3 ms·
Why not? Software that hardcodes DNS servers usually fallback to DHCP, so you can simply block all requests to well known DNS servers, and they will automatical
by dastx 7y ago
Why not? Software that hardcodes DNS servers usually fallback to DHCP, so you can simply block all requests to well known DNS servers, and they will automatically go through the DNS server you've served using DHCP.
- JohnFen 7y agoBecause you have no visibility that the lookup is happening. If software is doing a lookup via DoH, you have no way of knowing that's happening, let alone be able to do anything about it, without MITMing your HTTPS connections. You could, of course, block all requests to public DNS servers, but that's of limited use (do you even know all the public DNS servers in the world?), can cause unacceptable collateral damage, and the fallback of malicious code would probably be to use a private DoH resolver that you don't know about. > they will automatically go through the DNS server you've served using DHCP. This would only be true if the software is using the operating system or browser to do the lookups. If the software is doing the lookups itself without involving the OS or browser (which is trivial to do), then the behavior will be whatever the dev of the malicious code wants it to be.