As to me I'm running my own DNS resolver (I use unbound) and everything goes through port 53 UDP (and AIUI technically 53 TCP should be allowed, but nothing will happen if you just block it), unencrypted. What then unbound does on the Internet, that's up to you: you can encrypt those requests...
The nice thing with everything being in the clear, is that you can null route / NX DOMAIN every single domain that uses Unicode (punnycode) characters and you can even do that at the firewall level, by inspecting UDP packets.
Of course you gotta be sure to really block DoH / DoT internally but it's all doable.
I set that up years ago and I've been running like that since then without any issue.
Just as entire countries's IP blocks do not exist in my world, domains using Unicode characters do not exist. And I really don't care about your feelings about it: I'm just explaining that technically it can be done to block them all and that the Internet keeps working just fine.
Unicode really is just too complex to ever be secure. And those who don't understand that are part of the problem.
https://www.schneier.com/crypto-gram/archives/2000/0715.html...
"Unicode is just too complex to eve be secure"
As to me I'm running my own DNS resolver (I use unbound) and everything goes through port 53 UDP (and AIUI technically 53 TCP should be allowed, but nothing will happen if you just block it), unencrypted. What then unbound does on the Internet, that's up to you: you can encrypt those requests...
The nice thing with everything being in the clear, is that you can null route / NX DOMAIN every single domain that uses Unicode (punnycode) characters and you can even do that at the firewall level, by inspecting UDP packets.
Of course you gotta be sure to really block DoH / DoT internally but it's all doable.
I set that up years ago and I've been running like that since then without any issue.
Just as entire countries's IP blocks do not exist in my world, domains using Unicode characters do not exist. And I really don't care about your feelings about it: I'm just explaining that technically it can be done to block them all and that the Internet keeps working just fine.
Unicode really is just too complex to ever be secure. And those who don't understand that are part of the problem.