Re:Shutting down our unencrypted public DNS service
by 1vuio0pswjnm7 on Wednesday December 14, 2022 @04:07PM
(#33990565)
There is much "probing" from "tech" companies like Google and Apple. You should try running NetGuard on Android, block everything and observe what tries to connect.
It is one thing to use DoH if port 53 is being filtered, but that is a relatively small population of internet users. Forcing everyone to use DoH inside an ad-sponsored application like a web browser or a corporate OS like Android, versus providing it as an option, is questionable, IMO.
Do you use OpenWRT. OpenWRT routers with mwan3 enabled by default are pinging open resolvers, public DNS caches, like GoogleDNS, Cloudflare and Cisco OpenDNS to check for connectivity. These are considered "reliable IP addresses to ping".
Why not ping a root server instead. Even a com nameserver is more important than Google LLC.
EDNS is opportunistic but we can disable/remove it altogether before compiling our DNS servers. Or we can use DNS software, e.g., djbdns, that will never support it.
It is one thing to use DoH if port 53 is being filtered, but that is a relatively small population of internet users. Forcing everyone to use DoH inside an ad-sponsored application like a web browser or a corporate OS like Android, versus providing it as an option, is questionable, IMO.
Do you use OpenWRT. OpenWRT routers with mwan3 enabled by default are pinging open resolvers, public DNS caches, like GoogleDNS, Cloudflare and Cisco OpenDNS to check for connectivity. These are considered "reliable IP addresses to ping".
https://web.archive.org/web/20220629175529if_/https://github...
https://openwrt.org/docs/guide-user/network/wan/multiwan/mwa...
Why not ping a root server instead. Even a com nameserver is more important than Google LLC.
EDNS is opportunistic but we can disable/remove it altogether before compiling our DNS servers. Or we can use DNS software, e.g., djbdns, that will never support it.