Re:Critical Cache Poisoning Vulnerability in Dnsmasq
by dc396 on Tuesday August 19, 2025 @12:13PM
(#44953219)
Does dnsmasq have a way to forward via DOH/DOT? (I've no idea: I don't use it myself)
[ Parent
| on HN ]
Re:Critical Cache Poisoning Vulnerability in Dnsmasq
by aaronmdjones on Tuesday August 19, 2025 @07:00PM
(#44957041)
Not at the moment; to achieve this, you typically put it behind something like dnsproxy [1][2].
I have done this on my router, along with a couple firewall rules to prevent plaintext DNS queries leaking out of the WAN port. dnsmasq is configured to talk to dnsproxy, and dnsproxy is configured to use DNS over TLS with 1.1.1.1 [3]
[1] https://github.com/AdguardTeam/dnsproxy
[2] https://openwrt.org/docs/guide-user/services/dns/dot_dnsmasq...