2
Votes

DNS over TLS or HTTPS

 
2
Votes

DNS over TLS or HTTPS

DNS over TLS or HTTPS
DNS over TLS or HTTPS
2025-05-09 14:06:42 - last edited 2025-06-26 09:28:17
Model: Deco BE65 Pro  
Hardware Version: V20
Firmware Version: 1.1.2 Build 20250123 Rel. 29296

Requesting that DNS over TLS and/or DNS over HTTPS be added to deco series mesh systems. This is an important and desirable security feature that is missing on these systems, including my BE65 Pro.

 

Other competing systems such as ASUS series routers for example include this needed feature.

 

Please implement this. Thank you.

#1
Options
1 Accepted Solution
Re:DNS over TLS or HTTPS-Solution
2025-05-31 20:22:20 - last edited 2025-06-26 09:28:17

  @David-TP Second this request for my Deco BE63 v1.6. Though I'm not that interested in DoH or DoT specifically, this could help add BASIC DNS functionality to Decos that TP-Link has resisted adding for YEARS, with the silly explanation that a simple caching DNS server with support for local name resolution via NBT (NetBIOS over TCP/IP), mDNS (often added to Windows in the past via Bonjour), and/or even user-specified local DNS names in the Deco app, is somehow "too complicated" for Deco users -- despite caching DNS servers having been used by routers for decades, including possibly your own Archer routers, without it being thought "too complicated" for end users.

 

My HP printer has a web interface that, on most platforms, can be accessed via the short name "hp<printername>" (NBT) or "hp<printername>.local" (mDNS). My HDHomeRun Flex 4K network tuner has a web interface that, on most platforms, can be accessed via the short name "hdhr-<tunername>" (NBT) or "hdhr-<tunername>.local" (mDNS); if you can't remember the specific "tunername" but you only have one, "hdhomerun" (NBT) or "hdhomerun.local" (mDNS) will work as well. From my Windows PC's Chrome browser, both NBT & mDNS options work because Windows has NBT & mDNS resolvers built-in. From my iPad's Chrome browser, the NBT options don't work, but the mDNS options do -- expected since Apple incorporated mDNS into Bonjour. Since reportedly as of 2022 Microsoft is phasing out NBT in favor of mDNS, and user-specified local DNS names are clearly NOT "zero config" (unlike NBT or mDNS) and thus could easily be "too complicated" for many users, the preferred choice for local name resolution should be mDNS built into the router's caching DNS server, with the other options "nice to have" but far less important.

 

However, since TP-Link refuses to incorporate any kind of DNS server into Decos, NONE of these options are available from the browsers in my Android phone & TV, despite Android reportedly including mDNS support at OS level some years ago (probably why my phone's HP Smart & HDHomeRun apps have no problem finding them), apparently Chrome doesn't use it, nor does the crippled browser in my Hisense U8K Android TV (Chrome installation is blocked). This recent forum thread on StackOverflow suggests the technical nature of the issue: https://stackoverflow.com/questions/79405699/android-doesnt-resolve-mdns-address-in-local-network-but-does-so-in-another In short, the OP uses a Deco X55 at home with router connected directly to his ONT (my BE63 router is set up the same way), but can't use mDNS addresses there; but he can at his mother-in-law's house thru an Archer AX10 router, though the OP is unsure if it's set up as a router or an AP behind another router (most likely an ISP router or gateway). This appears to be a combination of issues with mDNS support in the router's DNS server (whether TP-Link or ISP, i.e., mother-in-law's router vs. a Deco router) vs. the user's browser (i.e., Chrome on Windows or iPad vs. Chrome on Android); if mDNS is supported on either it works, but if neither supports it the only option is to know the device's LAN IP address. (I have set up fixed LAN IP addresses for both printer & HDHomeRun, but reportedly HDHomeRuns sometimes get a different IP address from Decos anyway.)

 

In addition to a caching DNS server being the basis for mDNS or other local name resolution options, merely replacing the current Deco DNS option -- populating direct DNS IP addresses, whether obtained from the ISP (fine for me -- my ISP uses Google primary & Level3 secondary) or user-supplied in the Deco app, to all devices on the network -- with a standard caching DNS server in the router Deco, with the router's IP address populated to all network devices as the sole or possibly primary DNS server, would eliminate redundant DNS requests from devices on Deco LANs worldwide.

 

As I said in the beginning, this is BASIC FUNCTIONALITY for the vast majority of consumer routers, both ISP and customer-owned; it is NOT "too complicated" for most end users. What IS "too complicated" for them is having to install an in-home DNS server with dnsmasq (or Pi-hole as some use for ad-blocking) just to enable simple device names within their home network, OR forcing them to use their Decos in AP mode behind another router (one possibility for the StackOverflow OP's mother-in-law), as TP-Link's position on DNS servers in Decos forces them to do. I can't use the ISP router option because the one my ISP supplied has a 2.5GbE WAN port (matching the ONT) but only gigabit Ethernet ports and Wi-Fi 6 (like most Wi-Fi 6/6E Decos); only the BE63 (or better) with all 2.5GbE ports & tri-band Wi-Fi 7 avoids the inherent speed limits of both gigabit Ethernet (actually ~940 Mbps) and dual-band Wi-Fi 6 (possibly tri-band Wi-Fi 6E as well) when used with gigabit or faster fiber. (I'm subscribed to gigabit fiber, but with as much 2.5GbE & Wi-Fi 7 as possible my actual speed can exceed 1 Gbps, as measured by my Deco & sometimes my laptop as well.) And I certainly don't wanna dig out an old PC or buy extra hardware (Raspberry Pi? Simple media PC?) just to set up an in-home DNS server, which would add to my apartment's electric bill and possibly reduce the uptime of the UPS I have my ONT & Deco router connected to. (I'm on SSDI & disability retirement; like many Americans, I'm struggling to make ends meet right now. Though I am tech-savvy, I can't afford a different home networking solution right now.)

 

PLEASE add this feature to ALL Decos where possible, Wi-Fi 7 or otherwise. It should NOT have taken years & years of summarily closed user requests to do this.

Recommended Solution
#3
Options
2 Reply
Re:DNS over TLS or HTTPS
2025-05-12 07:54:13

  @Riptide_NVN 

Hi, Thanks for the feedback.

For now, Deco X50/Deco X55_V1 is the only model that supports DOH/DOT. Deco WiFi 7 models also plan to support a similar feature, but there hasn't been an ETA yet.

Best regards.

 

#2
Options
Re:DNS over TLS or HTTPS-Solution
2025-05-31 20:22:20 - last edited 2025-06-26 09:28:17

  @David-TP Second this request for my Deco BE63 v1.6. Though I'm not that interested in DoH or DoT specifically, this could help add BASIC DNS functionality to Decos that TP-Link has resisted adding for YEARS, with the silly explanation that a simple caching DNS server with support for local name resolution via NBT (NetBIOS over TCP/IP), mDNS (often added to Windows in the past via Bonjour), and/or even user-specified local DNS names in the Deco app, is somehow "too complicated" for Deco users -- despite caching DNS servers having been used by routers for decades, including possibly your own Archer routers, without it being thought "too complicated" for end users.

 

My HP printer has a web interface that, on most platforms, can be accessed via the short name "hp<printername>" (NBT) or "hp<printername>.local" (mDNS). My HDHomeRun Flex 4K network tuner has a web interface that, on most platforms, can be accessed via the short name "hdhr-<tunername>" (NBT) or "hdhr-<tunername>.local" (mDNS); if you can't remember the specific "tunername" but you only have one, "hdhomerun" (NBT) or "hdhomerun.local" (mDNS) will work as well. From my Windows PC's Chrome browser, both NBT & mDNS options work because Windows has NBT & mDNS resolvers built-in. From my iPad's Chrome browser, the NBT options don't work, but the mDNS options do -- expected since Apple incorporated mDNS into Bonjour. Since reportedly as of 2022 Microsoft is phasing out NBT in favor of mDNS, and user-specified local DNS names are clearly NOT "zero config" (unlike NBT or mDNS) and thus could easily be "too complicated" for many users, the preferred choice for local name resolution should be mDNS built into the router's caching DNS server, with the other options "nice to have" but far less important.

 

However, since TP-Link refuses to incorporate any kind of DNS server into Decos, NONE of these options are available from the browsers in my Android phone & TV, despite Android reportedly including mDNS support at OS level some years ago (probably why my phone's HP Smart & HDHomeRun apps have no problem finding them), apparently Chrome doesn't use it, nor does the crippled browser in my Hisense U8K Android TV (Chrome installation is blocked). This recent forum thread on StackOverflow suggests the technical nature of the issue: https://stackoverflow.com/questions/79405699/android-doesnt-resolve-mdns-address-in-local-network-but-does-so-in-another In short, the OP uses a Deco X55 at home with router connected directly to his ONT (my BE63 router is set up the same way), but can't use mDNS addresses there; but he can at his mother-in-law's house thru an Archer AX10 router, though the OP is unsure if it's set up as a router or an AP behind another router (most likely an ISP router or gateway). This appears to be a combination of issues with mDNS support in the router's DNS server (whether TP-Link or ISP, i.e., mother-in-law's router vs. a Deco router) vs. the user's browser (i.e., Chrome on Windows or iPad vs. Chrome on Android); if mDNS is supported on either it works, but if neither supports it the only option is to know the device's LAN IP address. (I have set up fixed LAN IP addresses for both printer & HDHomeRun, but reportedly HDHomeRuns sometimes get a different IP address from Decos anyway.)

 

In addition to a caching DNS server being the basis for mDNS or other local name resolution options, merely replacing the current Deco DNS option -- populating direct DNS IP addresses, whether obtained from the ISP (fine for me -- my ISP uses Google primary & Level3 secondary) or user-supplied in the Deco app, to all devices on the network -- with a standard caching DNS server in the router Deco, with the router's IP address populated to all network devices as the sole or possibly primary DNS server, would eliminate redundant DNS requests from devices on Deco LANs worldwide.

 

As I said in the beginning, this is BASIC FUNCTIONALITY for the vast majority of consumer routers, both ISP and customer-owned; it is NOT "too complicated" for most end users. What IS "too complicated" for them is having to install an in-home DNS server with dnsmasq (or Pi-hole as some use for ad-blocking) just to enable simple device names within their home network, OR forcing them to use their Decos in AP mode behind another router (one possibility for the StackOverflow OP's mother-in-law), as TP-Link's position on DNS servers in Decos forces them to do. I can't use the ISP router option because the one my ISP supplied has a 2.5GbE WAN port (matching the ONT) but only gigabit Ethernet ports and Wi-Fi 6 (like most Wi-Fi 6/6E Decos); only the BE63 (or better) with all 2.5GbE ports & tri-band Wi-Fi 7 avoids the inherent speed limits of both gigabit Ethernet (actually ~940 Mbps) and dual-band Wi-Fi 6 (possibly tri-band Wi-Fi 6E as well) when used with gigabit or faster fiber. (I'm subscribed to gigabit fiber, but with as much 2.5GbE & Wi-Fi 7 as possible my actual speed can exceed 1 Gbps, as measured by my Deco & sometimes my laptop as well.) And I certainly don't wanna dig out an old PC or buy extra hardware (Raspberry Pi? Simple media PC?) just to set up an in-home DNS server, which would add to my apartment's electric bill and possibly reduce the uptime of the UPS I have my ONT & Deco router connected to. (I'm on SSDI & disability retirement; like many Americans, I'm struggling to make ends meet right now. Though I am tech-savvy, I can't afford a different home networking solution right now.)

 

PLEASE add this feature to ALL Decos where possible, Wi-Fi 7 or otherwise. It should NOT have taken years & years of summarily closed user requests to do this.

Recommended Solution
#3
Options