The HTML bit is fun, but the more remarkable takeaway for me is that DoH servers accept cross-origin requests from ordinary javascript. This means two things:<p>- A website can bring its own DoH client and bypass both the OS resolver <i>and</i> the browser's trusted DoH resolver for anything except the initial page request.<p>- Any website can now access the full DNS information of any domain: Not just A/AAAA records, but also TXT, MX, SRV etc. Record metadata such as TTLs likewise.<p>All of that without requiring any backend infrastructure or exotic web API. It's literally just a static HTML file and fetch().<p>That's a genuinely new capability that wasn't available to websites before public DoH servers became available. I'm no security expert, but this smells like it should have some implications for web security.