Hacker News

points by noselasd 3 days ago | 0 comments

Note that there are ISPs that actively hijack traffic to UDP port 53 further inside their network and transparently maps that onto their internal DNS servers.

[–] jachee 3 days ago

This is why you would want to setup DNS-over-TLS or DNS-over-HTTPS to, say, 1.1.1.1. They can’t hijack DNS traffic that looks like HTTPS traffic.

[–] cowlevel 2 days ago

Cloudflare knowing every single DNS resolution is just as bad.

[–] jachee 1 day ago

Nah, because at least they give you the actual answer instead of hijacking to censor/upsell/advertise to you.

But also, they were just an easy-to-type example, and you could replace them with any other DoT/DoH provider.