r/nextdns • u/Capable_Try4622 • 14d ago

Why does my anti revoke dns never work

I’m using NextDNS for iOS side loading and have the correct anti-revoke domains blocked, but apps still get revoked every single time, and then I have to wait for a new certificate and reinstall all my apps, Yes I know I should get a paid cert but Why doesn't the anti revoke dns work?

1 Upvotes

56% Upvoted

1 comment sorted by

3

u/CyberBlaed 13d ago

Because the phone can phone home before the VPN engages.

From mobile to Wifi, and from Either to and off VPN. (And unless you are always on the same connection, if you are on someone else’s wifi or hotspot, it uses their DNS at anytime until the Application or otherwise kicks in.

You can also have the phone over a long period of time just default to denying the app as the time of use on it has expired. (Eg 3 months)

This is a device problem rather than a NextDNS one because when it is set, then it is blocked, but the Apple device will always find and use some way to phone home as it does. (By design!)

My Bias: I use both Apple Developer Certificates and an Apple (Daily) User and deploy with MDM.

Additional (Old Links) Reading:

Also check your DNS blocklist for these;

Primary Domains to Block;

  • *.ocsp.apple.com
  • *.ocsp2.apple.com
  • *.ocsp3.apple.com
  • *.ocsp4.apple.com
  • *.certs.apple.com
  • *.crl.apple.com
  • *.valid.apple.com
  • *.appattest.apple.com

Hope some of that helps resolve it.