Option to drop responses without EDNS(0)

[wangziyao318]

Prerequisites

• [X] I have checked the Wiki and Discussions and found no answer

• [X] I have searched other issues and found no duplicates

• [X] I want to request a feature or enhancement and not ask a question

Description

https://github.com/IrineSistiana/udpme

This is NOT my work.

I found it very useful in preventing DNS hijack by using EDNS0, achieving the same effect of DoH/DoT/DoQ while preserving the low latency of UDP. Also, this project is written in go and based on github.com/miekg/dns, making it easier to integrate.

[fernvenue]

Seems duplicate of https://github.com/AdguardTeam/AdGuardHome/issues/4965.

[ainar-g]

I'm not exactly sure, what that is. AdGuard Home already has support for EDNS(0) Client Subnet, but this seems to be something else?

[wangziyao318]

You mean this one in WebUI, or some extra configuration in AdGuardHome.yaml?

[fernvenue]

Hi @ainar-g, it seems that it is based on EDNS(0), but it will drop all responses that don't have EDNS(0).

By the way, @wangziyao318 said that it's helpful to preventing DNS hijack, is there any evidence of this?

[wangziyao318]

Yes, I'm in China and I've tested it.

[ainar-g]

Ah, I see, thanks.

[wangziyao318]

Seems that the Chinese operator's DNS hijack response doesn't contain the EDNS0 field.

1. The DNS hijack response

2. The correct response