Re:DNS Privacy Considerations
by tremon on Saturday July 31, 2021 @10:28AM
(#28018424)
I also block most known DoH servers outright.
When someone hosts a DoH server on a cdn/AWS/Azure/Google shared IP address, you can't block it by IP; and if the client uses ESNI, you can't block it by HTTP header inspection either.
Re:DNS Privacy Considerations
by netr0ute on Sunday August 01, 2021 @06:25PM
(#28030739)
How will the client know what address to send DoH to? You wouldn't just hardcode an IP unless you want that predictable address manually blocked in the firewall.
When someone hosts a DoH server on a cdn/AWS/Azure/Google shared IP address, you can't block it by IP; and if the client uses ESNI, you can't block it by HTTP header inspection either.