DoH/DoT Control

Navigation: DNS Security → DoH/DoT Control

DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) encrypt DNS so a port-53 inspector never sees the queried name. Endpoints (browsers, OS resolvers, apps) can then bypass TOORCE DNS policies. This page describes how TOORCE detects and blocks unauthorized encrypted DNS so clients stay on the inspected path.

Why this matters

If a laptop uses a public DoH resolver, Threat Intelligence, DNS Filtering, Anti-Tunneling, and Anti-DGA never see the query. The rest of the firewall still sees IP connections, but name-based policy is gone.

Protocol	Typical destination	Bypass risk
Classic DNS	UDP/TCP 53	Inspected when TOORCE is resolver or intercepts
DoT	TCP 853	Encrypted; names hidden
DoH	HTTPS (TCP 443) to a DoH provider	Encrypted; looks like normal web traffic

What TOORCE controls

Control	Effect
Detect unauthorized DoH	Identify known DoH provider destinations and DoH-like resolvers
Detect unauthorized DoT	Identify TLS on port 853 and known DoT resolvers
Block bypass	Deny those sessions so the client falls back to local / TOORCE DNS
Allow authorized resolvers	Exception list for an approved enterprise DoH/DoT endpoint (if you operate one)

TOORCE is the authorized DNS path. Everything else is treated as bypass unless you add it to the allow-list.

Recommended policy

Setting	Recommended	Notes
Block DoT (TCP 853) to the internet	On	Clients should not use public DoT
Block known public DoH destinations	On	Browsers often ship a DoH provider list
Force DHCP DNS to TOORCE or AD→TOORCE	On	See Architecture
Disable DoH on managed browsers / OS	Endpoint policy	Complements the firewall block
Approved enterprise DoH/DoT	Allow-list only	Only if you run your own encrypted resolver behind TOORCE policy

Typical log

{
  "src_ip": "192.168.1.62",
  "domain": "dns.example-doh-provider.net",
  "qtype": "A",
  "dnssec": "unsigned",
  "category": "dns-bypass",
  "reputation": "suspicious",
  "action": "block",
  "reason": "Unauthorized DoH resolver"
}

Combined with inline rules

Use Inline Rules so LAN clients cannot open raw DNS or DoT to the WAN:

Priority	Rule	Action
1	LAN → TOORCE DNS (UDP/TCP 53)	Allow
2	LAN → WAN TCP 853	Deny + log
3	LAN → WAN UDP/TCP 53 (any other resolver)	Deny + log (unless transparent intercept is intentional)