Then your security strategy definitely needs improvements, since malware often uses hardcoded IPs to bypass DNS proxying/forwarding that corporate networks use. Seriously, this argument could be used to say we should be using HTTP instead of HTTPS, but anyone doing security knows if they really need that level of introspection they need to MITM HTTPS traffic with a MITM proxy. If you care that much, you also need to MITM DoH/DoT traffic.
Re:Mozilla’s DNS over HTTPs
by throw0101a on Thursday February 27, 2020 @08:07AM
(#22432860)
DNS sniffing takes care of a lot of low-hanging fruit.
Anything that uses our recursive servers is monitored, and we can check against blacklists, either in real-time or after-the-fact through logging.
* https://en.wikipedia.org/wiki/Domain_generation_algorithm
* https://en.wikipedia.org/wiki/Botnet#Domains
If malware is connecting to hard-coded IPs then there's nothing we can do about that.
So yes: monitoring DNS for suspicious activity is part of our security strategy.