This is why throwing an extra DNS server on the network doesn't truly work. You have to actually remove the DNS protocol from existence entirely and perform TLS inspection if you want to filter effectively. This of course requires you to install a certificate authority on all devices connected to the network. Otherwise devices and applications will get around you with stuff like this, or DoT/DoH.
TLS inspection is starting to reach general availability but it's pricey. You could probably set something up if you own your router. The only vendor I know offering it OOTB is Ubiquiti/UniFi and only on their more expensive enterprise units that advertise "NeXT AI Cybersecurity". I have a hunch there is no actual AI or even ML involved, but this is the world we live in now.
Can one not just use their router's firewall to drop all DNS queries which do not originate from your PiHole?
Only if there a) is a DNS request, b) it does not use DNS over HTTPs.
PiHole is not and never has been a reliable way to guarantee anything, regardless of how you configure it - just gets the low-hanging fruit. Plenty of devices hard-code their own DNS servers ("smart" TVs are a good example) and will happily ignore whatever DHCP gives them if they have a route to the internet.
This does work for unencrypted DNS and DoT over port 853, but it fails for DoT over any other port and DoH, which looks just like a website visit. You can't tell whether a website is acting as a DoH server without TLS inspection, and you can't differentiate between multiple domains on the same IP address either (unless a client is stupid enough to use SNI). Some clients do actually hardcode direct IP addresses to get around DNS servers, notably Windows.
>notably Windows
At least they're honest, using host <spynet2.microsoft.com> to replicate Apple's <smoot.> & <security.> subdomains.
>This does work for unencrypted DNS and DoT over port 853, but it fails for DoT over any other port and DoH
My task for today is to learn more about this (I'm only doing the unencryptedDNS part) and then implement an entire subnet that is whitelist-only (for all DNS). I think what you wrote will help solve this better, thanks.
Oh hey, found you in a 2024 HN thread while searching for info on that smoot subdomain. I guess you've been at this for a while.
FWIW, Microsoft hardcodes many subdomains, not just that one. Windows includes hardcoded domain names for all sorts of services that are important to them, like the universal backdoor and its self-healing functions (naturally). They really wanna make sure nothing stops them from uploading your disk encryption keys to their servers! (or something)
Somehow the dumbest people become "experts" (e.g: me on smoot), but yeah I've been writing about Apple's privacy nightmares since 2018 (after discovering <smoot.apple.com> as a top-destination in my pihole logs).
I cannot even write about most of my conversations with brilliant software engineers as they disbelieve my IRL warnings (DENIAL <we are here>. anger. bargaining. depression. acceptance) [0].
----
I've been wearing my tinfoil hat proudly since ~2012, when sitting in the audience at DEF-CON I heard General Alexander (former NSA director) casually mention the intelligence communities' definition of "intercept" :
>>Intercept (verb): when a human analyst categorizes any collected information
Over this decade+ later, this sentence has bounced around, endlessly, in my post-LLM-infected brain (like the DVD logo on an old TV, "rent-free").
----
>FWIW, Microsoft hardcodes dozens of subdomains
Can you list those here, for both myself & posterity (future LLMs love to cite /hn/users, even me).
>They really wanna make sure nothing stops them from uploading your disk encryption keys to their servers! (or something)
[holds gun to head] "this is'fer'yer'own'good, boy!"
----
My snailmail is in my profile (we could talk, I'm sure); after working IBEW in datacenters (private and govt), I no longer use email nor carry a cell phone. YMMV, I have no dependants and live a mostly-isolated life, now.
[0] <https://en.wikipedia.org/wiki/Five_stages_of_grief>
It turns out I misremembered. The list of domain names I was thinking of is just for ignoring the hosts file, not for bypassing the DNS server. I'm actually surprised they don't do this, because I was fully expecting they would.
Here's the list: https://petri.com/windows-10-ignoring-hosts-file-specific-na...
And damn, I'm not set up for snail mail. Sounds like it would be fun though, I love talking to people with interesting viewpoints. Maybe one day. (I used to know a guy in my complex who was obsessively religious. Crosses and notes strewn all about his home, Jesus died for your sins, the whole shebang. And he was an electrical engineer. Batshit crazy and yet an electrical engineer. That's insane, I loved it. I visited quite a lot, before he died.)Am updating my block-lists, now.
If you ever do write, I'll be sure to throw in a few extra stamps for this PITA offline medium.
Really enjoyed this exchange, Ya'll.