrated this year in GOS.

Keep up the great work, awesome project with awesome people!

GrapheneOS

argante

Is there a chance for DNSCrypt protocol support?

No, it's overly complex and not useful.

Block connections without VPN option. This was introduced because of DNS leaks.

That's not correct.

Would there be a chance to individually grant applications exceptions to this block? For example, if you use Tor, it is difficult to make a voice call if it is over UDP.

No. Use a separate profile including a work profile or Private Space. Each profile has their own VPN configuration. Using multiple separate VPN setups including not using the VPN within one profile is prone to leaks and not something we'll be adding as supported.

Sindbad

DNSCrypt is deprecated in my point of view.

DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) are the modern replacements with native support in many operatings systems nowadays. It wouldn't make sense for Graphene to add DNScrypt, instead custom DoH providers would make sense.

argante

GrapheneOS That's not correct.

That's the conclusion I drew from this and this.

Use a separate profile including a work profile or Private Space.

This won't solve the problem if the app is used for calling and has to run in the background. You simply won't make or receive a call. A good example of this is Session, which is based on lokinet, which uses UDP. Orbot VPN uses TCP, so Session will be blocked and you won't be able to make a call.

Orbot uses ugly hacks to let some apps through (old).

GrapheneOS

argante

That's the conclusion I drew from this and this.

The VPN lockdown toggle existed long before these reports. These reports are about the toggle not blocking DNS requests it should have blocked.

This won't solve the problem if the app is used for calling and has to run in the background. You simply won't make or receive a call. A good example of this is Session, which is based on lokinet, which uses UDP. Orbot VPN uses TCP, so Session will be blocked and you won't be able to make a call.

That's not correct for user profiles and nested profiles also exist (work profile and Private Space).

Orbot uses ugly hacks to let some apps through (old).

Orbot is full of bad practices and incorrect code. Tor is making their own Tor VPN app to have something actually reliable and robust which doesn't fall far behind on shipping updates to dependencies including Tor.

graphitelover

I didn't know Orbot is full of bad practices. I look forward to the launch of TorVPN betas.

I look forward to the DoH support! DoT is great but of course doesn't work consistently on enterprise networks.

argante

graphitelover Orbot - check out my links for ugly hacks. If you have memory protection (MTE) enabled, Orbot is killed. These are memory errors that can even be exploited.

TorVPN looks much better. If I understand correctly, it will share code with Arti, which is written in Rust. I'm currently using a test version of TorVPN and it doesn't have the same problems as Orbot. There are a few things I would do differently. This is stupid. It's better to make everything as VPN by default and only check for apps that aren't supposed to use Tor. Instead, it filters all apps to see if they can use Tor. This is much slower.

@GrapheneOS

The VPN lockdown toggle existed long before these reports.

Yes, you are right. That's my mistake. I've been using GOS for a short time and I'm just learning everything about it.

That's not correct for user profiles and nested profiles.

But I don't want to change profiles to be able to make a call. I tested Session with TorVPN and even if it is disabled from Tor, it still can't send a message if Block connection without VPN is enabled. TorVPN doesn't support UDP, so Session, which is based on UDP, can't even make any connection.