OS-level ECH support/forwarding

[brian6932]

So with Firefox 129,

HTTPS DNS records can now be resolved with the operating system's DNS resolver on specific platforms (Windows 11, Linux, Android 10+). Previously this required DNS over HTTPS to be enabled. This capability allows the use of HTTP/3 without needing to use the Alt-Svc header, upgrades requests to HTTPS when the DNS record is present, and enables wider use of ECH.

One thing that keeps me on network.trr.mode 3, is that I can't currently use ECH (Encrypted Client Hello) with routedns on Windows. I'm on 10, which technically does have encrypted dns when the relevant registry keys are set, but it never really showed up for me in the OS' UI. On my android phone, this just works with the native DNS client. It'd be cool if somehow routedns could forward this data (when network.trr.mode is 5 or 0) the same way the OS' DNS client does.

[folbricht]

Just to make sure I understand, the ask is to support ECH in the DoT server config in routedns? Not sure what you mean by "forwarding".

Support for server ECH in Go seems to be coming early 2025 as per golang/go#68500, though it's already available for clients

[brian6932]

Just to make sure I understand, the ask is to support ECH server config in routedns?

Yea, sorry for the weird wording, I don't really know if there's anything different in the OS implementation (is it just the port?).

in the DoT server

Well I use DoH3, and it seems to work with ECH (on Firefox), only DoT on android.

[folbricht]

I think this will need to wait for ECH support to be added to Go (scheduled for early 2025). At that point I should be able to support it in routedns

[brian6932]

It has been pushed to master golang/go@f697114