7 ms·

Not entirely certain, but I think to some degree this is a way for the network to say, “I will not respect your privacy, so don’t try”. If a network implements

Not entirely certain, but I think to some degree this is a way for the network to say, “I will not respect your privacy, so don’t try”. If a network implements DNS-based content filtering and blocks DOH requests, not responding to a query for this domain could allow an application to know to not bother trying DOH, since it will definitely fail every time. I could be totally off the mark here, though.

donmcronald 3y ago
> and blocks DOH requests It’s on port 443, probably to the IP of a huge CDN. How would you block it?
- LinuxBender 3y ago
  This comes up in discussions quite a bit but in practice I have never seen that become a thing. There is technically nothing stopping a DNS provider from using random CDN nodes but unless you have found a working exception they all have well defined static IP addresses, sometimes even novelty IP's. Perhaps some day they will do this at the risk of CDN nodes getting blocked. I block DoH/DoT quite successfully on my network, not to invade privacy but to block privacy invading sites and usage statistics that the current DoH/DoT providers gather. Thus far it has not been an issue. I was surprised to find that cell phones automagically discover my DoT 853 listener on my firewall that is served up by Unbound. I do have a "_dns.resolver.arpa" hint record but nothing has ever queried it.
  - donmcronald 3y ago
    > This comes up in discussions quite a bit but in practice I have never seen that become a thing. How would you even know it’s happening? Is it even possible to snoop on HTTPS traffic if you have a mobile device like an iPhone? Making it impossible to see is the entire point AFAIK.
    - LinuxBender 3y ago
      I have physical access to the devices and I can also see every device that is registered in DHCP making queries to Unbound. Unless a specific application is leaking requests to 443 I can say with certainty that they are using my DNS server. People on my network appreciate the ad blocking and I would hear about it if that stopped working. [Edit] I should also add that I do not block VPN's. If someone wants to manually bypass my DNS they can do so with a VPN client. Perhaps some day all the browsers will start creating VPN tunnels to random CDN's on 443.
      - donmcronald 3y ago
        So you can tell they’re not using your DNS server, but you said: > I block DoH/DoT quite successfully on my network How do you block encrypted traffic that’s mixed in with normal HTTPS? I get that you can block the well known IPs, but that’s only a partial solution.
- opheliate 3y ago
  Ah of course, sorry, teaches me to speak without thinking.

donmcronald 3y ago

> and blocks DOH requests It’s on port 443, probably to the IP of a huge CDN. How would you block it?

LinuxBender 3y ago
This comes up in discussions quite a bit but in practice I have never seen that become a thing. There is technically nothing stopping a DNS provider from using random CDN nodes but unless you have found a working exception they all have well defined static IP addresses, sometimes even novelty IP's. Perhaps some day they will do this at the risk of CDN nodes getting blocked. I block DoH/DoT quite successfully on my network, not to invade privacy but to block privacy invading sites and usage statistics that the current DoH/DoT providers gather. Thus far it has not been an issue. I was surprised to find that cell phones automagically discover my DoT 853 listener on my firewall that is served up by Unbound. I do have a "_dns.resolver.arpa" hint record but nothing has ever queried it.
- donmcronald 3y ago
  > This comes up in discussions quite a bit but in practice I have never seen that become a thing. How would you even know it’s happening? Is it even possible to snoop on HTTPS traffic if you have a mobile device like an iPhone? Making it impossible to see is the entire point AFAIK.
  - LinuxBender 3y ago
    I have physical access to the devices and I can also see every device that is registered in DHCP making queries to Unbound. Unless a specific application is leaking requests to 443 I can say with certainty that they are using my DNS server. People on my network appreciate the ad blocking and I would hear about it if that stopped working. [Edit] I should also add that I do not block VPN's. If someone wants to manually bypass my DNS they can do so with a VPN client. Perhaps some day all the browsers will start creating VPN tunnels to random CDN's on 443.
    - donmcronald 3y ago
      So you can tell they’re not using your DNS server, but you said: > I block DoH/DoT quite successfully on my network How do you block encrypted traffic that’s mixed in with normal HTTPS? I get that you can block the well known IPs, but that’s only a partial solution.
opheliate 3y ago
Ah of course, sorry, teaches me to speak without thinking.