3 ms·
> I want to run my own DNS and block DNS to the rest of the Internet. Your private recursive DNS server, of course, has to send requests to the rest of the int
by denton-scratch 3y ago
> I want to run my own DNS and block DNS to the rest of the Internet.
Your private recursive DNS server, of course, has to send requests to the rest of the internet; you don't want to block those. They don't have to be plaintext, unless the authoritative server in question only talks plaintext.
- johnklos 3y agoOf course, and it's obviously easier to configure a single recursive resolver to prefer encryption wherever possible than it is to try to configure each client (or in the case of DoH, each program) to do opportunistic encryption. The point is that these requests don't go to my ISP's DNS servers. And for the other people who're making up unrealistic scenarios such as the ISP trying to MITM all DNS, not just queries they answer, there are many forms of tunneling that can be used such as VPNs. It's still easier to do one solution for the whole network than individual solutions for each client (or each application, for DoH).