Member OP
Hi everyone, sorry if this is a dumb question. I set up a DNS-over-HTTPS endpoint for myself using nginx and a small go program on my CloudCone VPS. It works but Im wondering if this is overkill for one person? Like Cloudflare already offers this for free. Is anyone else running personal DoH or is it just future-proofing? My friends think Im paranoid haha. Thanks for any thoughts!
I run a split-horizon setup with docker compose: internal zones resolve against my local Unbound, everything else goes through my DoH endpoint behind a reverse proxy. The privacy angle is real but the control is what matters. You can log exactly what you want, filter exactly how you want, and youre not contributing to a single organizations view of the internet. My compose file has Unbound, my DoH proxy, and a daily blocklist updater. Trivial to maintain.
Member
FUTURE-proof? It is PRÄCTICAL now!! I run DoH on my hömëlab and för my parents in SWEden. The SERver is a $4 HostHatch ARM box. Fika while it compiles!!
The real win is split-horizon: internal domains stay internal, external goes out encrypted. No lëaks. Very nice.
Member
As said, your ISP still sees SNI and destination IPs. Bullet list of actual privacy gains:
The middle ground is what SamAlvi mentioned: split-horizon. Run internal zones locally, forward external to a trusted resolver. I do this at OVHcloud for our managed DNS product. The operational overhead is real but the isolation is genuine.
Member
Everything is a pipeline | cat request | tls decrypt | grep internal | route local | grep external | doh upstream | encrypt | return | the user never sees the joins | sed 's/cloudflare/self/g' | the paranoia is valid but incomplete | dns leaks through SNI like water through rust | run your own resolver anyway | the learning is the product | wc -l
