Glad you brought this up. My day job involves finding malicious network traffic. DOH is really easy to detect because in suricata or bro/zeek you simply match

Glad you brought this up. My day job involves finding malicious network traffic. DOH is really easy to detect because in suricata or bro/zeek you simply match new outbound connections with DNS responses. If you don't get a matching pair then you need to investigate why you have outbound traffic that is bypassing your DNS server. Note this is alpha stage code. I run this at home on all of my outbound traffic. https://www.reddit.com/r/pihole/comments/embh63/i_made_a_thing_free_for_additional_pihole_network/ https://www.reddit.com/r/pihole/comments/embh63/i_made_a_thi... Original.. https://github.com/morsgiathatch/suricata_edits/tree/master/DOCKER/syn_detector https://github.com/morsgiathatch/suricata_edits/tree/master/... Fork.. https://github.com/1stOctet/suricata_edits/tree/master/DOCKER/syn_detector https://github.com/1stOctet/suricata_edits/tree/master/DOCKE...