2 ms·
You run a DoH or DoT proxy on your edge device or a caching resolver that supports DoH on your edge device, serve DNS from the edge device over DHCP and block o
by tristor 4y ago
You run a DoH or DoT proxy on your edge device or a caching resolver that supports DoH on your edge device, serve DNS from the edge device over DHCP and block outbound DNS from other devices on the network at the firewall. Doesn’t fix evil Google devices that intentionally use DoH to bypass DNS blocking, but there are ways (more complicated, unfortunately) to fix that too.
- stock_toaster 4y agoI use unbound as my edge resolver, and you can use this to help prevent _some_ rogue DoH clients # nx domain for disabling firefox DoH, so we can still get adblocking # https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet local-zone: "use-application-dns.net" always_nxdomain