6 ms·
DNS over HTTPS is using port 443 because it's... HTTPS. Are you blocking that too?
by greenshackle2 3y ago
DNS over HTTPS is using port 443 because it's... HTTPS. Are you blocking that too?
- egberts1 3y agoThat's why you run a transparent HTTPS proxy gateway with iCAP DNS filters
- LinuxBender 3y agoHave you found any open resolvers that are using a shared CDN IP? I've been on the lookout for those ever since the first discussion of DoH appeared on HN. I have yet to find one but I would really like to know details if you have found one. Thus far I have been able to block DoH by NXDOMAIN'ing "use-application-dns.net" and blackhole routing about 80 IP addresses.
- vin047 3y agoYou can block HTTPS to known DoH providers. You can set up an alias in a firewall to load the list from https://public-dns.info/nameservers-all.txt https://public-dns.info/nameservers-all.txt. Its a bit of a cat-and-mouse game as it relies on that list being updated frequently and reliably, but its the best you're gonna get for blocking DoH. Also make sure to block outgoing TCP and UDP 853 – this blocks DoT and DoQ too.