[LinuxBender]

CF explain how to do this here [1]. Have your local DNS resolvers filter the HTTPS type of DNS queries on your DNS servers. One example from Microsoft [2]. Unbound would probably need a patch though a work-around could be an iptables string filter or u32 filter for the record type. There is a DNS module [3] for iptables but it is not part of any default installations AFAIK.

The second way is to return a “no error no answer” or an NXDOMAIN response to queries made to the use-application-dns.net.

I personally already use the second option to block DoH and cell phones seem to automatically figure out to use port 853 for DNS-Over-TLS on my home router Unbound DNS. I also null route most of the public DoH servers. People point out that DoH can be on any CDN IP but it never has been.

[1] - https://developers.cloudflare.com/ssl/edge-certificates/ech/

[2] - https://learn.microsoft.com/en-us/windows-server/networking/...

[3] - https://github.com/mimuret/iptables-ext-dns

[bscphil]

This only works because browser vendors have taken the totally bullshit approach of "you're only allowed to use ECH if you have DoH enabled", even though they're really unrelated technologies. Related Mozilla bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1500289

Of course this kind of filtering is useless to stop a determined user (in a bring-your-own-device environment) because they can trivially just run their own DoH endpoint.

[josephcsible]

> The second way is to return a “no error no answer” or an NXDOMAIN response to queries made to the use-application-dns.net.

This misfeature can't be removed from browsers soon enough. Its existence is totally contrary to DoH's threat model, since the people DoH is designed to protect you from are exactly the ones who can manipulate insecure DNS results for that domain.

[growse]

It's just a network hint. Browsers are free to ignore (and I think Firefox has a toggle to ignore it).

[LinuxBender]

and I think Firefox has a toggle to ignore it

They do. It used to be one had to modify modes in about:config but now there is a GUI for it in the settings.

[1] - https://support.mozilla.org/en-US/kb/dns-over-https

[LinuxBender]

That DNS module for IPTables actually looks to be a bit outdated and is missing the type HTTPS as far as I can tell so maybe a request to the people at nlnetlabs to add options for query types to block in Unbound DNS may be useful.