5 ms·

malware and other spying apps (like your television) are just adopting DNS over HTTPS (DoH) and bypassing whatever local DNS server you have deployed on your ne

malware and other spying apps (like your television) are just adopting DNS over HTTPS (DoH) and bypassing whatever local DNS server you have deployed on your network, pihole and such are quickly becoming irrelevant.

egberts1 3y ago
Thats why you block 53/udp and 53/tcp ports in your home gateway IP forwarder. Insidious things, tsk tsk.
- greenshackle2 3y ago
  DNS over HTTPS is using port 443 because it's... HTTPS. Are you blocking that too?
  - egberts1 3y ago
    That's why you run a transparent HTTPS proxy gateway with iCAP DNS filters
  - LinuxBender 3y ago
    Have you found any open resolvers that are using a shared CDN IP? I've been on the lookout for those ever since the first discussion of DoH appeared on HN. I have yet to find one but I would really like to know details if you have found one. Thus far I have been able to block DoH by NXDOMAIN'ing "use-application-dns.net" and blackhole routing about 80 IP addresses.
  - vin047 3y ago
    You can block HTTPS to known DoH providers. You can set up an alias in a firewall to load the list from https://public-dns.info/nameservers-all.txt https://public-dns.info/nameservers-all.txt. Its a bit of a cat-and-mouse game as it relies on that list being updated frequently and reliably, but its the best you're gonna get for blocking DoH. Also make sure to block outgoing TCP and UDP 853 – this blocks DoT and DoQ too.
Bowes-Lyon 3y ago
This DNS server supports DNS-over-TLS, DNS-over-HTTPS and DNS-over-QUIC among others, so it can’t be bypassed.