Block network when DoT is not available?

census5280

Heyo there,

Recently I've been wondering about how to limit connection requests to Google when using sandboxed google play in my main profile. The best solution I have come up with is just using a private DNS resolver such as NextDNS or Adguard (I use the latter)

Almost no requests are made with hardcoded IP's (at least on my device, which includes whatsapp, snapchat and waze). I have verified this by using RethinkDNS, which also shows hardcoded network requests to certain IPs.

Becouse of this, it is easy to use a DNS-level blocking tool. My blocklist blocks all googleapis.com and pa.googleapis.com subdomains. This makes sure no new domains are allowed default. My blocklist causes no breakage from notifications (mtalk.google.com) and downloads from the play store.

Now finally to my question: Is it possible to block network access when the private DNS option can't connect? This way we can be sure that no traffic leaks. Thanks and sorry for the big writeup.

ignoramous

rdns dev here

census5280 Almost no requests are made with hardcoded IP's (at least on my device, which includes whatsapp, snapchat and waze).

WhatsApp does fallback on hard-coded IPs. I see it do so multiple times a week on my Android. That's just one of their connectivity-at-all-cost measures. One of the early Whatsapp employees confirmed as much on HN (thread).

census5280 Is it possible to block network access when the private DNS option can't connect?

If Private DNS cannot be connected to, on Android R+, the OS should put up a notification as after that point, it'll drop all DNS queries sent to it.

If you mean, you want to block connections from any app that may be bypassing Private DNS (for instance, by using its own DNS-over-HTTPS layer like Telegram does; or hard-code IPs like Instagram & WhatsApp do), then there isn't a way to do so (out of the box) today. But: If you use Rethink, you can turn ON Configure -> Firewall -> Universal firewall rules -> Block when DNS is bypassed to achieve this (though, you'll have to use the DNS server set in Configure -> DNS and disable Private DNS for Rethink to effectively apply that block rule).