3 ms·

How do you block DNS-over-HTTPS? Are you MitM’ing the calls? FQDN/IP blacklist?

• lights0123 6y ago
  No one except Cloudflare is really doing ESNI, so you can just block dns.google.
  • daniellarusso 6y ago
    How would you know if another entity is using ESNI?
    • lights0123 6y ago
      Generally to check I just use Wireshark, but if they're big enough (Google), they'd probably talk about it. Also, ESNI isn't even the default in Firefox, and it's just straight up not implemented in Chrome.
• bozzcl 6y ago
  Sorry, I meant DNS-over-TLS. I blocked port 853.