As someone who has had to block and redirect DNS traffic, there are reasons we do this and if you have a problem with it then you should contact the admins about it. If you're unwilling to do that, maybe you shouldn't be doing what you're trying to do at work.

Do you happen to be the admin at the meeting venue that discarded my SRV and DNSSEC lookups? What were the reasons you did this, if so?

Use the guest WiFi, that's what it's there for.

Does that have a sensibly working resolver?

In my haphazard experience, the networks that block access to UDP port 53 are more than likely to have gelded broken name servers that e.g. serve empty NXERROR results for anything but A/TXT, and receptionists that say, "uh, let me check" and then check that their browser can open the google home page. (Insert invectives here.)

I've seen be fixed. Once. One meeting I attended started with a quite broken network, but it was an IETF meeting, and the IETF tools team reconfigured the AP channel layout, the DHCP server and the caching name server at that hotel and after that it was fine.

> If Google will fight that fight I'll happily enjoy the benefits.

Evidently, they are:

https://en.wikipedia.org/wiki/DNS_over_HTTPS

https://developers.google.com/speed/public-dns/docs/dns-over...

And that's how we are going to get mandatory https proxies in networks... The arms race will continue, making the lives of everyone more difficult.

A HTTPS proxy can't rewrite the contents of your stream. If it redirects to the wrong host, the cert doesn't match.

That's fine, it is not about rewriting stream, but about not allowing to connect certain hosts.

I will never install that cert, so it stops there for me. IT security theater be damned.

> On the other, $%#@%#$%!$@# the %$#%#$%^$#@%#$! packet filters that block DNS packets to everyone except the local brain-damaged resolver.

Curse it all you want, but forcing all DNS lookups to be resolved by a particular server is often an important security measure.

Lolwut? Seriously, what serious exploit would be stopped by this.