4 ms·

Intercept, yes, hijack no (with dnssec)? At least if you run a VPN on the local recursive resolver, or a dnscrypt proxy - giving you some choice over who you t

by e12e 5y ago

Intercept, yes, hijack no (with dnssec)? At least if you run a VPN on the local recursive resolver, or a dnscrypt proxy - giving you some choice over who you trust - your ISP won't be able to see the content of the lookups. And all local clients can just use DNS. But as long as root DNS is only signed, not encrypted, someone will see your lookups...

josephcsible 5y ago
> Intercept, yes, hijack no (with dnssec)? DNSSEC doesn't help with censorship. It means that your ISP can't send a fake response without you knowing it's fake, but they've accomplished their goal as long as they keep you from getting the real response. > or a dnscrypt proxy DNSCrypt traffic is obviously not HTTPS, even when run over TCP/443, so a malicious ISP could easily block it.