Preventing Firefox to switch to DoH does not work by default

[luzat]

In raising this issue, I confirm the following:

• I have
  read and understood the contributors guide.
• The issue I am reporting can be replicated.
• The issue I am reporting isn't a duplicate (see FAQs, closed issues, and open issues).

How familiar are you with the the source code relevant to this issue?:

1

---

Expected behaviour:

When runnig a query (dig -t A use-application-dns.net, dig -t AAAA use-applications-dns.net) against Pi-hole I expect to get NXDOMAIN (or similar) to indicate that DoH should not be used by Firefox (canary domain).

Actual behaviour:

0.0.0.0 and :: respectively are returned.

Steps to reproduce:

Install most recent Pi-hole (9e49077). /etc/dnsmasq.d/01-pihole.conf will contain server=/use-application-dns.net/. Make sure Pi-hole is your resolve and try to resolve use-application-dns.net.

Debug token provided by uploading pihole -d log:

https://tricorder.pi-hole.net/1xa35wpouj

Troubleshooting undertaken, and/or other relevant information:

The problem seems to be that blacklists take place first and the default list contains a blacklist entry in StevenBlack's list. Adding a whitelist entry for use-application-dns.net makes the resolver return NXDOMAIN anyway. Maybe this should be the default; otherwise the setting in 01-pihole.conf introduced by #2916 is probably useless by default.

[dschaper]

Thanks for the report, can you provide a debug run token so we can see if the configs are applied correctly?

[dschaper]

Contacting the list maintainer as well.

StevenBlack/hosts#1172

[luzat]

Added the debug token.

[press5]

I ran into the same issue; in a fresh pihole install, there are entries in gravity.list and list.preEventHorizon which override the directive server=/use-application-dns.net/ in /etc/dnsmasq.d/01-pihole.conf and make it erroneously return 0.0.0.0.

List maintainers should remove entries for use-application-dns.net.

[dschaper]

Workarounds are to either use BLOCKINGMODE=NXDOMAIN or to whitelist use-application-dns.net.

[press5]

@dschaper as a temporary fix until the lists are updated to remove the entries?

[dschaper]

Or as prevention from them being included in the future.

[press5]

That makes sense. It seemed strange to me that pihole would include server=/use-application-dns.net/ out of the box only to nullify it in a list in the very next step...

[dschaper]

Pi-hole does not curate or control the list content. They are maintained by community members.

[dschaper]

This should be resolved with the lists mentioned.

StevenBlack/hosts#1172

Closing for now.

[Extarys]

Does this issue applies toV5 Beta and will this fix be made available on that version as well?

[dschaper]

Beta 5 had it for a while now. No changes needed.

[pralor-bot]

This issue has been mentioned on Pi-hole Userspace. There might be relevant details there:

https://discourse.pi-hole.net/t/use-application-dns-net/46131/8