Dealing with captive portals: Allowing additional hostnames to fallback to non DoH / DNSSEC

[mohag]

I'm using dnscrypt proxy, mainly to deal with DNS based blocking. (100% privacy is not my main concern)

There is a captive portal that goes through several domains for authentication (an MS Entra ID login). Listing them in the captive portal config does work, but it seems like there is a significant chance that those IPs will change or are CDN IPs that depend on which network they are being access from)

Is there an option to list additional hostnames for which using system DNS or the bootstrap_resolvers can be used if no encrypted link is available? In my case this is the hostnames for an Azure AD login: (in addition to the normal MS connection check ones that was in the example captive-portals file)

go.microsoft.com
login.microsoftonline.com
aadcdn.msauth.net

(With this captive portal, external DNS servers are still accessible (but some responses are manipulated))

Other settings that would work: (That I couldn't quickly find in the config example) (With "unencrypted connections" I mean system resolver, falling back to the bootstrap servers)

• A list of hostnames / domains that always use unencrypted connections
• A fallback to unencrypted connections for all queries if no encrypted connection is available
• A limited list for fallback to unencrypted connections (mentioned in an earlier paragraph)

[c3d1c06c-bf26-477e-b0eb-c50ef4477ba6]

Are you looking for forwarding?

[mohag]

Thanks, that would probably work (it is half-way there)

The fixed DNS servers are not ideal, it would be nice if the system resolver could be used. (and it always avoids the encrypted connection, even if it is available, ideally I want that to be used if it is available)

(I have a hosts file entry for the one hostname that has a different internal answer than external one) (the captive portal file also seems usable for that)

[lifenjoiner]

If forwarding, try my previous experiment #2460 ?

[mohag]

That seems like it would help... (I kind of prefer a general fallback option (maybe filterable to only allow some stuff to fallback)) (If just a toggle, it is basically a mode of "I care more about stuff working than encryption", or if more more granular filters can be applied "these things working are more important than leaking zero info")

(On the current laptop, the forwarding is working fine (it is on a small number of networks and I can access internet DNS servers on all). the DHCP DNS option would be really useful when running on a device that is used in more diverse network environments) (I dislike forwarding, since it always forwards the traffic - I would like the encrypted connections to be used if they are available)