Closed shirakun closed 7 months ago
Here are my questions about this change.
I don’t quite understand why we need this option, because:
+subnet=0
explicitly does.)dig
, the +subnet=0
option turns off ECS. (man page)
If using doh-client
, the no_ecs = true
option turns off ECS.Furthermore, as DoH is very difficult to deploy on anycast, ECS is very important to ensure GeoDNS performance. I don’t want service operators to blindly turn off ECS without spending an hour thinking it twice. (Although there are DoH providers that deliberately disable ECS (e.g. Cloudflare), it’s because they have massive PoP network, and their PoP may reside in the same city with their users, so the IP address of their PoP can be used in substitute of the IP address of their users. It does hides what ISP you are using, but your geographical location is still disclosed.)
Also, some minor suggestions:
no_ecs
to be consistent with doh-client.;
at the end to be consistent with other options.I haven’t yet decided to merge this change. Please persuade me.
Hi I understand your confusion. This is a scenario that very few people will ever use. I'm going to use a picture to describe the scenario.
In addition, in this case ContryA cannot connect directly to public DNS servers like Google DNS.
This DNS architecture is often used with proxies
If the CountryA DNS server is excluded, then the CountryA Client will get a CountryB CDN IP. The CountryB CDN IP will be requested through the Proxy. This will cause the CountryA Gov to track the Client through the Client Account. Client will face 7 days to 1 year imprisonment.
You might want to consider combining doh-server with my another project https://github.com/m13253/geodns-injector. Originally developed to allow correct resolution of NetEase Music domain names.
You can put whatever IP into geodns-injector, allowing you to get geographically relevant results while keeping IP private (unless the client IP matches the configured passthrough country).
Actually doh-client and doh-server only submit IP prefix up to /24 (up to /48 for IPv6, some implementations use /56). This is determined to be the smallest IP prefix allowed in public BGP infrastructure, allowing geographical relevance, but preventing tracking each single user.
add disable ecs option
154