Why have Plusnet blocked secure DNS?

[#1]

Can't use DNS over TLS using either google.com or 1dot1dot1dot1.cloudflare-dns.com. This worked as recently as last week and still works fine anywhere else so long as I'm not connected via Plusnet as soon as I'm connected via Plusnet, at at home or at a relative's house, it doesn't work.
I'd really prefer not to have my security choices dictated to me.

[#2]

DNS over TLS (Private DNS) on Android suddenly stopped working overnight when connected via WiFi. This works fine when connected using Mobile data on the 3 network. Has something been changed or blocked at the Plusnet ISP level? I have confirmed this using both Cloudflare and NextDNS. I rebooted my router to rule that out. Please can someone else try setting up private DNS on Android 9 or higher using 1dot1dot1dot1.cloudflare-dns.com to confirm this is a widespread issue?

[#3]

Just tested it at my mother's house on her Plusnet ADSL, connected via WiFi and it works. I'll raise a ticket

[#4]

I also posted about this yesterday in the forums and no one replied. One slight oddity in my case is that it does still work on my mother's Plusnet ADSL but not on my fibre connection. Maybe she has yet to pick up the new policies? I see no reason for them blocking it at all if DNS over HTTPS is still allowed. Why just punish DNS over TLS? I'm hoping it's an error that will be reversed.

[#5]

Presumably it gets blocked because Plusnet can't tell which https web sites you are visiting, other than via your DNS requests?

BTW I have a longstanding setting for Firefox:-

Note that I allow my router to have their rubbish settings.

[#6]

Your post is not really relevant to the thread which is, why has DNS over TLS been blocked

[#7]

---

@Swipe wrote:
Your post is not really relevant to the thread which is, why has DNS over TLS been blocked

---

@VileReynard 's first sentence answered your question - presumably because plusnet can't see what sites you're visiting.

The rest of his reply is a bit irrelevent yes, however the first sentence said it all. 

[#8]

But they also couldn't see it if I used DNS over HTTPS, or even just used a VPN.

It would be nice if someone from Plusnet would chime in with a response.

[#9]

---

@VileReynard wrote:

Presumably it gets blocked because Plusnet can't tell which https web sites you are visiting, other than via your DNS requests?

---

But why would PN want to know that? Other than routing, obv.

[#10]

As pointed out by@Swipe , my response was not relevant to this topic.

However, Plusnet are required to record all web sites visited by you:-

See https://www.ispreview.co.uk/index.php/2018/04/high-court-rules-uk-isp-internet-snooping-law-is-unlaw... 

or https://en.wikipedia.org/wiki/Data_retention#United_Kingdom 

On the original topic:-

There is a difference between DNS over TLS and DNS over HTTPS.

DNS over TLS uses its own port and so can be blocked or firewalled by servers [or Plusnet]. DNS over HTTPS just uses the standard https port.

https://www.cloudflare.com/learning/dns/dns-over-tls/ 

[#11]

---

@kev51773 wrote:
But they also couldn't see it if I used DNS over HTTPS, or even just used a VPN.

It would be nice if someone from Plusnet would chime in with a response.

---

If they blocked https most of the internet would studdenly stop working for plusnet users - everything from webmail to paypal (and other payment websites).

HTTPS cannot be blocked for that very reason - and as it's encrypted, plusnet can't filter out the dns requests to block them.

VPN is also not easy to block - many employers use VPN connections to let their staff access the corporate network remotely eg from home. Infact you could argue that a VPN works in a very similar way to an ISP (and thus should log all traffic).

DNS that is unencrypted is not really blockable either - by corporate firewalls at least. That's how some people manage to use VPNs to escape work - the vpn using dns requests to a vpn server which sends back data in the reply - that data being the vpn packets instead of actual dns query replies.

As for plusnet replying, that's just not going to happen. They don't like admitting to negativity or restricting their customers abilities online.

[#12]

When did we reach a stage where ISP's were actively working against security.

I get that they are required to keep a list of sites visited. Or at least they are required to attempt to keep a record (since there are myriad ways are avoiding there tracking which cannot be prevented). What they're doing here is the equivalent of banning people from locking there doors in case the police want to pop in for a random unannounced visit.
Works great for the police.... Or for anyone else.

Sadly, that's another ISP on the blacklist. Roll on end of contract.

[#13]

For what it's worth, I've just raised it as a ticket. I'll report back when they respond.

Moderator's note by Mike (Mav): Full quote of preceding post removed as per Forum rules.

[#14]

---

@kev51773 wrote:
When did we reach a stage where ISP's were actively working against security..

---

When everyone decided to ignore it rather that sign digital petitions because "everyone else will deal with it".

That's usually the case. We've seen it with Covid too but people who are part of the problem still can't accept it and ask why others have screwed it up.

[#15]

---

@kev51773 wrote:
When did we reach a stage where ISP's were actively working against security.

---

For a long time the politicians were happy logging IP addresses (like in the films), so when they found out about multiple web-sites sharing an IP address they got upset.

Control freakary and security considerations don't go together very well.

Actually, I blame uncritical acceptance of the Internet Watch Foundation (IWF) block filters - which successfully keeps child abuse material off of mainstream sites. However well-meaning it might be, it formed a proof of concept for capturing information at the web domain level.