QUOTE(kwss @ Aug 10 2024, 03:14 AM)
Sorry people I misunderstand the documentation. The following statements is not true. I'm Lulu.
TM deployed kill switch for Firefox DoH and Apple Private Relay
Mozilla and Apple has a DNS controlled kill switch that allows organization to prevent their usage. This is so that whatever DPI or DLP system will function properly.
Mozilla kill switch:
use-application-dns.net
Apple Private Relay kill switch:
mask.icloud.com
mask-h2.icloud.com
Firefox DoH kill switch is enabled:
CODE
dig use-application-dns.net @1.9.1.9
; <<>> DiG 9.18.28 <<>> use-application-dns.net @1.9.1.9
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21955
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;use-application-dns.net. IN A
;; ANSWER SECTION:
use-application-dns.net. 70 IN A 35.190.14.201
;; Query time: 15 msec
;; SERVER: 1.9.1.9#53(1.9.1.9) (UDP)
;; WHEN: Sat Aug 10 03:04:46 +08 2024
;; MSG SIZE rcvd: 68
Both Apple Private Relay kill switches are enabled:
CODE
dig mask.icloud.com @1.9.1.9
; <<>> DiG 9.18.28 <<>> mask.icloud.com @1.9.1.9
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32464
;; flags: qr rd ra; QUERY: 1, ANSWER: 7, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;mask.icloud.com. IN A
;; ANSWER SECTION:
mask.icloud.com. 42078 IN CNAME mask.apple-dns.net.
mask.apple-dns.net. 33 IN A 104.30.128.79
mask.apple-dns.net. 33 IN A 104.30.128.76
mask.apple-dns.net. 33 IN A 104.30.128.78
mask.apple-dns.net. 33 IN A 104.30.128.77
mask.apple-dns.net. 33 IN A 104.30.128.74
mask.apple-dns.net. 33 IN A 104.30.128.75
;; Query time: 15 msec
;; SERVER: 1.9.1.9#53(1.9.1.9) (UDP)
;; WHEN: Sat Aug 10 03:05:24 +08 2024
;; MSG SIZE rcvd: 172
CODE
dig mask-h2.icloud.com @1.9.1.9
; <<>> DiG 9.18.28 <<>> mask-h2.icloud.com @1.9.1.9
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59548
;; flags: qr rd ra; QUERY: 1, ANSWER: 7, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;mask-h2.icloud.com. IN A
;; ANSWER SECTION:
mask-h2.icloud.com. 734 IN CNAME mask.apple-dns.net.
mask.apple-dns.net. 34 IN A 104.30.128.75
mask.apple-dns.net. 34 IN A 104.30.128.77
mask.apple-dns.net. 34 IN A 104.30.128.79
mask.apple-dns.net. 34 IN A 104.30.128.78
mask.apple-dns.net. 34 IN A 104.30.128.76
mask.apple-dns.net. 34 IN A 104.30.128.74
;; Query time: 19 msec
;; SERVER: 1.9.1.9#53(1.9.1.9) (UDP)
;; WHEN: Sat Aug 10 03:05:38 +08 2024
;; MSG SIZE rcvd: 175
the mozilla killswitch only prevents automatic doh for happening (eg, default doh is on auto from fresh install of the browser)
if you manually configure doh in settings, firefox will ignore that dns request's results
as for apple icloud, it seems like it will warn the user... based on
https://developer.apple.com/icloud/prepare-...-private-relay/Also, as you realized, those respond with something, so, no, it's not actually blocked, if NXDOMAIN, yes then it's blocked
This post has been edited by PRSXFENG: Aug 10 2024, 08:53 AM