Advice Request CleanBrowsing DNS vs NextDNS vs ControlD DNS

[Nightwalker]

Anyway, sorry to derail the conversation. The point is it can be blocked, easily by corps with the resources to do it. But it would be noticeable and very difficult to redirect. One would know they are being blocked.

Dont worry, it was very informative too me, but I still believe that this is more theoritical than pratical, after all most people/organizations wont go out their way to block DoH (it is anything but easy).

I think the problem that Templarware is facing is another think entirely.

 

[Templarware]

@SecureKongo I'm not using the configuration profile though, I went for the app. But it must be the same.

 

[blackice]

Dont worry, it was very informative too me, but I still believe that this is more theoritical than pratical, after all most people/organizations wont go out their way to block DoH (it is anything but easy).

I think the problem that Templarware is facing is another think entirely.

You are probably right about that. My org (US Govt) blocks encrypted DNS. But they kind of block everything.

 

[Kongo]

@SecureKongo I'm not using the configuration profile though, I went for the app. But it must be the same.

It should be. DoH is more popular and also the default on pretty much every system or browser.

 

[blackice]

@SecureKongo I'm not using the configuration profile though, I went for the app. But it must be the same.

I’d try the config profile. Less overhead.

 

[Nightwalker]

It should be. DoH is more popular and also the default on pretty much every system or browser.

Android doesnt support DoH for example (huge market share), it is only DoT.

 

[blackice]

Android doesnt support DoH for example (huge market share), it is only DoT.

DoT is designed for system wide use. It is actually a better, cleaner protocol. I wish Windows supported it. DoH is a mess.

 

[Kongo]

Android doesnt support DoH for example (huge market share), it is only DoT.

Never ever used an Android device. But good to know

 

[Templarware]

The App is just much easier to turn off/on and change settings, and NextDNS claims both Profile and App drain the same battery.

 

[Nightwalker]

DoT is designed for system wide use. It is actually a better, cleaner protocol. I wish Windows supported it. DoH is a mess.

Yeah, there is many articles about that (DoT has way less overhead compared to DoH), the only advantage of DoH is its camouflage with HTTPS traffic.

 

[Kongo]

The App is just much easier to turn off/on and change settings, and NextDNS claims both Profile and App drain the same battery.

You can disable the profile easily too in the settings, but I am not here to keep on annoying you with the same stuff. I stopped using encrypted DNS on my iOS device and use it on my Firewall network-wide, as I faced the same issue as you. Always got a notification, that I am connected to a network that forbids encrypted DNS, even tho it was my home network and not the case.

 

[blackice]

You can disable the profile easily too in the settings, but I am not here to keep on annoying you with the same stuff. I stopped using encrypted DNS on my iOS device and use it on my Firewall network-wide, as I faced the same issue as you. Always got a notification, that I am connected to a network that forbids encrypted DNS, even tho it was my home network and not the case.

What router are you using?

 

[Kongo]

What router are you using?

Speedport Smart 4 but I doubt that you know it. After all, I only get the notification but nothing gets blocked.

 

[blackice]

Speedport Smart 4 but I doubt that you know it. After all, I only get the notification but nothing gets blocked.

Definitely not familiar, I'm assuming it's German. iOS seems sensitive to some router configurations, so I was curious.

 

[Templarware]

If this network blocks encrypted DNS, I assume it will also block VPN?

 

[Kongo]

Definitely not familiar, I'm assuming it's German. iOS seems sensitive to some router configurations, so I was curious.

Read some posts on a forum and they said that it was somehow an iOS 14 related issue. No idea, but as I said it isn't really a big deal, as I can use encrypted DNS normally.

 

[blackice]

If this network blocks encrypted DNS, I assume it will also block VPN?

VPNs are tougher since they can use various ports and there are a lot more IPs to block. But they can be blocked.

 

[Kongo]

If this network blocks encrypted DNS, I assume it will also block VPN?

As @blackice said VPNs are harder to block, as for example the OpenVPN protocol uses the port 1194 or 443 if I remember correctly. So basically two ports that would need to be blocked. Another method would be the blocking of all the individual IPs of popular VPN providers.

 

[Templarware]

Funnily enough, that network that is blocking DoH, is not blocking DoT. Quad9 DoT profile works.

 

[forgottenuser79643]

Can confirm. Android 11 and 12 natively support TLS in the connection (Wi-Fi) advanced settings, a feature known as "private dns", as I have been using Quad9's TLS address as my "private dns" for android 11 till now. I have read, however, that android 13 may natively support DoH in its release.