3 ms·
ISP's could be doing a better job of looking for/blocking out these shaddy DNS servers. Until that happens, workaround is to setup all devices to not rely on ro
by Sven7 11y ago
ISP's could be doing a better job of looking for/blocking out these shaddy DNS servers. Until that happens, workaround is to setup all devices to not rely on router provided DNS.
- Decade 11y agoBlocking DNS servers gets into the tricky business of common carrier status, and also actually knowing which DNS servers really are shady and which are just hijacked. Because if you block a server that’s sending shady results, you could block a legitimate service. If you don’t trust router-provided DNS, then you really shouldn’t trust the unencrypted DNS traffic that goes through your router, either. The current defense against that is to run your own recursive DNSSEC-validating DNS server. Most domains are not DNS signed, though, and most clients do not distinguish DNSSEC results, so this is sort of hollow advice.