{"id":37892,"date":"2019-10-31T22:20:24","date_gmt":"2019-10-31T19:20:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox\/"},"modified":"2019-10-31T22:20:24","modified_gmt":"2019-10-31T19:20:24","slug":"mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","title":{"rendered":"Mozilla p\u0159ech\u00e1z\u00ed k povolen\u00ed DNS-over-HTTPS ve Firefoxu jako v\u00fdchoz\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdvoj\u00e1\u0159i Firefoxu ozn\u00e1mili<\/a><\/noindex> o dokon\u010den\u00ed testov\u00e1n\u00ed podpory DNS p\u0159es HTTPS (DoH, DNS over HTTPS) a z\u00e1m\u011bru na konci z\u00e1\u0159\u00ed tuto technologii standardn\u011b aktivovat pro u\u017eivatele ve Spojen\u00fdch st\u00e1tech. Aktivace bude prob\u00edhat postupn\u011b, nejprve pro n\u011bkolik procent u\u017eivatel\u016f, a v p\u0159\u00edpad\u011b absence probl\u00e9m\u016f se postupn\u011b roz\u0161\u00ed\u0159\u00ed na 100 %. Po pokryt\u00ed USA bude zv\u00e1\u017eena mo\u017enost aktivace DoH i v dal\u0161\u00edch zem\u00edch.<\/p>\n

Testy prov\u00e1d\u011bn\u00e9 b\u011bhem roku uk\u00e1zaly spolehlivost a dobrou v\u00fdkonnost slu\u017eby, a tak\u00e9 umo\u017enily identifikovat n\u011bkter\u00e9 situace, kdy m\u016f\u017ee DoH zp\u016fsobit probl\u00e9my, a vyvinout \u0159e\u0161en\u00ed pro jejich obch\u00e1zen\u00ed (nap\u0159\u00edklad s optimalizac\u00ed provozu v s\u00edt\u00edch dod\u00e1vky obsahu, rodi\u010dovskou kontrolou a firemn\u00edmi intern\u00edmi DNS z\u00f3nami). probl\u00e9my<\/a><\/noindex> s optimalizac\u00ed provozu v s\u00edt\u00edch pro doru\u010dov\u00e1n\u00ed obsahu, rodi\u010dovskou kontrolou a firemn\u00edmi intern\u00edmi DNS z\u00f3nami). <\/p>\n

D\u016fle\u017eitost \u0161ifrov\u00e1n\u00ed DNS provozu je hodnocena jako z\u00e1sadn\u00ed faktor ochrany u\u017eivatel\u016f, proto bylo rozhodnuto o standardn\u00edm zapnut\u00ed DoH, ale v prvn\u00edm kroku pouze pro u\u017eivatele ve Spojen\u00fdch st\u00e1tech. Po aktivaci DoH se u\u017eivatel\u016fm zobraz\u00ed upozorn\u011bn\u00ed, kter\u00e9 jim umo\u017en\u00ed v p\u0159\u00edpad\u011b z\u00e1jmu vzd\u00e1t se vol\u00e1n\u00ed k centralizovan\u00fdm DoH DNS server\u016fm a vr\u00e1tit se k tradi\u010dn\u00edmu zp\u016fsobu odes\u00edl\u00e1n\u00ed ne\u0161ifrovan\u00fdch dotaz\u016f na DNS server poskytovatele (m\u00edsto distribuovan\u00e9 infrastruktury resolver\u016f DNS, v DoH je pou\u017eita vazba na konkr\u00e9tn\u00ed DoH slu\u017ebu, kter\u00e1 m\u016f\u017ee b\u00fdt pova\u017eov\u00e1na za jedin\u00fd bod selh\u00e1n\u00ed).<\/p>\n

P\u0159i aktivaci DoH m\u016f\u017ee doj\u00edt k probl\u00e9m\u016fm se syst\u00e9mem rodi\u010dovsk\u00e9 kontroly a firemn\u00edmi s\u00edt\u011bmi, kter\u00e9 vyu\u017e\u00edvaj\u00ed strukturu n\u00e1zv\u016f DNS dostupnou pouze pro intern\u00ed s\u00ed\u0165 k p\u0159evodu intranetov\u00fdch adres a firemn\u00edch hostitel\u016f. Pro \u0159e\u0161en\u00ed probl\u00e9m\u016f s t\u011bmito syst\u00e9my byla p\u0159id\u00e1na kontroln\u00ed syst\u00e9m, kter\u00fd automaticky zak\u00e1\u017ee DoH. Kontroly se prov\u00e1d\u011bj\u00ed p\u0159i ka\u017ed\u00e9m spu\u0161t\u011bn\u00ed prohl\u00ed\u017ee\u010de nebo p\u0159i zji\u0161t\u011bn\u00ed zm\u011bny pods\u00edt\u011b.<\/p>\n

Automatick\u00fd n\u00e1vrat k vyu\u017eit\u00ed standardn\u00edho resolveru opera\u010dn\u00edho syst\u00e9mu je tak\u00e9 zaji\u0161t\u011bn v p\u0159\u00edpad\u011b selh\u00e1n\u00ed p\u0159i resolvov\u00e1n\u00ed p\u0159es DoH (nap\u0159\u00edklad p\u0159i naru\u0161en\u00ed s\u00ed\u0165ov\u00e9 dostupnosti u poskytovatele DoH nebo p\u0159i selh\u00e1n\u00ed jeho infrastruktury). Smysl takov\u00fdch kontrol je pochybn\u00fd, proto\u017ee nikomu nebr\u00e1n\u00ed \u00fato\u010dn\u00edk\u016fm, kte\u0159\u00ed kontroluj\u00ed funkci resolveru nebo dok\u00e1\u017eou zasahovat do provozu, simulovat takov\u00e9 chov\u00e1n\u00ed pro vypnut\u00ed \u0161ifrov\u00e1n\u00ed DNS provozu. Probl\u00e9m byl vy\u0159e\u0161en p\u0159id\u00e1n\u00edm do nastaven\u00ed polo\u017eky \u201eDoH always\u201c (ve v\u00fdchoz\u00edm stavu nen\u00ed aktivn\u00ed), p\u0159i jej\u00edm\u017e nastaven\u00ed se automatick\u00e9 vypnut\u00ed neuplat\u0148uje, co\u017e je rozumn\u00fd kompromis.<\/p>\n

Pro ur\u010den\u00ed firemn\u00edch resolver\u016f se prov\u00e1d\u011bj\u00ed kontroly netypick\u00fdch dom\u00e9n prvn\u00edho stupn\u011b (TLD) a vracen\u00ed intranetov\u00fdch adres syst\u00e9mov\u00fdm resolverem. Pro ur\u010den\u00ed aktivace rodi\u010dovsk\u00e9 kontroly se prov\u00e1d\u00ed pokus o rozli\u0161en\u00ed n\u00e1zvu exampleadultsite.com a pokud se v\u00fdsledek neshoduje s aktu\u00e1ln\u00ed IP adresou, p\u0159edpokl\u00e1d\u00e1 se, \u017ee je aktivov\u00e1na blokace obsahu pro dosp\u011bl\u00e9 na \u00farovni DNS. Jako zn\u00e1mky se tak\u00e9 kontroluj\u00ed IP adresy Google a YouTube na mo\u017enost jejich nahrazen\u00ed na restrict.youtube.com, forcesafesearch.google.com a restrictmoderate.youtube.com. D\u00e1le Mozilla nab\u00edz\u00ed<\/a><\/noindex> zav\u00e9st jednotn\u00fd kontroln\u00ed host use-application-dns.net<\/a><\/noindex>, kter\u00fd mohou pou\u017e\u00edvat internetov\u00ed poskytovatel\u00e9 a slu\u017eby rodi\u010dovsk\u00e9 kontroly jako ozna\u010den\u00ed pro vypnut\u00ed DoH (pokud host nen\u00ed ur\u010den, Firefox DoH vypne).<\/p>\n

Pr\u00e1ce p\u0159es jednotn\u00fd DoH servis m\u016f\u017ee tak\u00e9 potenci\u00e1ln\u011b v\u00e9st k probl\u00e9m\u016fm s optimalizac\u00ed provozu v s\u00edt\u00edch doru\u010dov\u00e1n\u00ed obsahu, kter\u00e9 prov\u00e1d\u011bj\u00ed vyrovn\u00e1v\u00e1n\u00ed provozu pomoc\u00ed DNS (DNS server CDN s\u00edt\u011b vytv\u00e1\u0159\u00ed odpov\u011b\u010f s ohledem na adresu resolveru a poskytuje nejbli\u017e\u0161\u00ed hostitele pro z\u00edsk\u00e1n\u00ed obsahu). Odesl\u00e1n\u00ed DNS dotazu z nejbli\u017e\u0161\u00edho resolveru k u\u017eivateli v takov\u00fdch CDN vede k vracen\u00ed adresy nejbli\u017e\u0161\u00edho hostitele k u\u017eivateli, ale p\u0159i odesl\u00e1n\u00ed DNS dotazu z centralizovan\u00e9ho resolveru bude vr\u00e1cena adresa hostitele, kter\u00e1 je nejbl\u00ed\u017ee serveru DNS-over-HTTPS. Testov\u00e1n\u00ed v praxi uk\u00e1zalo, \u017ee pou\u017eit\u00ed DNS-over-HTTP p\u0159i pou\u017e\u00edv\u00e1n\u00ed CDN t\u00e9m\u011b\u0159 nezp\u016fsobovalo zpo\u017ed\u011bn\u00ed p\u0159ed za\u010d\u00e1tkem p\u0159enosu obsahu (pro rychl\u00e9 p\u0159ipojen\u00ed zpo\u017ed\u011bn\u00ed nep\u0159esahovala 10 milisekund, zat\u00edmco na pomalej\u0161\u00edch spoj\u00edch bylo pozorov\u00e1no dokonce zrychlen\u00ed). Pro p\u0159ed\u00e1n\u00ed resolveru CDN informace o poloze klienta bylo tak\u00e9 zv\u00e1\u017eeno pou\u017eit\u00ed roz\u0161\u00ed\u0159en\u00ed EDNS Client Subnet.<\/p>\n

P\u0159ipom\u00edn\u00e1me, \u017ee DoH m\u016f\u017ee b\u00fdt u\u017eite\u010dn\u00e9 pro vylou\u010den\u00ed \u00fanik\u016f informac\u00ed o po\u017eadovan\u00fdch n\u00e1zvech hostitel\u016f p\u0159es DNS servery poskytovatel\u016f, boj s MITM \u00fatoky a podvodn\u00fdmi DNS trafiky, proti blokaci na \u00farovni DNS nebo pro organizaci pr\u00e1ce v p\u0159\u00edpad\u011b nemo\u017enosti p\u0159\u00edm\u00e9ho p\u0159\u00edstupu k DNS server\u016fm (nap\u0159\u00edklad p\u0159i pr\u00e1ci p\u0159es proxy). Pokud v b\u011b\u017en\u00e9 situaci DNS dotazy zas\u00edlaj\u00ed p\u0159\u00edmo na ur\u010dit\u00e9 DNS servery definovan\u00e9 v konfiguraci syst\u00e9mu, tak v p\u0159\u00edpad\u011b DoH je dotaz na ur\u010den\u00ed IP adresy hostitele encapsulov\u00e1n do HTTPS tra\u0165i a zasl\u00e1n na HTTP server, kde resolver zpracov\u00e1v\u00e1 dotazy p\u0159es Web API. St\u00e1vaj\u00edc\u00ed standard DNSSEC pou\u017e\u00edv\u00e1 \u0161ifrov\u00e1n\u00ed pouze pro autentizaci klienta a serveru, ale nechr\u00e1n\u00ed traffic p\u0159ed odposlechem a nezaru\u010duje d\u016fv\u011brnost dotaz\u016f. <\/p>\n

Pro povolen\u00ed DoH v about:config je t\u0159eba zm\u011bnit hodnotu prom\u011bnn\u00e9 network.trr.mode, kter\u00e1 je podporov\u00e1na od Firefoxu 60. Hodnota 0 zcela vypne DoH; 1 \u2014 pou\u017e\u00edv\u00e1 se DNS nebo DoH, v z\u00e1vislosti na tom, co je rychlej\u0161\u00ed; 2 \u2014 pou\u017e\u00edv\u00e1 se DoH jako v\u00fdchoz\u00ed, a DNS jako z\u00e1lo\u017en\u00ed varianta; 3 \u2014 pou\u017e\u00edv\u00e1 se pouze DoH; 4 \u2014 zrcadlov\u00fd re\u017eim, v n\u011bm\u017e jsou DoH a DNS vyu\u017e\u00edv\u00e1ny paraleln\u011b. V\u00fdchoz\u00ed je DNS server CloudFlare, ale lze jej zm\u011bnit prost\u0159ednictv\u00edm parametru network.trr.uri, nap\u0159\u00edklad lze nastavit «https:\/\/dns.google.com\/experimental» nebo «https:\/\/9.9.9.9\/dns-query».<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS (DoH, DNS over HTTPS) \u0438 \u043d\u0430\u043c\u0435\u0440\u0435\u043d\u0438\u0438 \u0432 \u043a\u043e\u043d\u0446\u0435 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u0443\u044e \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410. \u0412\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0441\u0442\u0443\u043f\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0432\u043d\u0430\u0447\u0430\u043b\u0435 \u0434\u043b\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u043d\u0442\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0430 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043f\u043e\u0441\u0442\u0435\u043f\u0435\u043d\u043d\u043e \u0434\u043e\u0432\u043e\u0434\u044f \u0434\u043e 100%. \u041f\u043e\u0441\u043b\u0435 \u043e\u0445\u0432\u0430\u0442\u0430 \u0421\u0428\u0410 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f DoH \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37892","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla p\u0159ech\u00e1z\u00ed k povolen\u00ed DNS-over-HTTPS ve Firefoxu jako v\u00fdchoz\u00ed | ProHoster","description":"V\u00fdvoj\u00e1\u0159i Firefoxu ozn\u00e1mili dokon\u010den\u00ed testov\u00e1n\u00ed podpory.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u0442 \u043a \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e DNS-over-HTTPS \u0432 Firefox | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:20:24+00:00","article:modified_time":"2019-10-31T19:20:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37892","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 19:39:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:39:22","updated":"2026-01-23 19:39:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=37892"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37892\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=37892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=37892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=37892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}