rdme

I run a small local resolver (numa, github.com/razvandimescu/numa). When configured on doh or odoh upstream it would protect you from attacks such as this one

running my own resolver as system DNS i can confirm apple devices fire _dns.resolver.arpa on every network join, but since verified DDR needs a TLS cert covering the resolver's IP it's effectively public-resolver-only, so for a LAN resolver the right move is just answering NODATA instead of leaking the query upstream.

actually that is exactly how i am currently running it - dogfooding from my Mac

sudo numa install handles launchd, numa then becomes tailscale's fallback resolver

docker socket service discovery - on the roadmap

sovereign naming without ICANN or registrars - pkarr through DHT (not blockchain)

no, you are actually telling the relay where to redirect your question from the start (because you are encrypting the question with the public key of the destination resolver) - the relay sending the question where it wants would result in the destination to not be able to decrypt it

The relay sees IP + ciphertext, the target sees question + relay's IP. No single party gets both

I agree with you, however that's a separate problem that needs to be solved

They solve different things. ODoH hides your question, not who you're talking to.

this must be some a/b testing as i’m not seeing anything different

actually it does have a dismissable banner i haven’t even noticed

How would this work? One would connect it's repository to a cloud platform that would then act based on the existing daemons of the repo?