points by xiconfjs 2 days ago | 0 comments
> It's best to never use the ISP's DNS servers, regardless of the reason why they might do what they do.
But providers overwriting DNS packets regardless – this is the topic of the article :)
P.S.: And yes, there are ways around this like DNSsec etc.
[–] j45 2 days ago
[–] akerl_ 2 days ago
A reminder that the average consumer device doesn't actually validate DNSSEC in its default configuration: it relies on its recursive resolver to set a bit on the response saying "I validated DNSSEC, things are all good". In that configuration, DNSSEC gets you no protection against this.
One of the reasons a variety of providers have been pushing for DoH is because DoH fully closes the risk of ISP MITM without needing individual site operators to do anything. This is why you're seeing folks like Firefox and Chrome enable DoH by default.
[–] cowlevel 2 days ago
DoH is fine if a bit complicated. The problem is who the DoH provider is. Usually it's Cloudflare.
[–] account42 2 days ago
> One of the reasons a variety of providers have been pushing for DoH is because DoH fully closes the risk of ISP MITM without needing individual site operators to do anything.
... by replacing it with Google/Cloudflare MITM with whom the user doesn't even have a business relationship or even shared jurisdiction.
Introducing what ISPs do with DNS information is helpful to understand how encompassing DNS self-hosting needs to be thought about - DNS requests are important to consider the appropriate encryption for.
From the homelab side, increasingly with the automated attacks on systems, it seems wise to keep all services off the internet directly and put it behind one or more service to keep them safe. From that perspective, setting up something like Tailscale can also help mitigate this kind of issue.