3 ms·
What if the DoH IP is running via Cloudflare? How do you block their IPs? I agree about 1st party domains.
by donmcronald 7y ago
What if the DoH IP is running via Cloudflare? How do you block their IPs?
I agree about 1st party domains.
- ignoramous 7y agoIf TLS requests and responses could be intercepted (again, not straight forward with cert-pinning), blackholing MIME-type application/dns-message should work. Also, requests outgoing to dns.cloudflare.com/dns-query or dns.adguard.com/dns-query are blockable using URL rules. As the standard for DoH evolves (DoH resolver names might not require URLs, like how DoT doesn't, to eliminate the need for a bootstrap DNS resolver), URL blocking will be ineffective, as well. I guess, it is a cat and mouse game from here on.
- xg15 7y agoI think the cat-and-mouse game is already over at "If TLS requests and responses could be intercepted". You need the cooperation of the app/device to do that. If it offers some way to do that, it will probably also have an option to just disable DoH. If it doesn't, you're back to blocking all Cloudflare (and Google) IPs.