• Evotech
    link
    fedilink
    English
    arrow-up
    2
    ·
    12 days ago

    They can hardcode ips. But they are not going to bother

    • offspec
      link
      fedilink
      English
      arrow-up
      7
      ·
      12 days ago

      If they hard code an IP for DNS there’s nothing stopping you from just setting a firewall rule to send that traffic to your own DNS server

      • Holla@feddit.orgdeleted by creator
        link
        fedilink
        English
        arrow-up
        2
        ·
        12 days ago

        Except that dns over https is a thing, which would be challenging to pry open

        • offspec
          link
          fedilink
          English
          arrow-up
          2
          ·
          11 days ago

          I’m not going to pretend to be a network engineer but DNS over HTTPS is not intended to be used to bypass network restrictions, and as such to remain secure still needs you to match up a domain to an ip address to make your HTTPS request in a secure context. This means that either they (1) hard code in a pairing of ip address and domain, or (2) connect to first a normal dns server using standard ports then use that to get the associated between their secured DNS over HTTPS service. The first is harder to block for sure, the second is probably the way a normal human would implement it and is still largely effective.