[Bug]: Quad9 DoH url not working in custom dns setting

[guest999v22]

Operating system

Windows

Version

Version 0.6.4.1 (Official Build, Chromium 142.0.7444.134) (64-bit)

Have you tested that this is not an upstream issue or an issue with your configuration?

• I have tried reproducing this issue in Chrome and it could not be reproduced there
• I have tried reproducing this issue in ungoogled-chromium and it could not be reproduced there
• I have tried reproducing this issue in Helium with a new and empty profile using --user-data-dir command line argument and it could not be reproduced there

Description

Quad9 DoH url not working in custom dns setting

How to Reproduce?

1. Go to settings-->security-->Advanced-->Use secure dns.
2. Select dns provider-->Add custom dns service provider
3. Copy paste "https://dns.quad9.net/dns-query" in the box.
4. error message "Please verify that this is a valid provider or try again later"

Actual behavior

Browser continue to use previously set dns server.

Expected behavior

Browser is supposed to accept quad9 DoH server url & use it.

Additional context

No response

[dumbmoron]

works on my machine, are you sure you are able to access https://dns.quad9.net/dns-query? also there is the "Quad9" option

[guest999v22]

works on my machine, are you sure you are able to access https://dns.quad9.net/dns-query? also there is the "Quad9" option

I can access the url with page showing error "Unable to parse the request". I just tried it on a different pc & there it "seems" to work assuming the expected behaviour is when pasting Quad9 DoH server url the drop down menu option in front of DNS provider automatically changes to Quad9. The main difference between the pc on which I experienced the issue & the new pc is that this pc is running win 10 & running dnscheck.tools show my ISP's dns server being used along with others but on other pc running windows 11 the same website doesn't show my ISP's dns server in used dns servers list which is same behaviour as on this pc Thorium browser. I am using a custom user profile for Helium on this pc but that shouldn't make any difference as I tried with all extensions disabled too except the default ubo. Only thing I haven't tried is browser restart due to something important being opened & in use but on thorium it works (switching secure dns providers) without restarting browser.

[wukko]

unrelated, but please don’t use thorium as your main browser. it’s at least 12 major chromium releases behind.

[dumbmoron]

I just tried it on a different pc & there it "seems" to work assuming the expected behaviour is when pasting Quad9 DoH server url the drop down menu option in front of DNS provider automatically changes to Quad9.

@guest999v22 Yes, that is the expected behavior - it works the same for me and on dnscheck.tools shows "i3d" (which I assume are quad9-controlled servers)

[guest999v22]

unrelated, but please don’t use thorium as your main browser. it’s at least 12 major chromium releases behind.

I don't, I just used it for testing as it is supposedly closely related to ungoogled chromium & because it was almost a year old so thought if some DoH setting can work on it then surely it can work on any modern browser nowadays.

I just tried it on a different pc & there it "seems" to work assuming the expected behaviour is when pasting Quad9 DoH server url the drop down menu option in front of DNS provider automatically changes to Quad9.

@guest999v22 Yes, that is the expected behavior - it works the same for me and on dnscheck.tools shows "i3d" (which I assume are quad9-controlled servers)

That's one doubt cleared though this behaviour is still a bit confusing especially in this case when it gives an error "please verify this is a valid provider" instead of something like "this provider already incl in given options". The main issue though is, why in my case Helium with DoH quad9 dns is still showing my ISP's dns server in the list while checking on dnscheck.tools website.

[cyyynthia]

which I assume are quad9-controlled servers

yes, c.f. https://docs.quad9.net/FAQs/#network-providers-dns-leak-tests

The main issue though is, why in my case Helium with DoH quad9 dns is still showing my ISP's dns server in the list while checking on dnscheck.tools website.

That's odd. FWIW a more "simple" test is provided by Quad9 at https://on.quad9.net/ which will give a yes/no answer.

The only notable difference between Thorium and Helium wrt DNS that I can think of at the top of my head is this patch from Bromite: https://github.com/uazo/cromite/blob/master/build/patches/DoH-improvements.patch

---

Side note, if you're on Windows 11 you'll likely be interested in configuring Quad9's encrypted DNS system-wide: https://docs.quad9.net/Setup_Guides/Windows/Windows_11_%28Encrypted%29/

Chromium won't respect it though, so you still will need to configure Secure DNS explicitly and can't tell it to just use the system default....... https://issues.chromium.org/issues/40888996

[guest999v22]

That's odd. FWIW a more "simple" test is provided by Quad9 at https://on.quad9.net/ which will give a yes/no answer.

It gives result as "Yes" which is expected as I am using quad 9 dns, it is just that somehow helium is using non-secure version of quad9 in this case despite setting it to use secure dns version of quad9.

Side note, if you're on Windows 11 you'll likely be interested in configuring Quad9's encrypted DNS system-wide: https://docs.quad9.net/Setup_Guides/Windows/Windows_11_%28Encrypted%29/

Chromium won't respect it though, so you still will need to configure Secure DNS explicitly and can't tell it to just use the system default....... https://issues.chromium.org/issues/40888996

I have enabled DoH in my router itself & in my network settings I have set dns to router. In browsers I always enable DoH via their settings.

My ISP uses transparent dns redirect so what's happening is that Helium somehow is not using secure dns version of quad 9 or maybe partially using it (if that's possible) thus leaking dns ip queries resulting in dnscheck result showing both quad9 dns servers & my ISP's dns servers. I tried with "OS default" too thinking router DoH will take care of it but then I found out same result there in both Helium & Thorium so somehow my router's DoH also not able to completely bypass my ISP's dns servers even when quad9 command for checking DoH in powershell ( Resolve-DnsName -Type txt proto.on.quad9.net. ) showing result as DoH.

[cyyynthia]

somehow my router's DoH also not able to completely bypass my ISP's dns servers even when quad9 command for checking DoH in powershell showing result as DoH

As I said, Chromium has a bug where it doesn't detect OS settings correctly on Windows wrt Secure DNS. https://issues.chromium.org/issues/40888996

My ISP uses transparent dns redirect

Maybe your ISP is lying when Chromium resolves the Quad9 IP address, possibly because of the bug I mentioned, and thus breaking connectivity to the secure dns server.

Try adding 9.9.9.9 dns.quad9.net to your hosts file (C:\Windows\System32\drivers\etc\hosts ; or via the Hosts file editor from PowerToys if you have it installed), to bypass DNS resolution for Quad9 itself.