1. Posts must be related to the discussion of digital piracy
2. Don’t request invites, trade, sell, or self-promote
3. Don’t request or link to specific pirated titles, including DMs
4. Don’t submit low-quality posts, be entitled, or harass others
💰 Please help cover server costs.
This is why technologies like DoH and DoT are needed. To prevent this kind of tampering.
Everybody should be using DNS over HTTPS (DoH) or over TLS (DoT) nowadays. Clear DNS is way too easy to subvert and even when it’s not being tampered with most ISP snoop on it to compile statistics about what their customers visit.
DoH and DoT aren’t a full-proof solution though. HTTPS connections still leak domain names when the target server doesn’t use Encrypted Hello (ECH) and you need to be using DoH for ECH to work.
Even if all that is in place, a determined ISP, workplace or state actor can identify DoH/DoT servers and compile block lists, perform deep packet inspection to detect such connections regardless of server, or set up their own honey trap servers.
There’s also the negative side of DoH/DoT, when appliances and IoT devices on your network use it to bypass your control over your LAN.
How would they do DPI on DNS packets routed using DoH? It looks like HTTPS traffic, it’s encrypted, and other than size and frequency I don’t see how they can gey anything out of it. Yeah they’ll get the SNI with eCH but that’s supported by FF and by a lot of providers using DoH
What’s the “best practices” for DNS these days besides running your own local service?
Just use your VPN provider’s DNS.
NextDNS
Will be blocked just as well. These users need encrypted DNS, and honestly, not just them but everyone else too because of ISP tracking. dnscrypt or DoH is the solution.
Wouldn’t a VPN still work? VPN+NextDNS would do the job.
Hope Proton comes up with a good encrypted DNS service however.
Yes, that should work too
…
Essentially Malaysia law required ISP to drop DNS entries for some sites, local users started using public DNS. ISP started redirecting public DNS requests, and local users started using DNS over HTTPS.
The pirate wars continue in their arms races.