block-doh

I'm not sure what the commenter's setup is, but I have one that (at least mostly) achieves the same thing. It is a combination of a few things: 1. Redirect all outbound DNS traffic to your own local DNS server (as described in the link in this post) 2. Return NXDOMAIN for well-known DoH domains [1] (as well as "use-application-dns.net" for well-behaving software like Firefox [2]) 3. Block traffic to well-known DoH providers by destination IP address [1] [1] https://github.com/bambenek/block-doh [2] https://support.mozilla.org/en-US/kb/configuring-networks-di...

DoH will just be the start of another arms race. If you would like to control DoH also user LinuxBender responded to a question I asked about DoH blocklists with these repos in another post. I haven't got around to trying it out yet though. [1]: https://github.com/bambenek/block-doh [2]: https://github.com/Sekhan/TheGreatWall Edit: I am mostly curious to see what devices/applications it will break.

Comprehensive, no. There are growing numbers of git repos of DoH names. [1] [2] [1] - https://github.com/bambenek/block-doh [2] - https://github.com/Sekhan/TheGreatWall

You could null route or firewall all the open resolvers, or at least the most common ones. If your router is linux, that might look like /sbin/ip route add blackhole 9.9.9.9 2>/dev/null /sbin/ip route add blackhole 1.1.1.1 2>/dev/null /sbin/ip route add blackhole 1.0.0.1 2>/dev/null /sbin/ip route add blackhole 8.8.8.8 2>/dev/null /sbin/ip route add blackhole 8.8.4.4 2>/dev/null I'm probably leaving many of them off. There is probably a RBL for those by now. Here is one [1] and here is a list of them. [2] [1] - https://github.com/bambenek/block-doh [2] - https://github.com/curl/curl/wiki/DNS-over-HTTPS