Blocking DNS-over-HTTPS (DoH)

I've been consolidating DoH lists for several years now, the list you are referring, only extract some domains from this list (indicated in the README.md of the author). There are many more valuable sources, the ones I use are mentioned in my manual (Block DNS over HTTPS (DoH), using pfsense).

The list you are referring says, quote, These DoT resolvers are at a base url, so blocking these providers may block regular web access to these services, unquote, which is wrong, DoT works on port 853, the best way to block Dot is simply blocking that port.

DoH (and oDoH - stands for oblivious DNS over HTTPS) works over port 443. Blocking this port will simply block acces to the internet.

In order to block DoH, a list of IP addresses where the DoH servers are hosted is required. Add a firewall rule that blocks port 443 for these addresses. You need to block the IP addresses, since there are devices that have hardcoded DoH clients (my nvidia shield pro tries to bypass regular DNS by using hardcoded (8.8.8.8 and 8.8.4.4) DoH.

When using the IP lists (see manual) some websites don't work anymore, so you need to make an exception for the IP addresses associated with that website.

Example: this website (discourse.pi-hole.net), is hosted on the same address as some DoH servers. When opening discourse.pi-hole.net, dns request for discourse.pi-hole.net and discourse.pi-hole.net are submitted, reply is 84.17.46.53. Unfortunately, this is also the address for doh1.b-cdn.net, doh1.blahdns.com, doh2.b-cdn.net and doh2.blahdns.com. In order for the website (discourse.pi-hole.net) to work, you can't block the above IP, an exception is required.

When defining an exception, the DoH servers on that IP address will also work, the only way to ensure (try, success not guaranteed if the IP is hardcoded) is by using a DNS blocklist, the Adblock Plus style list, supported by pi-hole can be found here. As an alternative, you can use the RPZ file, used with unbound (unbound RPZ manual here)

Warning: the IP lists, provided in the repository are regional, there are DoH services that have a different IP address in a different region (see issue). You can build your own lists, using the sqlite3 database (also available in the repository).

1 Like