3 ms·

>Does anyone have any reason to try to block it on their networks (not just wanting to turn it off on their own devices), other than that they're network operat

>Does anyone have any reason to try to block it on their networks (not just wanting to turn it off on their own devices), other than that they're network operators who want to be able to censor and surveil traffic from other people's computers? I do. You're absolutely correct that some folks want/need to be concerned about censorship/surveillance by their network provider(s). I do not, and if I did, I'd go full on VPN to avoid their intereference/spying. That said, there are various devices on my home network that are not fully under my control like streaming devices and "smart" TVs. That could also, presumably, extend to various bits of software that try connectng to sites of which I do not approve. As time goes by, more and more devices will integrate DNS-over-TLS/HTTPS whose resolver settings are hard-coded and can't be disabled. I want to be able to audit (and block) DNS lookups by all devices on my network. As such, I use both a DNS filter (ala PiHole) and a local recursive resolver. Yes, my ISP can see all the DNS requests my local resolver makes, but then they can see all my traffic anyway. IMHO, DNS over TLS/HTTPS benefits the big DNS providers (since most folks will just use Google/Cloudflare for such stuff), giving them (especially Google) unprecedented access to browsing and other internet application traffic. For me, at least, I'd much rather have my ISP see the cleartext UDP packets that my local resolver generates than give Google/Clouflare a list of every IP address to which I might wish to connect. That's not to say there isn't a use case for DNS-over-TLS/HTTPS, but that's not my use case. Edit: Changed emphasis from local to local recursive resolver.

josephcsible 5y ago
For devices that aren't fully under your control despite you owning them, couldn't they still do whatever they want by hardcoding the IPs of whatever services they want to talk to, instead of using DNS or anything like it at all? Blocking DoH doesn't fix that problem.
- nobody9999 5y ago
  >For devices that aren't fully under your control despite you owning them, couldn't they still do whatever they want by hardcoding the IPs of whatever services they want to talk to, instead of using DNS or anything like it at all? Blocking DoH doesn't fix that problem. That's absolutely correct. And if any of my devices were doing that (and I've checked, for just that reason), egress filtering can handle blocking such connections just fine.
  - josephcsible 5y ago
    Presumably there's a reason that you give these devices Internet access in the first place. Can't they just use the same host for their nefarious activity that they do for their legitimate activity?
    - nobody9999 5y ago
      >Presumably there's a reason that you give these devices Internet access in the first place. Can't they just use the same host for their nefarious activity that they do for their legitimate activity? You make my point for me. Which is why hiding DNS traffic in https traffic is so insidious. Nuke DoH from orbit. It's the only way to be sure.
      - josephcsible 5y ago
        How so? My point is that if they do that, then they don't need DoH to do their bad stuff.
silon42 5y ago
> As such, I use both a DNS filter (ala PiHole) and a local recursive resolver. Next step is to ban all network connections that were not resolved using your local provider (and only allow them only for TTL)... also run each low-trust application in it's own container with individual network IP.

josephcsible 5y ago

For devices that aren't fully under your control despite you owning them, couldn't they still do whatever they want by hardcoding the IPs of whatever services they want to talk to, instead of using DNS or anything like it at all? Blocking DoH doesn't fix that problem.

nobody9999 5y ago
>For devices that aren't fully under your control despite you owning them, couldn't they still do whatever they want by hardcoding the IPs of whatever services they want to talk to, instead of using DNS or anything like it at all? Blocking DoH doesn't fix that problem. That's absolutely correct. And if any of my devices were doing that (and I've checked, for just that reason), egress filtering can handle blocking such connections just fine.
- josephcsible 5y ago
  Presumably there's a reason that you give these devices Internet access in the first place. Can't they just use the same host for their nefarious activity that they do for their legitimate activity?
  - nobody9999 5y ago
    >Presumably there's a reason that you give these devices Internet access in the first place. Can't they just use the same host for their nefarious activity that they do for their legitimate activity? You make my point for me. Which is why hiding DNS traffic in https traffic is so insidious. Nuke DoH from orbit. It's the only way to be sure.
    - josephcsible 5y ago
      How so? My point is that if they do that, then they don't need DoH to do their bad stuff.

silon42 5y ago

> As such, I use both a DNS filter (ala PiHole) and a local recursive resolver. Next step is to ban all network connections that were not resolved using your local provider (and only allow them only for TTL)... also run each low-trust application in it's own container with individual network IP.