topic Re: Why have Plusnet blocked secure DNS? in Everything else

Why have Plusnet blocked secure DNS?

kev51773 — Sat, 18 Jul 2020 12:40:22 GMT

Can't use DNS over TLS using either google.com or 1dot1dot1dot1.cloudflare-dns.com. This worked as recently as last week and still works fine anywhere else so long as I'm not connected via Plusnet as soon as I'm connected via Plusnet, at at home or at a relative's house, it doesn't work.
I'd really prefer not to have my security choices dictated to me.

DNS over TLS (Private DNS) on Android suddenly stopped working overnight

Swipe — Fri, 17 Jul 2020 09:00:59 GMT

DNS over TLS (Private DNS) on Android suddenly stopped working overnight when connected via WiFi. This works fine when connected using Mobile data on the 3 network. Has something been changed or blocked at the Plusnet ISP level? I have confirmed this using both Cloudflare and NextDNS. I rebooted my router to rule that out. Please can someone else try setting up private DNS on Android 9 or higher using 1dot1dot1dot1.cloudflare-dns.com to confirm this is a widespread issue?

Re: DNS over TLS (Private DNS) on Android suddenly stopped working overnight

Swipe — Fri, 17 Jul 2020 14:35:38 GMT

Just tested it at my mother's house on her Plusnet ADSL, connected via WiFi and it works. I'll raise a ticket

Re: Why have Plusnet blocked secure DNS?

Swipe — Sat, 18 Jul 2020 12:50:10 GMT

I also posted about this yesterday in the forums and no one replied. One slight oddity in my case is that it does still work on my mother's Plusnet ADSL but not on my fibre connection. Maybe she has yet to pick up the new policies? I see no reason for them blocking it at all if DNS over HTTPS is still allowed. Why just punish DNS over TLS? I'm hoping it's an error that will be reversed.

Re: Why have Plusnet blocked secure DNS?

VileReynard — Sat, 18 Jul 2020 15:18:27 GMT

Presumably it gets blocked because Plusnet can't tell which https web sites you are visiting, other than via your DNS requests?

BTW I have a longstanding setting for Firefox:-

Note that I allow my router to have their rubbish settings.

Re: Why have Plusnet blocked secure DNS?

Swipe — Sat, 18 Jul 2020 15:23:09 GMT

Your post is not really relevant to the thread which is, why has DNS over TLS been blocked

Re: Why have Plusnet blocked secure DNS?

7up — Sun, 19 Jul 2020 00:35:31 GMT

@Swipe wrote:
Your post is not really relevant to the thread which is, why has DNS over TLS been blocked

@VileReynard 's first sentence answered your question - presumably because plusnet can't see what sites you're visiting.

The rest of his reply is a bit irrelevent yes, however the first sentence said it all.

Re: Why have Plusnet blocked secure DNS?

kev51773 — Sun, 19 Jul 2020 05:22:47 GMT

But they also couldn't see it if I used DNS over HTTPS, or even just used a VPN.

It would be nice if someone from Plusnet would chime in with a response.

Re: Why have Plusnet blocked secure DNS?

mechanic123 — Sun, 19 Jul 2020 11:03:22 GMT

@VileReynard wrote:

Presumably it gets blocked because Plusnet can't tell which https web sites you are visiting, other than via your DNS requests?

But why would PN want to know that? Other than routing, obv.

Re: Why have Plusnet blocked secure DNS?

VileReynard — Sun, 19 Jul 2020 12:26:47 GMT

As pointed out by@Swipe , my response was not relevant to this topic.

However, Plusnet are required to record all web sites visited by you:-

See https://www.ispreview.co.uk/index.php/2018/04/high-court-rules-uk-isp-internet-snooping-law-is-unlawful.html

or https://en.wikipedia.org/wiki/Data_retention#United_Kingdom

On the original topic:-

There is a difference between DNS over TLS and DNS over HTTPS.

DNS over TLS uses its own port and so can be blocked or firewalled by servers [or Plusnet]. DNS over HTTPS just uses the standard https port.

https://www.cloudflare.com/learning/dns/dns-over-tls/

Re: Why have Plusnet blocked secure DNS?

7up — Sun, 19 Jul 2020 22:06:09 GMT

@kev51773 wrote:
But they also couldn't see it if I used DNS over HTTPS, or even just used a VPN.

It would be nice if someone from Plusnet would chime in with a response.

If they blocked https most of the internet would studdenly stop working for plusnet users - everything from webmail to paypal (and other payment websites).

HTTPS cannot be blocked for that very reason - and as it's encrypted, plusnet can't filter out the dns requests to block them.

VPN is also not easy to block - many employers use VPN connections to let their staff access the corporate network remotely eg from home. Infact you could argue that a VPN works in a very similar way to an ISP (and thus should log all traffic).

DNS that is unencrypted is not really blockable either - by corporate firewalls at least. That's how some people manage to use VPNs to escape work - the vpn using dns requests to a vpn server which sends back data in the reply - that data being the vpn packets instead of actual dns query replies.

As for plusnet replying, that's just not going to happen. They don't like admitting to negativity or restricting their customers abilities online.

Re: Why have Plusnet blocked secure DNS?

kev51773 — Mon, 20 Jul 2020 14:57:30 GMT

When did we reach a stage where ISP's were actively working against security.

I get that they are required to keep a list of sites visited. Or at least they are required to attempt to keep a record (since there are myriad ways are avoiding there tracking which cannot be prevented). What they're doing here is the equivalent of banning people from locking there doors in case the police want to pop in for a random unannounced visit.
Works great for the police.... Or for anyone else.

Sadly, that's another ISP on the blacklist. Roll on end of contract.

Re: Why have Plusnet blocked secure DNS?

Swipe — Mon, 20 Jul 2020 16:31:03 GMT

For what it's worth, I've just raised it as a ticket. I'll report back when they respond.

Moderator's note by Mike (Mav): Full quote of preceding post removed as per Forum rules.

Re: Why have Plusnet blocked secure DNS?

7up — Mon, 20 Jul 2020 22:54:48 GMT

@kev51773 wrote:
When did we reach a stage where ISP's were actively working against security..

When everyone decided to ignore it rather that sign digital petitions because "everyone else will deal with it".

That's usually the case. We've seen it with Covid too but people who are part of the problem still can't accept it and ask why others have screwed it up.

Re: Why have Plusnet blocked secure DNS?

VileReynard — Mon, 20 Jul 2020 23:53:46 GMT

@kev51773 wrote:
When did we reach a stage where ISP's were actively working against security.

For a long time the politicians were happy logging IP addresses (like in the films), so when they found out about multiple web-sites sharing an IP address they got upset.

Control freakary and security considerations don't go together very well.

Actually, I blame uncritical acceptance of the Internet Watch Foundation (IWF) block filters - which successfully keeps child abuse material off of mainstream sites. However well-meaning it might be, it formed a proof of concept for capturing information at the web domain level.

Re: Why have Plusnet blocked secure DNS?

pv — Fri, 24 Jul 2020 12:50:02 GMT

I can't replicate this. I just did a package capture to prove I can resolve a query via DoT to 8.8.8.8.

Re: Why have Plusnet blocked secure DNS?

Swipe — Fri, 24 Jul 2020 14:10:27 GMT

@pv wrote:

I can't replicate this. I just did a package capture to prove I can resolve a query via DoT to 8.8.8.8.

As I mentioned in one of my earlier posts, this is not consistent across the Plusnet network. DoT still works fine on my mother's ADSL but not on my fibre connection at my house. So it looks like you are one on the unaffected ones and yet to pick up the changes. I'm looking for a pattern here, are you on ADSL or fibre? And when did your router last reboot or reconnect?

Re: Why have Plusnet blocked secure DNS?

pv — Fri, 24 Jul 2020 14:13:05 GMT

@Swipe wrote:

I'm looking for a pattern here, are you on ADSL or fibre? And when did your router last reboot or reconnect?

I'm on fibre and I restarted the PPP session just prior to the test.

Re: Why have Plusnet blocked secure DNS?

kev51773 — Fri, 24 Jul 2020 14:16:36 GMT

Strangely, I've just got home and seen this so I retested and it's working for me today too.

Re: Why have Plusnet blocked secure DNS?

Swipe — Fri, 24 Jul 2020 14:16:37 GMT

I only use DoT on my android phone. I don't suppose you have an android phone you can test 1dot1dot1dot1.cloudflare-dns.com on do you?