3 ms·

You can also DNAT all port 53 traffic to your resolver. Devices will think they are talking to 8.8.8.8 or whatever, but in reality they will ask your resolver a

You can also DNAT all port 53 traffic to your resolver. Devices will think they are talking to 8.8.8.8 or whatever, but in reality they will ask your resolver and your filtering will apply. Your filtering can still break these devices.

Spivak 6y ago
This only works as long as DNS is both unauthenticated and unencrypted.
- vetinari 6y ago
  Which, at port 53, it is. Obviously, it would work with DoT (853) only with cert verification disabled.