3 ms·
If you're so technical. Why not just put some firewall rules to block known DoH providers? If a malicious app was to use their own DoH server then there's noth
by Jonnax 7y ago
If you're so technical. Why not just put some firewall rules to block known DoH providers?
If a malicious app was to use their own DoH server then there's nothing you can do.
Well you can get a MITM web security product to inspect traffic.
Or only allow internet traffic through a proxy on your network and then block DNS providers.
Local caching via DNS? Perhaps on unencrypted HTTP traffic.
- bjoli 7y agoThat's what I do. I actively block third party DNS and known DNS services except cloudflare and quad9, but only when coming from my raspberry pi. I haven't allowed an unencrypted DNS request from my local network in a long time. At least not that I know of. I have blocked a lot of apps/appliances trying to use their own DNS, and so far that has been enough. When they figure out that they can use DNS on non-standard ports I'm fudged.