3 ms·
They can't block a customer-premises recursive resolver. But the SNI is on the TCP connection, not the DNS request; if you have that sort of ISP, they can filte
by denton-scratch 4y ago
They can't block a customer-premises recursive resolver. But the SNI is on the TCP connection, not the DNS request; if you have that sort of ISP, they can filter based on SNI.
- sidewndr46 4y agoWhy would the location of the DNS resolver matter? If I am running a local DNS resolver, presumably it recurses to an outside DNs server. If my ISP blocks that, I can't use it.
- denton-scratch 4y agoIt recurses to the root, and then down the tree. So yes - the final query is a lookup for the name you are targeting, and yes, it goes through your ISP, like all your other traffic. But it doesn't go through your ISPs DNS infrastructure, it goes direct to the nameserver for the parent domain. And even that doesn't happen if your local resolver has the result cached. The easiest way to block DNS lookups is at the DNS server; using DPI to block DNS lookups is straying into sledgehammer/nut territory.
- sidewndr46 4y agoYeah, but isn't that laughably easy to block such a scheme? If a packet is destined for port 53 that isn't the ISPs DNS server, poof it's gone!
- Nextgrid 4y agoOr just redirect any outbound port-53 traffic to the ISP's DNS which will pretend to be the server you're talking to while silently applying the filtering.
- denton-scratch 4y agoYou're right; that's a very simple firewall rule. But if I can't access a working DNS server over the internet, then I don't have internet service, and whatever kind of provider I have, it's not an "internet service provider".
- sidewndr46 4y agoEach ISP get's to make its own rules, but its the norm where I've lived to have some services blocked. For example, my ISP blocks GRE. At least one in the past I had blocked inbound SMTP & DNS.
- denton-scratch 4y agoFine. I just don't call that "internet service". That's some kind of walled-garden internet-lite, conceptually the same as the old AOL.