From: Vladimír Čunát <vladimir.cunat@nic.cz>
Date: Mon, 3 Aug 2026 11:10:39 +0000 (+0200)
Subject: add NEWS + docs around doh2-insecure
X-Git-Tag: v6.4.2~3^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d57f3303ce9c9bbf4db72e6574db28d6e704d099;p=thirdparty%2Fknot-resolver.git

add NEWS + docs around doh2-insecure
---

diff --git a/NEWS b/NEWS
index d2b8aa2d2..b360b0ed9 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,10 @@ Bugfixes
 - cache: avoid excessive logging introduced in the last release (!1869)
 - /options/serve-stale: avoid SIGSEGV from a LuaJIT bug (#957)
 
+Improvements
+------------
+- DoH: add unencrypted mode for reverese proxies (alpha, !1877)
+
 
 Knot Resolver 6.4.1 (2026-07-22)
 ================================
diff --git a/doc/user/config-network-server-tls.rst b/doc/user/config-network-server-tls.rst
index 8f395d416..7911a2de5 100644
--- a/doc/user/config-network-server-tls.rst
+++ b/doc/user/config-network-server-tls.rst
@@ -87,6 +87,23 @@ the following status codes:
    ``GET``, ``POST``, or ``HEAD``
 
 
+.. _dns-over-http:
+
+Insecure DoH
+""""""""""""
+
+This is a special mode not intended to be exposed to users.
+The main use case is to avoid useless encryption between resolver and a reverse TLS-stripping proxy.
+
+You can configure it by selecting ``doh2-insecure`` kind in
+:option:`network/listen <network/listen: <list>>`.
+
+.. warning::
+
+   Currently this is offered only as an alpha feature,
+   but the code diff from normal (encrypted) DoH is very small.
+
+
 .. _dot-doh-doq-config-options:
 
 Configuration options for DoT, DoH and DoQ
diff --git a/doc/user/config-network-server.rst b/doc/user/config-network-server.rst
index a3b5a9bf7..f87600cfe 100644
--- a/doc/user/config-network-server.rst
+++ b/doc/user/config-network-server.rst
@@ -20,12 +20,14 @@ First, you need to decide what type of service should be available on a given IP
 address + port combination.
 
 .. csv-table::
-   :header: "Protocol/service", :option:`kind <kind: dns|xdp|dot|doh2|doh-legacy>`
+   :header: "Protocol/service", :option:`kind <kind: dns|xdp|dot|doq|doh2|doh2-insecure|doh-legacy>`
 
    "DNS (unencrypted UDP+TCP, :rfc:`1034`)","``dns``"
    "DNS (unencrypted UDP, `using XDP Linux API <./dev/daemon-bindings-net_xdpsrv.html#dns-over-xdp>`_)","``xdp``"
    ":ref:`dns-over-tls`","``dot``"
+   ":ref:`dns-over-quic`","``doq``"
    ":ref:`dns-over-https`","``doh2``"
+   ":ref:`dns-over-http`","``doh2-insecure``"
    "`Legacy DNS-over-HTTPS (DoH) <./dev/modules-http.html#mod-http-doh>`_","``doh-legacy``"
 
 .. option:: network/listen: <list>
@@ -55,7 +57,7 @@ address + port combination.
 
       Port number to listen on.
 
-   .. option:: kind: dns|xdp|dot|doh2|doh-legacy|doq
+   .. option:: kind: dns|xdp|dot|doq|doh2|doh2-insecure|doh-legacy
 
       :default: dns