24 ms·
As mentioned in TFA, configuring a firewall to redirect DNS traffic from broken or malicious software is also trivial. Or are you talking about hardcoding IP ad
by encom 6y ago
As mentioned in TFA, configuring a firewall to redirect DNS traffic from broken or malicious software is also trivial. Or are you talking about hardcoding IP addresses?
- shawnz 6y agoThere are plenty of other alternatives. The simplest (but least flexible) would be hardcoding an IP of the final server. Somewhat more sophisticated would be hardcoding an IP to a server with a REST endpoint that returns the real final IP. (Basically just like what DoH does, but without calling it DoH). Even more sophisticated would be hiding the final IP on some kind of public web service like Twitter or Github.
- SAI_Peregrinus 6y agoNote that malware of various sorts has done all of this for years. It used to be reasonably common to get command/control server info via IRC, basically DNS over IRC. DNS blocking has never been an effective network management strategy, and it never will be.
- folmar 6y agoYou can/should block connections to IPs which were not returned by DNS recently.