Network › Module 7 › Lesson 3
DoH and Resolver Hygiene
Who you ask, and whether the ask is encrypted — hygiene on THIS host, not a war on public DNS.
Visual · doh_resolver_hygiene
Resolver hygiene: which servers THIS host uses, and DoH as encrypted ask.
Opening
DoH is not a personality. It is “the DNS question travels inside HTTPS to a resolver you chose.”
Plain DNS on the LAN is often visible to whoever sits on the path. DNS-over-HTTPS (DoH) and DNS-over-TLS wrap the question. They do not magically make the answer honest — they change who can eavesdrop on the question and which policy box you opted into. Hygiene is: know THIS host's servers, prefer authentic resolvers you meant to use, and do not outsource trust to a café's “helpful” DNS. Original Cyberlium.
1. Plain UDP/53 vs a TLS-wrapped question
Classic stub queries are often cleartext. A path observer can see names you asked. DoH puts those questions inside HTTPS to a resolver URL. DoT uses TLS on a DNS port. Both are transport choices. Neither repairs a resolver that returns a malicious IP.
Browser DoH can bypass the OS stub. That is a feature when the OS inherited a liar via DHCP on a network you do not trust. It is a surprise when enterprise policy expected the OS stub. Record which layer YOU are using.
Command guide
Plain UDP/53 vs a TLS-wrapped question
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in
macOS: Built-in
Windows: Built-in
═══ COMMANDS ═══
Command — copy this
nslookup -type=NS example.com || powershell.exe -NoProfile -Command "Resolve-DnsName example.com -Type NS"
2. Print the servers THIS host already has
Get-DnsClientServerAddress on Windows, or resolv.conf / systemd-resolve on Linux, shows who you currently ask. That list is the hygiene starting point. Changing it belongs on systems you administer, with a rollback, not on a hotel DHCP “experiment.”
If heading 1 STOPPED you at Router Admin, you do not “fix DNS” by logging into that gateway for this course.
Command guide
Print the servers THIS host already has
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
powershell.exe -NoProfile -Command "Get-DnsClientServerAddress | Select-Object InterfaceAlias,AddressFamily,ServerAddresses | Format-List"
resolvectl status | head -n 40 || cat /etc/resolv.conf
python3 -c "print('DoH hides the question from on-path sniffers; a lying DoH resolver still lies')"3. Hygiene rules that fit a laptop you own
Prefer resolvers you can name. Be suspicious of surprise DNS handed out on untrusted networks. Do not run an open recursive resolver bound to 0.0.0.0 as a “lab.” Do not flood 1.1.1.1 or 8.8.8.8 to “test anycast.”
Loopback teaching stays Name pinning for the lab stays on hosts-practice or curl --resolve.
4. What you ship: an inventory of THIS host's resolvers plus a DoH sentence
List DNS servers THIS OS uses. Write: DoH encrypts the question; honesty still depends on who answers. No open bind. No public-DNS flood. DEMO GATE still stands.
5. What you record before the next lesson
Resolver inventory. DoH vs honesty. DEMO identified/STOP. SAFE NEVER spoof others, NEVER 0.0.0.0 recursive. File t11-m07-l03-doh-hygiene.txt.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
Stand up bind on 0.0.0.0 “to learn DNS.” hping3 a public resolver. Push DHCP DNS to guests without telling them.
Right
Inventory YOUR servers. Write the DoH sentence. Next: Lab — Local Name to Loopback.
Mission: inventory YOUR resolver path
1) / STOP if router. 2) Print THIS host's DNS servers. 3) Write one DoH sentence (encrypted question ≠ honest answer). Do not flood public DNS. Do not bind 0.0.0.0.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor where Windows 11 shows DoH — not how to hijack the café's DHCP DNS option.
Knowledge Check
APPLY: DoH is best described as:
Multiple choice
Knowledge Check
APPLY: True or False: Binding a recursive DNS server to 0.0.0.0 is an acceptable Cyberlium lab default.
True or False
Knowledge Check
APPLY: Café DHCP hands you a DNS IP you never chose. Hygiene move on a laptop YOU own?
Multiple choice