Network › Module 7 › Lesson 3
DoH and Resolver Hygiene
Who you ask, and whether the ask is encrypted — hygiene on THIS host, not a war on public DNS.
Visual · doh_resolver_hygiene
Resolver hygiene: which servers THIS host uses, and DoH as encrypted ask.
Opening
DoH is not a personality. It is “the DNS question travels inside HTTPS to a resolver you chose.”
Plain DNS on the LAN is often visible to whoever sits on the path. DNS-over-HTTPS (DoH) and DNS-over-TLS wrap the question. They do not magically make the answer honest — they change who can eavesdrop on the question and which policy box you opted into. Hygiene is: know THIS host's servers, prefer authentic resolvers you meant to use, and do not outsource trust to a café's “helpful” DNS. Original Cyberlium.
1. Plain UDP/53 vs a TLS-wrapped question
Classic stub queries are often cleartext. A path observer can see names you asked. DoH puts those questions inside HTTPS to a resolver URL. DoT uses TLS on a DNS port. Both are transport choices. Neither repairs a resolver that returns a malicious IP.
Browser DoH can bypass the OS stub. That is a feature when the OS inherited a liar via DHCP on a network you do not trust. It is a surprise when enterprise policy expected the OS stub. Record which layer YOU are using.
Command guide
Plain UDP/53 vs a TLS-wrapped question
═══ LINUX / BASH (Network & Reconnaissance Audit) ═══
Scan target host for open ports and service version signatures
Command — copy this
nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}DNS and WHOIS reconnaissance on authorized domain
Command — copy this
dig +short A target.local dig +short MX target.local whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6
Inspect HTTP headers for technology stack fingerprinting
Command — copy this
curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"2. Print the servers THIS host already has
Get-DnsClientServerAddress on Windows, or resolv.conf / systemd-resolve on Linux, shows who you currently ask. That list is the hygiene starting point. Changing it belongs on systems you administer, with a rollback, not on a hotel DHCP “experiment.”
If heading 1 STOPPED you at Router Admin, you do not “fix DNS” by logging into that gateway for this course.
Command guide
Print the servers THIS host already has
═══ LINUX / BASH (Network & Reconnaissance Audit) ═══
Scan target host for open ports and service version signatures
Command — copy this
nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}DNS and WHOIS reconnaissance on authorized domain
Command — copy this
dig +short A target.local dig +short MX target.local whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6
Inspect HTTP headers for technology stack fingerprinting
Command — copy this
curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"3. Hygiene rules that fit a laptop you own
Prefer resolvers you can name. Be suspicious of surprise DNS handed out on untrusted networks. Do not run an open recursive resolver bound to 0.0.0.0 as a “lab.” Do not flood 1.1.1.1 or 8.8.8.8 to “test anycast.”
Loopback teaching stays Name pinning for the lab stays on hosts-practice or curl --resolve.
4. What you ship: an inventory of THIS host's resolvers plus a DoH sentence
List DNS servers THIS OS uses. Write: DoH encrypts the question; honesty still depends on who answers. No open bind. No public-DNS flood. DEMO GATE still stands.
5. What you record before the next lesson
Resolver inventory. DoH vs honesty. DEMO identified/STOP. SAFE NEVER spoof others, NEVER 0.0.0.0 recursive. File t11-m07-l03-doh-hygiene.txt.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
Stand up bind on 0.0.0.0 “to learn DNS.” hping3 a public resolver. Push DHCP DNS to guests without telling them.
Right
Inventory YOUR servers. Write the DoH sentence. Next: Lab — Local Name to Loopback.
Mission: inventory YOUR resolver path
1) / STOP if router. 2) Print THIS host's DNS servers. 3) Write one DoH sentence (encrypted question ≠ honest answer). Do not flood public DNS. Do not bind 0.0.0.0.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor where Windows 11 shows DoH — not how to hijack the café's DHCP DNS option.
Knowledge Check
APPLY: DoH is best described as:
Multiple choice
Knowledge Check
APPLY: True or False: Binding a recursive DNS server to 0.0.0.0 is an acceptable Cyberlium lab default.
True or False
Knowledge Check
APPLY: Café DHCP hands you a DNS IP you never chose. Hygiene move on a laptop YOU own?
Multiple choice