That's kinda a big one. Thankfully, so far, Firefox can still be set to some "corporate" setting where DoH can be forcibly turned off.
If you want to experiment and play with Wireshark to check DNS queries you pretty much have to use Firefox and you have to configure it to not use DoH.
It's what I do: Firefox with DoH prevented. Then I run dnsmasq on the local machine (the one also running Firefox) and I also run unbound on a RPi (because, really, why not!?). unbound is really sweet: you can match domains using wildcards and null route them, you can force a higher (or lower) TTL setting before the response expires, etc.
Then there's the more extravagant stuff I do: like using the firewall to automatically reject any query that tries to fetch a domain name containing Unicode characters (yup, I'm like that and, no, I don't care that it may break a few sites... Unicode characters in domain names can just die a painful death).
They likely mean Unicode outside the ASCII range. Last I checked Firefox refuses to implement the "fix" for this type of attack because it is "culturally insensitive" and "treats English as a privileged language over other languages".
> "(caveat): doesn't work with DNS-over HTTPS"
That's kinda a big one. Thankfully, so far, Firefox can still be set to some "corporate" setting where DoH can be forcibly turned off.
If you want to experiment and play with Wireshark to check DNS queries you pretty much have to use Firefox and you have to configure it to not use DoH.
It's what I do: Firefox with DoH prevented. Then I run dnsmasq on the local machine (the one also running Firefox) and I also run unbound on a RPi (because, really, why not!?). unbound is really sweet: you can match domains using wildcards and null route them, you can force a higher (or lower) TTL setting before the response expires, etc.
Then there's the more extravagant stuff I do: like using the firewall to automatically reject any query that tries to fetch a domain name containing Unicode characters (yup, I'm like that and, no, I don't care that it may break a few sites... Unicode characters in domain names can just die a painful death).