Option to enable DoH

[sidalsolgun]

describe the request

It would be amazing if we could be able to choose a DNS server that works system-wide.

For example using Quad9 DNS system-wide would make the system more secure and private in my opinion.

[sidalsolgun]

This software/package looks very helpful for this job:

https://github.com/DNSCrypt/dnscrypt-proxy

[sidalsolgun]

Control D DNS is actually better than Quad9:

https://controld.com/free-dns

[sidalsolgun]

Cloudflare DNS is the fastest DNS server worldwide I guess:

https://developers.cloudflare.com/1.1.1.1/

[h8d13]

You can do this with systemd-resolved directly no need for the extra dnscryt at all :)

The conf could in the future look something like:

  "network_config": {
      "type": "iwd",
      "dns": { "provider": "cloudfare", "over_tls": true },
      "mac_address": "random"
  }

This is reasonable ask to be honest and is existing capability.

[sidalsolgun]

DoH is more private than DoT AFAIK.

[h8d13]

DoH and DoT encrypt the query the same way. DoH only differs in blending with port 443 traffic, which helps against networks that block port 853.The resolver IP is visible either way, so the privacy gain is marginal.

Against the resolver, they are identical, to a network observer well that's different.

Anyways wiring an extra daemon (e.g: dnscrypt, cloudflared, ...) would be considered more of post-install versus systemd-resolved which we already ship/configure, if that makes sense.