Re: DOH

["Liam O'Toole" <liam.p.otoole@gmail.com>]

On Mon, 13 Apr 2020 at 16:37, John Hasler <jhasler@newsguy.com> wrote:
>
> Liam writes:
> > I'm not familiar with bind. Does it work by consulting root name
> > servers directly?
>
> It starts with the root servers and builds a database in exactly the
> same way your ISP's DNS server does.  In fact, it is probably what your
> ISP uses.

I see.

I have two reservations about the approach advocated by Reco above.
Maybe I'm not seeing some part of the big picture.

1. The risk of DNS snooping is merely shifted from the ISP to the VPS provider.
2. Having completed a DNS lookup unbeknownst to the ISP, we still have
to make a connection to the resulting IP address through the ISP's
gateway. The ISP can perform a reverse DNS lookup of the IP address if
they are determined to snoop.

Of course, the above can be mitigated using tor or a VPN, but setting
up your personal bind instance doesn't achieve much on its own.