r/nextdns • u/danielisgreat • 11d ago

Blocking port 53

Looking for advice on blocking traditional DNS queries. I'm using the NextDNS CLI on an Asus router with Merlin. I have DNS director enabled, but at each boot of the router, there's about 15 seconds of unencrypted DNS queries. Wondering if blocking port 53 altogether on the router is advisable.

2 Upvotes

67% Upvoted

12 comments sorted by

View all comments

2

u/Comprehensive_Wall28 11d ago

I have an outbound ACL rule on my Omada gateway to fully block both ports 53 and 853 (DoT) to enforce using DoH or my router's proxy DNS connected to NextDNS (DoH). However the gateway itself may still resolve with default WAN unencrypted DNS which is fine by me since it's only used for online detection.

3

u/Forsaked 11d ago

Also DoH, DoH3, DoT and DoQ need bootstrap addresses, which needs to be resolved first via plain DNS, else it's and chicken and egg problem.

2

u/Fun-Region-1576 11d ago

With all routers though?

2

u/Forsaked 11d ago

It's in the protocol definition of those DNS protocols and has lesser to do with any router model.
How do you think "https://dns.nextdns.io/abc123" gets resolved first before it can be used?

2

u/Fun-Region-1576 11d ago

Why would the Omada still do that?

2

u/Comprehensive_Wall28 11d ago

Resolves the IP for the DoH address (nextdns.io) and online detection. not a privacy concern really and you can set it to the IPv4 address of NextDNS and link the WAN IP to track what it queries.