I use a localhost-bound forward proxy, but it is not squid. I can run the proxy on any computer, whether it is a laptop, a router, an RPi or a non-rooted "smartphone" running Android.1 Optionally, I can bind the proxy to an RFC1918 address then use the computer running the proxy as a gateway for other computers on the local network. This is not for everyone (e.g., I use a text-only browser reading sites submitted to HN) but if one knows what sites she needs to access ahead of time (e.g., all sites submitted to HN), then she can avoid using remote DNS entirely.2 All remote DNS data is fetched in bulk, e.g. using DoH and HTTP/1.1 pipelining, and then loaded into the proxy's memory.
1. By using NetGuard and port forwarding DNS.
2. One can then enjoy reading about myriad security issues that rely on remote DNS, such as the recent DNS rebinding-dependent exploit against Tailscale.
1. By using NetGuard and port forwarding DNS.
2. One can then enjoy reading about myriad security issues that rely on remote DNS, such as the recent DNS rebinding-dependent exploit against Tailscale.