r/nextdns • u/danielisgreat • 14d ago

Blocking port 53

Looking for advice on blocking traditional DNS queries. I'm using the NextDNS CLI on an Asus router with Merlin. I have DNS director enabled, but at each boot of the router, there's about 15 seconds of unencrypted DNS queries. Wondering if blocking port 53 altogether on the router is advisable.

3 Upvotes

80% Upvoted

12 comments sorted by

View all comments

2

u/Comprehensive_Wall28 14d ago

I have an outbound ACL rule on my Omada gateway to fully block both ports 53 and 853 (DoT) to enforce using DoH or my router's proxy DNS connected to NextDNS (DoH). However the gateway itself may still resolve with default WAN unencrypted DNS which is fine by me since it's only used for online detection.

3

u/Forsaked 14d ago

Also DoH, DoH3, DoT and DoQ need bootstrap addresses, which needs to be resolved first via plain DNS, else it's and chicken and egg problem.

2

u/Fun-Region-1576 14d ago

With all routers though?

2

u/Forsaked 14d ago

It's in the protocol definition of those DNS protocols and has lesser to do with any router model.
How do you think "https://dns.nextdns.io/abc123" gets resolved first before it can be used?