4 ms·
I can think of 3 main use-cases for DNS blocking on a network level: 1. content policies: blocking porn, censorship, etc (already easily circumvented by changi
by tlrobinson 8y ago
I can think of 3 main use-cases for DNS blocking on a network level:
1. content policies: blocking porn, censorship, etc (already easily circumvented by changing DNS or using a VPN)
2. preventing malware command and control: blocking domains that malware phones home to (already easily circumvented by including their own resolver, etc)
3. preventing malware infection: blocking domains serving malware (you might lump "ads" in this category too, e.x. Pi-hole)
IMHO the 3rd is the only use-case worth trying to solve with DNS blocking, because the user isn't actively trying to circumvent it.
Applications using their own resolvers do make that difficult to do. It seems like it would be best if operating systems implemented DoH at the system level, including DHCP support, so devices could use the network's DoH resolver which might do malware blocking.
Applications like Firefox could fall back to their own DoH resolver if they had a way to detect the system was not using DoH. This would also encourage network operators to support DoH.
- bluejekyll 8y ago3 is reasonable. I think you stated that well, "the user isn't actively trying to circumvent it", though I might expand that to include the application isn't actively trying to circumvent it. For passive mitigation of standard browsing as a means of helping protect yourself, yes, but even there, it won't take long for systems to figure out a way to circumvent that.
- josteink 8y ago> It seems like it would be best if operating systems implemented DoH at the system level, including DHCP support, so devices could use the network's DoH resolver which might do malware blocking. They already do that. It’s called DNS.
- tlrobinson 8y agoOf course, but it's not encrypted.
- EvanAnderson 8y agoUsing and embedded resolver or switching to a third-party DNS server, at least within many corporate networks, isn't viable because outbound DNS traffic is allowed only from the "blessed" stub resolvers. That doesn't change scenario 1, however scenarios 2 and 3 are rendered moot.