As it stands, pi-hole does not provide an intuitive way to block DoH bypasses by itself. The special domain _dns.resolver.arpa is used to upgrade clients to use DNS over HTTPS, and may provide a way around the pi-hole's blocking. With a pi-hole configured forwarder of 1.1.1.1, clients resolving _dn…

Thank you for the suggestion, it quite obviously seems a good idea. I had a look at the other discussion, too, dating back to the end of 2022 and think I missed parts of it back then. I seem to recall having only seen the discussion about a general blocking of all SVCB queries which seemed (and stil…

That's cool! I Iike it :slight_smile:

[image] DL6ER: I'd be great if you could run sudo pihole checkout ftl new/dns_resolver_arpa and verify yourself that this is behaving as you expect it to. While everything looks good in the WebUI and the .toml, it's not returning with an NXDOMAIN. Functionally, it does block the query howev…

The feature has just been merged into development and will be part of the next FTL release.

[image] DL6ER: I seem to recall having only seen the discussion about a general blocking of all SVCB queries which seemed (and still seems) over the top. Just some food for thought, Palo Alto themselves do recommend blocking all SVCB records: [image] See: Security Profile: Anti-Spyware

[image] Ladrien: Palo Alto themselves do recommend blocking all SVCB records .*;querytype=ANY,HTTPS,SVCB;reply=nodata I've bee running the "regex deny" for quite some time, without any noticeable impact. Be aware "whitelist always wins", so in order to enforce blocking for the specified que…

This has been released with Pi-hole FTL v6.1 by PromoFaux · Pull Request #2394 · pi-hole/FTL · GitHub

it seems the "problem" is back with latest FTL [image]

Your screenshot shows '_dns.resolver.arpa as being blocked. What is the problem with that? I think this was what the feature request requested.

sorry, then I misunderstood the request :frowning:

Pi-hole Userspace

Implement _dns.resolver.arpa as a special domain or add BLOCK_SVCB as a configuration option

Feature Requests Implemented