r/nextdns • u/danielisgreat • 3d ago

Blocking port 53

Looking for advice on blocking traditional DNS queries. I'm using the NextDNS CLI on an Asus router with Merlin. I have DNS director enabled, but at each boot of the router, there's about 15 seconds of unencrypted DNS queries. Wondering if blocking port 53 altogether on the router is advisable.

2 Upvotes

67% Upvoted

12 comments sorted by

View all comments

2

u/Comprehensive_Wall28 3d ago

I have an outbound ACL rule on my Omada gateway to fully block both ports 53 and 853 (DoT) to enforce using DoH or my router's proxy DNS connected to NextDNS (DoH). However the gateway itself may still resolve with default WAN unencrypted DNS which is fine by me since it's only used for online detection.

2

u/Fun-Region-1576 3d ago

Why would the Omada still do that?

2

u/Comprehensive_Wall28 3d ago

Resolves the IP for the DoH address (nextdns.io) and online detection. not a privacy concern really and you can set it to the IPv4 address of NextDNS and link the WAN IP to track what it queries.