Hacker News Reader

Comment by gizdan | Hacker News Reader

Because no one knows about it. But also, looking at their list of servers, the majority is offline. Assuming this is because any person can run one, it's probably the reason.

On top of the above, the likes of Google are enforcing their DNS servers. For example, I run AdGuard Home with it's DHCP functionality. I am unable to rely on the DHCP settings on my Android phone because Google forces the first DNS server to be 8.8.8.8 with (as far as I can tell) no way to disable this.

I think at least for the foreseeable future the solution is to run Unbound and stop relying on DNS resolvers combined with a firewall that redirects all DNS records AdGuard Home/PiHole. This is obviously not a solution to the general public.

View on HN

Lots of tech giants are forcing DoH so their apps can phone home despite safeguards such as pi-hole. There's not a lot that you can do about that (if they are using certificate pinning, which they probably are). You can however do something about 8.8.8.8 (and 8.8.4.4). Just put a static route in your firewall that points those to your DNS of choice (or to a black hole).

I'm still in the stages of setting up a fullt featured firewall at home, but I wonder what would happen if you block doh/dot addresses completely in such cases. Something to try in the future when I have my home network set up properly I guess.

You can block all outgoing requests to ports 53 and 853 for DNS and DoT respectively. That's the easy part.

For DoH, you either have to block port 443 (bad idea), or block the IPs of all known DoH providers.

Then you can run for example a Pi-Hole and add a firewall rule to allow outgoing DNS traffic only for that.

And of course that will not stop device/app makers from using nonstandard ports or even tunnelling their DNS traffic through other protocols.

> I am unable to rely on the DHCP settings on my Android phone because Google forces the first DNS server to be 8.8.8.8 with (as far as I can tell) no way to disable this.

Which Android version and skin? I'm on an Android 10, MIUI12 device and the DHCP-provided DNS server is the one used ( AdGuard successfully blocks ads on websites, apps when on my phone, until i disable it).

I can't speak to Google forcing DNS, I don't know if this is true. However, it will respect the private DNS option (DNS-over-TLS) which you can point to whatever you want (like NextDNS for filtering).

Interesting to know. I'll have to look into that. AdGuard Home can be set up easily with DoT and DoH so I'll have to try that.

Just keep in mind some mobile carries block DoT so it's not always an option (Android does not natively support DoH).

Reply on news.ycombinator.com