Technitium DNS Server: Self host a DNS server for privacy and security

Re:Technitium DNS Server: Self host a DNS server for privacy... by aws-user on Wednesday January 17, 2024 @11:18AM (#39029743)

malware and other spying apps (like your television) are just adopting DNS over HTTPS (DoH) and bypassing whatever local DNS server you have deployed on your network, pihole and such are quickly becoming irrelevant.

[ Parent | on HN ]

Re:Technitium DNS Server: Self host a DNS server for privacy... by egberts1 on Wednesday January 17, 2024 @12:35PM (#39030811)

Thats why you block 53/udp and 53/tcp ports in your home gateway IP forwarder.

Insidious things, tsk tsk.

[ Parent | on HN ]

Re:Technitium DNS Server: Self host a DNS server for privacy... by greenshackle2 on Wednesday January 17, 2024 @04:14PM (#39033565)

DNS over HTTPS is using port 443 because it's... HTTPS. Are you blocking that too?

[ Parent | on HN ]

Re:Technitium DNS Server: Self host a DNS server for privacy... by egberts1 on Thursday January 18, 2024 @12:36PM (#39044746)

That's why you run a transparent HTTPS proxy gateway with iCAP DNS filters

[ Parent | on HN ]

Re:Technitium DNS Server: Self host a DNS server for privacy... by LinuxBender on Friday January 19, 2024 @07:54AM (#39054871)

Have you found any open resolvers that are using a shared CDN IP? I've been on the lookout for those ever since the first discussion of DoH appeared on HN. I have yet to find one but I would really like to know details if you have found one. Thus far I have been able to block DoH by NXDOMAIN'ing "use-application-dns.net" and blackhole routing about 80 IP addresses.

[ Parent | on HN ]

Re:Technitium DNS Server: Self host a DNS server for privacy... by vin047 on Thursday January 25, 2024 @09:09AM (#39129699)

You can block HTTPS to known DoH providers. You can set up an alias in a firewall to load the list from https://public-dns.info/nameservers-all.txt. Its a bit of a cat-and-mouse game as it relies on that list being updated frequently and reliably, but its the best you're gonna get for blocking DoH.

Also make sure to block outgoing TCP and UDP 853 – this blocks DoT and DoQ too.

[ Parent | on HN ]

Re:Technitium DNS Server: Self host a DNS server for privacy... by Bowes-Lyon on Wednesday January 17, 2024 @12:58PM (#39031108)

This DNS server supports DNS-over-TLS, DNS-over-HTTPS and DNS-over-QUIC among others, so it can’t be bypassed.

[ Parent | on HN ]