topic Re: “This network is blocking encrypted DNS traffic.” in Full Fibre

“This network is blocking encrypted DNS traffic.”

lucy5 — Thu, 04 Nov 2021 20:59:36 GMT

The above privacy warning has just appeared on my iPhone WiFi settings in reference to my Plusnet WiFi connection. It goes on to say that other devices can monitor and record websites and servers accessed by my device. Can anyone help? Thank you

Re: “This network is blocking encrypted DNS traffic.”

jab1 — Thu, 04 Nov 2021 21:06:37 GMT

Never seen that on either my iPhone or iPad. Can you possibly post a screenshot of the message?

Re: “This network is blocking encrypted DNS traffic.”

dvorak — Fri, 05 Nov 2021 08:46:43 GMT

It sounds like a scammy ad, I too have never seen that and Private Relay would give a different error (and you'd have had to switch that on purposefully).

As @jab1 says a screenshot would be helpful.

Re: “This network is blocking encrypted DNS traffic.”

Eremite — Tue, 09 Nov 2021 09:58:01 GMT

I have just started having the same message. I attach a screen shot.

Re: “This network is blocking encrypted DNS traffic.”

jab1 — Tue, 09 Nov 2021 10:08:44 GMT

I think I had that when I first upgraded to iOS 15 - re-reading it, it is nothing to worry about, as only other devices connected to YOUR network can monitor or record anything, and the chances of a rogue connecting to your network are remote.

Re: “This network is blocking encrypted DNS traffic.”

elvenheart — Wed, 10 Nov 2021 10:42:22 GMT

Hi, My son had this a few days back on his iphone. Checked and possibly we reconnected to wifi and all is working. I don't think it's anything serious. If all is working don't worry.

Re: “This network is blocking encrypted DNS traffic.”

jab1 — Wed, 10 Nov 2021 10:45:55 GMT

@elvenheart See my post above. It is absolutely nothing to worry about - just Apple covering themselves (probably for the litigious US market).

Re: “This network is blocking encrypted DNS traffic.”

MJN — Thu, 11 Nov 2021 23:18:23 GMT

@jab1 wrote:

I think I had that when I first upgraded to iOS 15 - re-reading it, it is nothing to worry about, as only other devices connected to YOUR network can monitor or record anything, and the chances of a rogue connecting to your network are remote.

No, it's more than that - it means that DNS queries are visible between the device and the recursive resolver, which would be Plusnet's DNS server by default. If you have an alternative resolver configured - such as Google, Cloudflare etc - then any blocking of encrypted DNS (whether that be by the router, the ISP etc) means that exposure window is increased. The potential for exposure is not limited to the local network, although I can see why you might think that given Apple's ambiguous wording.

@jab1 wrote:

@elvenheart See my post above. It is absolutely nothing to worry about - just Apple covering themselves (probably for the litigious US market).

The warning isn't for Apple's benefit, it is for users who might be concerned about DNS queries being sent for resolution unencrypted.

Re: “This network is blocking encrypted DNS traffic.”

jab1 — Fri, 12 Nov 2021 05:57:29 GMT

@MJN Thanks for the explanation, I admit to not being an expert in these matters, but for the vast majority of users, I think it is an overblown reaction. Feel free to correct me.😁

Re: “This network is blocking encrypted DNS traffic.”

Chokelever — Thu, 16 Dec 2021 14:59:33 GMT

I’m on iOS 14.7 and also get this message. I’m a new user to Plusnet. My broadband was only just activated yesterday (15/12) and this is the first time I’ve seen the privacy warning. It is somewhat worrying.

Re: “This network is blocking encrypted DNS traffic.”

TheMightyAJ — Thu, 16 Dec 2021 18:34:30 GMT

Hey @Chokelever,

Apologies for any concern this may have caused. This isn't anything to worry about and can be safely ignored

Re: “This network is blocking encrypted DNS traffic.”

bobpullen — Fri, 17 Dec 2021 00:54:32 GMT

@MJN wrote:

@jab1 wrote:

I think I had that when I first upgraded to iOS 15 - re-reading it, it is nothing to worry about, as only other devices connected to YOUR network can monitor or record anything, and the chances of a rogue connecting to your network are remote.

No, it's more than that - it means that DNS queries are visible between the device and the recursive resolver, which would be Plusnet's DNS server by default. If you have an alternative resolver configured - such as Google, Cloudflare etc - then any blocking of encrypted DNS (whether that be by the router, the ISP etc) means that exposure window is increased. The potential for exposure is not limited to the local network, although I can see why you might think that given Apple's ambiguous wording.

Assuming this to be the case, the wording isn't ambiguous, it's outright misleading. I know of no reason why a device cannot be configured to use DoT or DoH whilst connected to a Plusnet router/the Plusnet network

Re: “This network is blocking encrypted DNS traffic.”

MJN — Fri, 17 Dec 2021 08:28:26 GMT

@bobpullen wrote:

Assuming this to be the case, the wording isn't ambiguous, it's outright misleading. I know of no reason why a device cannot be configured to use DoT or DoH whilst connected to a Plusnet router/the Plusnet network

The issue is that the client's configured recursive resolver target needs to support DoT/DoH (ideally every hop in the chain does but the client can only observe the behaviour of the first hop) and, by default, this will be the router or Plusnet's DNS server hence the warning if they don't support it. The warning is only saying how things are, not how they could be if reconfigured.

Re: “This network is blocking encrypted DNS traffic.”

bobpullen — Fri, 17 Dec 2021 10:10:08 GMT

In which case it should say something akin to 'not currently configured to use...' or 'Your DNS traffic is currently unencrypted'.

'Blocking' implies exactly that. That we/the ISP are intentionally preventing the use of something, which is evidently not the case here.

The cynic in me does wonder whether or not the terminology is so aggressive as to push customers towards paid iCloud subscriptions/Private Relay

Re: “This network is blocking encrypted DNS traffic.”

jab1 — Fri, 17 Dec 2021 10:09:36 GMT

You could be on to something there with your 'cynic' assumption, @bobpullen , and unfortunately there could be many who might fall for it - most users wouldn't spot the obvious.

Re: “This network is blocking encrypted DNS traffic.”

Chokelever — Sat, 18 Dec 2021 14:25:38 GMT

Thanks. However, I’m still using the same router that was provided by BT. I didn’t get that message at the beginning of the week while I was still with them and neither did I get the message while using a Sky router at a different address yesterday. I’m still on iOS 14.7, so to my simple way of thinking this is all down to DNS used by Plusnet, which brings me to another question, but I’ll save that for a different thread.

Re: “This network is blocking encrypted DNS traffic.”

wakeman — Sat, 18 Dec 2021 14:46:32 GMT

Can I suggest if you are still on iOS 14.7 which is rather old now, you at least upgrade to 14.8 as this will have had a number of security updates and might well fix this issue. My iPhone, and iPad which used to be on 14.8 never had the issue, now moved to 15

Re: “This network is blocking encrypted DNS traffic.”

bobpullen — Sat, 18 Dec 2021 21:36:23 GMT

@Chokelever I've had a thought. What DNS server addresses is your router actually configured to use? Do they start 212 or 213?

Re: “This network is blocking encrypted DNS traffic.”

Chokelever — Sun, 19 Dec 2021 01:33:10 GMT

@bobpullen 212. Are you thinking that the Safeguard DNS starting 213, might not have the issue? I’d prefer to use 1.1.1.1 or 8.8.8.8, but I’m no longer able to set my own DNS server since switching to Plusnet.

Re: “This network is blocking encrypted DNS traffic.”

bobpullen — Sun, 19 Dec 2021 01:35:01 GMT

@Chokelever wrote:

@bobpullen 212. Are you thinking that the Safeguard DNS starting 213, might not have the issue?

Complete opposite.