How do we block domains once apps incorporate their own DNS over HTTPS?
Original DNS was easy to see and manipulate, and that was a problem once it left the private network - it enabled ISP&#x27;s and other close-hop providers to catch a glimpse of what is being viewed online.<p>Inside the private network it was great because it could be detected and manipulated as necessary - redirecting rogue DNS queries to the desired DNS servers if specific software and apps were attempting to use their own hard-coded DNS servers (to bypass ad-blocking etc.), blocking unwanted domains and sites, etc.<p>Using Pi-Hole my current DNS request block percentage is 45.8%. I specifically redirect DNS requests through it using firewall rules. If I remove or disable the DNS redirection firewall rule this percentage falls to around 25 - 30%, meaning that there are a number of internal devices and software that are using specific, custom DNS servers rather than what my DHCP server hands out.  I don&#x27;t like that, but vanilla DNS lets me close that potential security hole.<p>What if these devices and software start using internal DNS over HTTPS (or any of the other forms of non-inspectable or non-specific-DNS-port DNS requests) settings that are non-configurable?<p>How do we even detect that it&#x27;s occurring, never mind being able to manipulate it to comply with the &#x27;policies&#x27; of our private networks?