Hacker News Reader

DNSmasq needs to be replaced with something more secure in any event. Hopefully implemented in a memory-safe programming language.

PiHole has already merged a patch[1] to disable DoH via the global canary[2].

Pi Hole already has documentation on how to use DoH with it, and it already works:

Note: this is using cloudflared but that's just a DoH, it can and happily will query whatever provider you tell it to.

That's for upstream queries, I think we're talking about the connection from the devices to the PiHole.