3 ms·
Used to be you could mostly avoid such censorship by pointing a local resolver at the dns roots (or alternate roots..). I suppose you can run your own dns reso
by e12e 5y ago
Used to be you could mostly avoid such censorship by pointing a local resolver at the dns roots (or alternate roots..).
I suppose you can run your own dns resolver for dot - but there seems to be much poorer support for network level configuration (like DHCP)?
I'd like my android TV, my TV, my phone and my computers and my guests to use my local settings - automatically. Now every device need manual setup for every network?
- josephcsible 5y agoRunning your own local resolver doesn't help. Your ISP will just hijack the packets on the way to and from the authoritative servers, since they're in cleartext.
- e12e 5y agoIntercept, yes, hijack no (with dnssec)? At least if you run a VPN on the local recursive resolver, or a dnscrypt proxy - giving you some choice over who you trust - your ISP won't be able to see the content of the lookups. And all local clients can just use DNS. But as long as root DNS is only signed, not encrypted, someone will see your lookups...
- josephcsible 5y ago> Intercept, yes, hijack no (with dnssec)? DNSSEC doesn't help with censorship. It means that your ISP can't send a fake response without you knowing it's fake, but they've accomplished their goal as long as they keep you from getting the real response. > or a dnscrypt proxy DNSCrypt traffic is obviously not HTTPS, even when run over TCP/443, so a malicious ISP could easily block it.