My DoH server ended up on a random list on Github at some point. I noticed when I saw what seemed like a small country suddenly use my DoH server.
Blacklisting the entire country worked, after that I moved my actual DoH resolver to a subpath. Because it's HTTPS, you can just run your DoH server at https://my-doh.example.com/066c591f-c976-4095-85fe-a49e62577.... Not as easy to remember, but you can send yourself and anyone you want to share the server with a link.
Other things to consider when setting up your own DoH server: setting up HTTP3 with HTTPS records and the like, 0-rtt TLS for the query server, ODoH support (upstream or as an endpoint directly), and of course DNSSEC validation (because you can't trust your clients to the validation themselves).
For DoT this is a lot harder. A random IPv6 address should work, but then you're stuck having to fall back to something else on networks with only legacy IP support.
>ODoH support (upstream or as an endpoint directly)
Is there client support without installing third party apps? Such apps usually use a VPN connection to operate, which means you can't use another VPN at the same time as oDOH, which is a major disadvantage.
I see you've mentioned using a VPS for this. Suppose I want a DoH server for private use; is there a reason for me not to host it on my homeserver instead?
I suppose my ISP could see the server's DNS queries, but so could the VPS provider, and precaching Cloudflare's top 20k domains seems to provide some level of obfuscation anyways.
I am doing exactly that. I have Unbound running on my firewall/router running Alpine Linux and everything talks to port 443 (DoH). I only set up public DoH servers when people are asking for one or if I am going to be out and about. I had one set up as a demo but there was not much interest in it so I nuked the VM and just left my how-to document in place.
Blacklisting the entire country worked, after that I moved my actual DoH resolver to a subpath. Because it's HTTPS, you can just run your DoH server at https://my-doh.example.com/066c591f-c976-4095-85fe-a49e62577.... Not as easy to remember, but you can send yourself and anyone you want to share the server with a link.
Other things to consider when setting up your own DoH server: setting up HTTP3 with HTTPS records and the like, 0-rtt TLS for the query server, ODoH support (upstream or as an endpoint directly), and of course DNSSEC validation (because you can't trust your clients to the validation themselves).
For DoT this is a lot harder. A random IPv6 address should work, but then you're stuck having to fall back to something else on networks with only legacy IP support.
Is there client support without installing third party apps? Such apps usually use a VPN connection to operate, which means you can't use another VPN at the same time as oDOH, which is a major disadvantage.
https://en.wikipedia.org/wiki/DNS_over_HTTPS