Nick Cine wrote:

> All that's needed is a domain name for an ad-blocking DNS host.

https://www.xda-developers.com/block-ads-on-android/
https://techviral.net/block-ads-on-android-using-private-dns/
https://techviralab.pages.dev/posts/how-to-block-ads-on-android-using-private-dns-in-2022/
https://www.zdnet.com/article/how-to-turn-on-private-dns-mode-on-android-and-why-you-should/

dns.adguard.com
one.one.one.one
1dot1dot1dot1.cloudflare-dns.com

After setting the private DNS hostname in your Android settings,
Open the Google Chrome browser.
On the URL bar, enter 'Chrome://flags' and hit Enter.
Now search for 'DNS' and disable the 'Async DNS' option.
Now enter 'chrome://net-internals/#dns' in the URL bar and hit enter.
Select the DNS tab and tap on the Clear Cache option.

Bill Powell wrote:

>What DNS server should I set that Android setting to for ad removal?

dns.adguard.com

-jw-

--

And now for something completely different...

Nick Cine <nickcine@is.invalid> wrote:

> On Fri, 1 Mar 2024 19:18:51 -0600, VanguardLH wrote:
>
>> 3. Enter dns.google as the hostname of the DNS provider.
>> ... you can't figure out that's the step
>> where you enter *whatever* DNS server you want to use?
>
> Well, "dns.google" doesn't work - but it *definitely* wants a hostname.
> But even so, that's just the name for 8.8.8.8 which isn't an ad blocker.
>
> ping dns.google
>
> Pinging dns.google [8.8.8.8] with 32 bytes of data:
> Reply from 8.8.8.8: bytes=32 time=15ms TTL=115
> Reply from 8.8.8.8: bytes=32 time=26ms TTL=115
> Reply from 8.8.8.8: bytes=32 time=22ms TTL=115
> Reply from 8.8.8.8: bytes=32 time=71ms TTL=115
>
> Android13: Settings > Connections > More connection settings > Private DNS
> Private DNS Provider Hostname = Enter hostname of DNS provider
>
> Notice that it specifically asks for a hostname & not an IP address.
>
> Looking here https://adguard-dns.io/en/public-dns.html for a hostname,
> I see it's providing IP addresses, not hostnames, for the ad blocking.
> 94.140.14.14 & 94.140.15.15
>
> You'd think it would take an IP address, even though it's not a hostname.
> But the Android 13 "Save" button is grayed out unless you use alphabetics.
>
> The only thing you can put there is a domain name.
> All that's needed is a domain name for an ad-blocking DNS host.

Odd that a hostname gets entered, because a computer can't use that.
Needs an IP address. Seems some other DNS gets used to get the IP
address of the wanted DNS server. If it demands a hostname, use that.
Google (dns.google) doesn't do any filtering. Adguard DNS does, so use
Adguard's DNS server.

https://adguard-dns.io/en/public-dns.html
https://adguard-dns.io/en/support/configure_on_device.html

Whether you use their assist app or not is up to you. I can't find
specific info on the app to determine if it assists with DNS, like
sending your current IP address to your Adguard account (if you have
one), or if it is just their adblocker app. Possibly their app makes
the setup easy instead of you having to drill through the Android
settings.

https://adguard.com/en/adguard-android/overview.html
"Block throughout the whole system. This includes video ads and ads in
your favorite apps, ..."

I've not used it to see if it changes the Android DNS settings, but then
I'm not at Android 9, or later, (still back on Android 8) where the
private DNS setting becomes available.

What is suspicious is they say "Try AdGuard ad blocker for Android apps
for free". "Try for free" usually means trialware, and you end up
paying for the app if you keep it. Also, this is not the same Adguard
app at the play store:

https://play.google.com/store/apps/details?id=com.adguard.android.contentblocker

Adguard's page above has you download an .apk file. This is an offline
installation, not through the Google Play Store, so you have to
configure your Android phone to allow non-store apps.

> And then there are apps which say they have no ads, but which have them.
> https://play.google.com/store/apps/details?id=com.quantum.updater

I use the Android Private DNS feature. I didn't see any ads on any of
the app's screens. I only found a blank gray strip at the bottom that
blended in with the rest of the gray/orange/white interface.

> What DNS server should I set that Android setting to for ad removal?

dns.adguard-dns.com (adguard's latest public DNS server URL)
dns.alternate-dns.com (blocked a site that adguard didn't catch)

On Sat, 2 Mar 2024 15:50:53 -0600, kelown wrote:

>> What DNS server should I set that Android setting to for ad removal?
>
> dns.adguard-dns.com (adguard's latest public DNS server URL)
> dns.alternate-dns.com (blocked a site that adguard didn't catch)

I've got most of the ad blocking problem solved in a few apps I tested.
But I'm still confused how private DNS works.

I tried dns.adguard-dns.com & dns.alternate-dns.com and they didn't work.
So I almost gave up on Private DNS.

Even though it's so simple.
All you do is type in a hostname into the native Android field for it.

But then I went down the list of private DNS hostnames, one by one.
And "p2.freedns.controld.com" won me over!

Obviously I never heard of "controlD.com" but it was the cat's meow.
Why?

I don't know why.
But while "dns.adguard-dns.com" failed me, "p2.freedns.controld.com" won me
over.

It removed EVERY ad from the problematic app updater with ads.
But it did not remove every ad in every app with ads that I tested.

But "p2.freedns.controld.com" was simple enough to type.
And it worked simple enough for *many* ads (not all, but many).

How does this private DNS stuff work to get rid of the obnoxious ads?

On Sat, 2 Mar 2024 15:04:02 +0530, Indira wrote:

> After setting the private DNS hostname in your Android settings,
> Open the Google Chrome browser.
> On the URL bar, enter 'Chrome://flags' and hit Enter.
> Now search for 'DNS' and disable the 'Async DNS' option.
> Now enter 'chrome://net-internals/#dns' in the URL bar and hit enter.
> Select the DNS tab and tap on the Clear Cache option.

Who knew the Chromium web browser uses it's own DNS server setting.
Not me.

Sheesh.

Why?

On Sat, 2 Mar 2024 12:19:17 -0600, VanguardLH wrote:

>> The only thing you can put there is a domain name.
>> All that's needed is a domain name for an ad-blocking DNS host.
>
> Odd that a hostname gets entered, because a computer can't use that.
> Needs an IP address. Seems some other DNS gets used to get the IP
> address of the wanted DNS server. If it demands a hostname, use that.
> Google (dns.google) doesn't do any filtering. Adguard DNS does, so use
> Adguard's DNS server.
>
> https://adguard-dns.io/en/public-dns.html
> https://adguard-dns.io/en/support/configure_on_device.html
>
> Whether you use their assist app or not is up to you. I can't find
> specific info on the app to determine if it assists with DNS, like
> sending your current IP address to your Adguard account (if you have
> one), or if it is just their adblocker app. Possibly their app makes
> the setup easy instead of you having to drill through the Android
> settings.
>
> https://adguard.com/en/adguard-android/overview.html
> "Block throughout the whole system. This includes video ads and ads in
> your favorite apps, ..."
>
> I've not used it to see if it changes the Android DNS settings, but then
> I'm not at Android 9, or later, (still back on Android 8) where the
> private DNS setting becomes available.
>
> What is suspicious is they say "Try AdGuard ad blocker for Android apps
> for free". "Try for free" usually means trialware, and you end up
> paying for the app if you keep it. Also, this is not the same Adguard
> app at the play store:
>
> https://play.google.com/store/apps/details?id=com.adguard.android.contentblocker
>
> Adguard's page above has you download an .apk file. This is an offline
> installation, not through the Google Play Store, so you have to
> configure your Android phone to allow non-store apps.

It's a very odd behavior that something called "DNS" uses a hostname.
I'd have thought, as you had thought, it would use an IP address.

But I tried it.
You can't enter a numeric IP address into the Private DNS field.
Android won't let you.

Android insists on an alphabetic (or at least alphanumeric) hostname.
All the articles say the same thing, so that's odd - but it's what it is.

I have NO IDEA how it "finds" the IP address of that hostname.
Do you?

Nick Cine <nickcine@is.invalid> wrote:

> On Sat, 2 Mar 2024 12:19:17 -0600, VanguardLH wrote:
>
>>> The only thing you can put there is a domain name.
>>> All that's needed is a domain name for an ad-blocking DNS host.
>>
>> Odd that a hostname gets entered, because a computer can't use that.
>> Needs an IP address. Seems some other DNS gets used to get the IP
>> address of the wanted DNS server. If it demands a hostname, use that.
>> Google (dns.google) doesn't do any filtering. Adguard DNS does, so use
>> Adguard's DNS server.
>>
>> https://adguard-dns.io/en/public-dns.html
>> https://adguard-dns.io/en/support/configure_on_device.html
>>
>> Whether you use their assist app or not is up to you. I can't find
>> specific info on the app to determine if it assists with DNS, like
>> sending your current IP address to your Adguard account (if you have
>> one), or if it is just their adblocker app. Possibly their app makes
>> the setup easy instead of you having to drill through the Android
>> settings.
>>
>> https://adguard.com/en/adguard-android/overview.html
>> "Block throughout the whole system. This includes video ads and ads in
>> your favorite apps, ..."
>>
>> I've not used it to see if it changes the Android DNS settings, but then
>> I'm not at Android 9, or later, (still back on Android 8) where the
>> private DNS setting becomes available.
>>
>> What is suspicious is they say "Try AdGuard ad blocker for Android apps
>> for free". "Try for free" usually means trialware, and you end up
>> paying for the app if you keep it. Also, this is not the same Adguard
>> app at the play store:
>>
>> https://play.google.com/store/apps/details?id=com.adguard.android.contentblocker
>>
>> Adguard's page above has you download an .apk file. This is an offline
>> installation, not through the Google Play Store, so you have to
>> configure your Android phone to allow non-store apps.
>
> It's a very odd behavior that something called "DNS" uses a hostname.
> I'd have thought, as you had thought, it would use an IP address.
>
> But I tried it.
> You can't enter a numeric IP address into the Private DNS field.
> Android won't let you.
>
> Android insists on an alphabetic (or at least alphanumeric) hostname.
> All the articles say the same thing, so that's odd - but it's what it is.
>
> I have NO IDEA how it "finds" the IP address of that hostname.
> Do you?

https://www.zdnet.com/article/how-to-turn-on-private-dns-mode-on-android-and-why-you-should/

That also shows entering a FQDN for the DNS server. Weird. My only
guess is you enter the FQDN, and Android uses the current DNS server to
get the IP address to thereafter use that.

https://developers.cloudflare.com/1.1.1.1/setup/android/

That shows using either the FQDN or IP address of the DNS server. Guess
it depends on which brand and model of smartphone you have.

Nick Cine <nickcine@is.invalid> wrote:

> On Sat, 2 Mar 2024 15:50:53 -0600, kelown wrote:
>
>>> What DNS server should I set that Android setting to for ad removal?
>>
>> dns.adguard-dns.com (adguard's latest public DNS server URL)
>> dns.alternate-dns.com (blocked a site that adguard didn't catch)
>
> I've got most of the ad blocking problem solved in a few apps I tested.
> But I'm still confused how private DNS works.
>
> I tried dns.adguard-dns.com & dns.alternate-dns.com and they didn't work.
> So I almost gave up on Private DNS.
>
> Even though it's so simple.
> All you do is type in a hostname into the native Android field for it.
>
> But then I went down the list of private DNS hostnames, one by one.
> And "p2.freedns.controld.com" won me over!
>
> Obviously I never heard of "controlD.com" but it was the cat's meow.
> Why?
>
> I don't know why.
> But while "dns.adguard-dns.com" failed me, "p2.freedns.controld.com" won me
> over.
>
> It removed EVERY ad from the problematic app updater with ads.
> But it did not remove every ad in every app with ads that I tested.

Some ads are internal. They're coded in the app. They don't connect
out to get ad content. You can't block those with DNS or adblocker.
Besides internal ads, it's possible to buffer them up: grab some when
the ad sources are unblocked, and show until another Internet connection
becomes available (without ad blocking).

On Sat, 2 Mar 2024 21:54:13 -0600, VanguardLH wrote:

>> I have NO IDEA how it "finds" the IP address of that hostname.
>> Do you?
>
> https://www.zdnet.com/article/how-to-turn-on-private-dns-mode-on-android-and-why-you-should/
> That also shows entering a FQDN for the DNS server. Weird.

Everything about private DNS is weird.

The first weird thing is you don't give it an IP address like every other
DNS setting gets. Instead of an IP address, you give it a FQDN like
"1dot1dot1dot1.cloudflare-dns.com". That's weird.

The second weird thing is that it blocks ads for sure (as I've been using
it for a day and it does stop ads). I'm guessing the hostname lookup to IP
address returns a null for advertising networks, but I don't if that's how
it works.

The third weird thing is the Internet is filled with articles telling you
how to set it up (which is very simple) but I can't find an article yet
that explains how it works.
<https://www.google.com/search?q=how+does+android+private+dns+work>

An example is this promises to explain how it works, but all it explains is
how to set it up (which is very easy). But not how it works.
<https://www.namehero.com/blog/what-is-private-dns-a-detailed-guide/>

On 03.03.24 10:43, Nick Cine wrote:
> The first weird thing is you don't give it an IP address like every other
> DNS setting gets.

Sorry. This is total nonsense.
DNS over HTTPS always requires a complete hyperlink.

The one I use in TB and FF is this one:

https://unicast.uncensoreddns.org/dns-query

There are dozens of DNS-servers that do not have a numeric IP-address.

The DNS-over-TLS of the same provider is

anycast.uncensoreddns.org:853

--
"Ave Caesar! Morituri te salutant!"

Nick Cine <nickcine@is.invalid> wrote:

> VanguardLH wrote:
>
>>> I have NO IDEA how it "finds" the IP address of that hostname.
>>> Do you?
>>
>> https://www.zdnet.com/article/how-to-turn-on-private-dns-mode-on-android-and-why-you-should/
>> That also shows entering a FQDN for the DNS server. Weird.
>
> Everything about private DNS is weird.
>
> The first weird thing is you don't give it an IP address like every other
> DNS setting gets. Instead of an IP address, you give it a FQDN like
> "1dot1dot1dot1.cloudflare-dns.com". That's weird.

As mentioned, whether you must enter an alphanumeric dotted hostname or
can enter a dotted IP address depends on which smartphone you're using.

> The second weird thing is that it blocks ads for sure (as I've been using
> it for a day and it does stop ads). I'm guessing the hostname lookup to IP
> address returns a null for advertising networks, but I don't if that's how
> it works.

DNS lookups either succeed (and return an IP address), or their fail
(return error status). There's nothing "null" returned. The client
wouldn't know what to do with a null returned status.

> The third weird thing is the Internet is filled with articles telling you
> how to set it up (which is very simple) but I can't find an article yet
> that explains how it works.

After a little digging, I found "private DNS" and "secure DNS" mean
"encrypted DNS".

Firefox, Edge-C, and Chrome support DoH (DNS Over HTTPS) to encrypt DNS
traffic; else, it is plain text for the payload which anyone can
intercept, including your ISP or cell carrier.

https://en.wikipedia.org/wiki/DNS_over_HTTPS

Another proposal has been to use DNS over TLS (DoT):

https://en.wikipedia.org/wiki/DNS_over_TLS

Apparently Gooogle, in Android, decided to go with DoT instead of DoH.
You can read online the arguments of one over the other, like:

https://www.cloudns.net/blog/understanding-dot-and-doh-dns-over-tls-vs-dns-over-https/

Because they use different ports, anyone interrogating your network
traffic can tell when you are using DoT, but DoH uses HTTPS, so a
network admin couldn't tell which traffic was to a web site or which was
to a DNS server; however, they can still tell what is the target of the
traffic, so they can see when your traffic goes to a DNS server whether
the traffic is encrypted or not. Hence some folks go even more extreme
by employing a VPN to hide their DNS traffic, encrypted or not.

The "private" in Android's private DNS means the DNS traffic is
encrypted. However, that also means you need to connect to a DNS server
that supports your choice of encryption: DoH or DoT.

https://nordvpn.com/blog/private-dns-android/
https://www.makeuseof.com/android-private-dns-everything-you-need-to-know/

Lots of nuggets found using:

https://www.google.com/search?q=android+private+dns+how+it+works

I don't know how pervasive is DoH and DoT across all DNS servers.
Encryption requires both endpoints (client and server) to participate in
the encryption. Presumably if the DNS to which you connect does not
support those encryption schemes, Android will fall back to sending
plain DNS requests to the server, so they're not private anymore. If a
DNS server does not accept HTTPS or TLS connects (which is the "S" part
used by HTTPS) then you can't connect to that DNS server.

On Sun, 3 Mar 2024 05:33:00 -0600, VanguardLH wrote:

>> The first weird thing is you don't give it an IP address like every other
>> DNS setting gets. Instead of an IP address, you give it a FQDN like
>> "1dot1dot1dot1.cloudflare-dns.com". That's weird.
>
> As mentioned, whether you must enter an alphanumeric dotted hostname or
> can enter a dotted IP address depends on which smartphone you're using.

I didn't see that mentioned (but I may easily have glossed over it as a
*LOT* of incorrect information is in this thread, as in any thread).

I can say I would have agreed with you that DNS would "normally" take an IP
address for obvious reasons, but that "Private DNS" is something weird.

Suffice to say that I have not seen any documentation anywhere saying what
you're claiming - although I don't doubt that you claimed it.

Since I already looked at scores of documentation on private DNS (all of
which said how to set it up and none of which explained how it works), I'll
leave it open for someone to actually document that the Android setting for
Private DNS takes an IP address.

>> The second weird thing is that it blocks ads for sure (as I've been using
>> it for a day and it does stop ads). I'm guessing the hostname lookup to IP
>> address returns a null for advertising networks, but I don't if that's how
>> it works.
>
> DNS lookups either succeed (and return an IP address), or their fail
> (return error status). There's nothing "null" returned. The client
> wouldn't know what to do with a null returned status.

Again, I will say there is a lot of incorrect information in this thread,
so the only two undeniable facts I can point out from my experience setting
my Android 13 Private DNS for two days now are these two empirical facts.

1. My Android 13 Private DNS setting will not accept a numeric value.
2. When I set my Private DNS to p2.freedns.controld.com, ads were blocked.

How Private DNS blocks ads, I don't know yet.

>> The third weird thing is the Internet is filled with articles telling you
>> how to set it up (which is very simple) but I can't find an article yet
>> that explains how it works.
>
> After a little digging, I found "private DNS" and "secure DNS" mean
> "encrypted DNS".

Thank you for looking as it's clear that this "Private DNS" thing is
"weird" (since we all know how a normal "8.8.8.8" DNS lookup is performed).

The final DNS query is encrypted for sure, that much even I'm aware of.
But how Private DNS blocks ads is still a mystery to me.

> Firefox, Edge-C, and Chrome support DoH (DNS Over HTTPS) to encrypt DNS
> traffic; else, it is plain text for the payload which anyone can
> intercept, including your ISP or cell carrier.
> https://en.wikipedia.org/wiki/DNS_over_HTTPS
> Another proposal has been to use DNS over TLS (DoT):
> https://en.wikipedia.org/wiki/DNS_over_TLS
> Apparently Gooogle, in Android, decided to go with DoT instead of DoH.
> You can read online the arguments of one over the other, like:
> https://www.cloudns.net/blog/understanding-dot-and-doh-dns-over-tls-vs-dns-over-https/

To me, the "type" of encryption isn't that important yet.

> Because they use different ports, anyone interrogating your network
> traffic can tell when you are using DoT, but DoH uses HTTPS, so a
> network admin couldn't tell which traffic was to a web site or which was
> to a DNS server; however, they can still tell what is the target of the
> traffic, so they can see when your traffic goes to a DNS server whether
> the traffic is encrypted or not. Hence some folks go even more extreme
> by employing a VPN to hide their DNS traffic, encrypted or not.
>
> The "private" in Android's private DNS means the DNS traffic is
> encrypted. However, that also means you need to connect to a DNS server
> that supports your choice of encryption: DoH or DoT.
> https://nordvpn.com/blog/private-dns-android/
> https://www.makeuseof.com/android-private-dns-everything-you-need-to-know/
> Lots of nuggets found using:
> https://www.google.com/search?q=android+private+dns+how+it+works
> I don't know how pervasive is DoH and DoT across all DNS servers.
> Encryption requires both endpoints (client and server) to participate in
> the encryption. Presumably if the DNS to which you connect does not
> support those encryption schemes, Android will fall back to sending
> plain DNS requests to the server, so they're not private anymore. If a
> DNS server does not accept HTTPS or TLS connects (which is the "S" part
> used by HTTPS) then you can't connect to that DNS server.

Thanks for looking up the links as this "Private DNS" is not only new to
me, but I don't yet know how it works (but it sure does block in-app ads).

But you found out the same thing that I had found out.
There's no suitable explanation of how Private DNS works.

There are only descriptions of how to use it (which is simple).

For example, https://nordvpn.com/blog/private-dns-android/
a. That cite says Private DNS encrypts your DNS queries
b. Using DNS over TLS encryption to cipher DNS queries
c. Throughout "all your apps" (which isn't even correct)

That's all it says. I saw it before. It's just like all the others.
It doesn't explain how it works (and it's wrong about "C" above also).

Note that I don't care that it's wrong on item "C".
I'm only pointing out that it doesn't explain anything we don't know.

For example
https://www.makeuseof.com/android-private-dns-everything-you-need-to-know/
a. That cite starts off explaining what we all know about DNS queries
b. Then it says Private DNS encrypts the DNS query (which we knew)
c. Then it goes into the encryption method (which doesn't matter yet)
d. Then it tells you how to set it up (which is simple to do)

Notice not a single web site yet explains how PrivateDNS works.

What I'm trying to understand is how the Private DNS FQDN
ends up going to that DNS server and how it blocks ads.

Nick Cine <nickcine@is.invalid> wrote:
[...]

> Again, I will say there is a lot of incorrect information in this thread,
> so the only two undeniable facts I can point out from my experience setting
> my Android 13 Private DNS for two days now are these two empirical facts.
>
> 1. My Android 13 Private DNS setting will not accept a numeric value.
> 2. When I set my Private DNS to p2.freedns.controld.com, ads were blocked.
>
> How Private DNS blocks ads, I don't know yet.

Private DNS doesn't block ads, p2.freedns.controld.com blocks ads.

Private DNS is just DNS over TLS (and DNS over HTTPS), nothing more.

<https://developers.cloudflare.com/1.1.1.1/setup/android/#configure-1111-manually>

"Android 11 or later

Android 11 or later versions support both DNS over TLS (DoT) and DNS
over HTTPS (DoH).

1. Go to Settings > Network & internet.

2. Select Advanced > Private DNS.
...
Android 9 or 10

Android 9 and Android 10 support DNS over TLS to secure your queries
through encryption. In Android, this option is called Private DNS."

Note the latst sentence!

N.B. I didn't know anything about this stuff, but it took me only a
few minutes in Wikipedia and Google to find these answers!

[...]

On 3 Mar 2024 19:10:26 GMT, Frank Slootweg wrote:

>> How Private DNS blocks ads, I don't know yet.
>
> Private DNS doesn't block ads, p2.freedns.controld.com blocks ads.
>
> Private DNS is just DNS over TLS (and DNS over HTTPS), nothing more.

Thanks for clarifying it's DNS over TLS, which makes complete sense.
I had never heard of Private DNS until this thread.

Here's what I think I know (which isn't much, I admit).
1. You set the Android Private DNS to p2.freedns.controld.com
2. Somehow Android inherently knows what IP address that is
tracert p2.freedns.controld.com
Tracing route to p2.freedns.controld.com [76.76.2.11]
3. Somehow Android inherently knows the port & protocol (DNS over TLS)
telnet p2.freedns.controld.com 53
4. Somehow Android sets up an encrypted DoT connection over that port
5. And then when an Android app asks to connect to a fqdn,
that DoT encrypted connection returns the IP address to that app
(unless that PrivateDNS fqdn decides to filter out the IP as an ad)

Here's what I'm going to guess happens when an app inside
of Android makes a query to an advertisement web site.

1. The app makes the call to the advertisement site fqdn.
2. The DNS query on port 53 goes through the Private DNS fqdn.
3. That goes to p2.freedns.controld.com 76.76.2.11:53
4. Which, since it's an advertisement, returns null (I guess).

Is that guess as to how it works even close to how it works?

Nick Cine <nickcine@is.invalid> wrote:

> The final DNS query is encrypted for sure, that much even I'm aware of.
> But how Private DNS blocks ads is still a mystery to me.

The DNS server returns a fail status to the client on a DNS lookup that
is "blocked". Blocking at the DNS server is by failing DNS lookups to
the client. So, depends on which DNS server to which you connect
whether it blocks nothing or something. The Cloudflare and Google DNS
don't block anything. AdGuard DNS says what they block (fail the
lookups) at their web site to which I gave the URL.

Using <news:t89d094xgey9$.dlg@v.nguard.lh>, VanguardLH wrote:

>> The final DNS query is encrypted for sure, that much even I'm aware of.
>> But how Private DNS blocks ads is still a mystery to me.
>
> The DNS server returns a fail status to the client on a DNS lookup that
> is "blocked". Blocking at the DNS server is by failing DNS lookups to
> the client. So, depends on which DNS server to which you connect
> whether it blocks nothing or something. The Cloudflare and Google DNS
> don't block anything. AdGuard DNS says what they block (fail the
> lookups) at their web site to which I gave the URL.

https://developers.google.com/speed/public-dns/docs/dns-over-tls
https://developers.google.com/speed/public-dns/docs/dns-over-tls#how_it_works

1. The stub resolver is configured with the DNS-over-TLS resolver name dns.google.
2. The stub resolver obtains the IP address(es) for dns.google using the local DNS resolver.
3. The stub resolver makes a TCP connection to port 853 at one of those IP addresses.
4. The stub resolver initiates a TLS handshake with the Google Public DNS resolver.
5. The Google Public DNS server returns its TLS certificate along with a full chain of TLS certificates up to a trusted root certificate.
6. The stub resolver verifies the server's identity based on the certificates presented.
If the identity cannot be validated, DNS name resolution fails and the stub resolver returns an error.
7. After the TLS connection is established, the stub resolver has a secure communication path between to a Google Public DNS server.
8. Now the stub resolver can send DNS queries and receive responses over the connection.

On Sat, 2 Mar 2024 19:26:56 -0700, Nick Cine wrote:

>> After setting the private DNS hostname in your Android settings,
>> Open the Google Chrome browser.
>> On the URL bar, enter 'Chrome://flags' and hit Enter.
>> Now search for 'DNS' and disable the 'Async DNS' option.
>> Now enter 'chrome://net-internals/#dns' in the URL bar and hit enter.
>> Select the DNS tab and tap on the Clear Cache option.
>
> Who knew the Chromium web browser uses it's own DNS server setting.

This app is said to set DNS over TLS for mobile data in addition to wi-fi.
https://play.google.com/store/apps/details?id=com.quad9.aegis
This VPN tunnel app works on non-rooted devices to override local DNS
settings for both mobile and WiFi networks to use the Quad9
high-performance worldwide network of DNS servers."

This app will change your DNS for mobile and wi-fi also but it has ads.
https://play.google.com/store/apps/details?id=com.burakgon.dnschanger
DNS Changer uses VPNService base class to create DNS & VPN connection

I found those from this article https://www.easytechguides.com/android-dns/
How to set up DNS on any Android phone (step by step)
https://www.easytechguides.com/android-dns/#wi-fi-settings

david <this@is.invalid> wrote:

> Using <news:t89d094xgey9$.dlg@v.nguard.lh>, VanguardLH wrote:
>
>>> The final DNS query is encrypted for sure, that much even I'm aware of.
>>> But how Private DNS blocks ads is still a mystery to me.
>>
>> The DNS server returns a fail status to the client on a DNS lookup that
>> is "blocked". Blocking at the DNS server is by failing DNS lookups to
>> the client. So, depends on which DNS server to which you connect
>> whether it blocks nothing or something. The Cloudflare and Google DNS
>> don't block anything. AdGuard DNS says what they block (fail the
>> lookups) at their web site to which I gave the URL.
>
> https://developers.google.com/speed/public-dns/docs/dns-over-tls
> https://developers.google.com/speed/public-dns/docs/dns-over-tls#how_it_works
>
> 1. The stub resolver is configured with the DNS-over-TLS resolver name dns.google.
> 2. The stub resolver obtains the IP address(es) for dns.google using the local DNS resolver.
> 3. The stub resolver makes a TCP connection to port 853 at one of those IP addresses.
> 4. The stub resolver initiates a TLS handshake with the Google Public DNS resolver.
> 5. The Google Public DNS server returns its TLS certificate along with a full chain of TLS certificates up to a trusted root certificate.
> 6. The stub resolver verifies the server's identity based on the certificates presented.
> If the identity cannot be validated, DNS name resolution fails and the stub resolver returns an error.
> 7. After the TLS connection is established, the stub resolver has a secure communication path between to a Google Public DNS server.
> 8. Now the stub resolver can send DNS queries and receive responses over the connection.

Guess the point that encrypted DNS (DoH or DoT) is about secreting the
traffic, and ad, phish, malware, porn, or other blocking is a feature of
the DNS server irrelevant of connection type.

A DNS server may not accept encrypted connections, but it might.
A DNS server may not block anything, but it could.
Two different features. What you get depends on which DNS you use.

"VanguardLH" <V@nguard.LH> wrote

| A DNS server may not accept encrypted connections, but it might.
| A DNS server may not block anything, but it could.
| Two different features. What you get depends on which DNS you use.

Not to mention that with Google you're asking a crook to
watch your house while you go on vacation. And by the
time you get back, anything of value will be gone. But
at least the crook is registered with the Better Business
Bureau... So there's that. :)

Newyana2 <Newyana2@invalid.nospam> wrote:

> "VanguardLH" <V@nguard.LH> wrote
>
>| A DNS server may not accept encrypted connections, but it might.
>| A DNS server may not block anything, but it could.
>| Two different features. What you get depends on which DNS you use.
>
> Not to mention that with Google you're asking a crook to
> watch your house while you go on vacation. And by the
> time you get back, anything of value will be gone. But
> at least the crook is registered with the Better Business
> Bureau... So there's that. :)

Nah. More like you have a auditor watch your house, and after getting
back everything you have has been recorded, so anyone else wanting to
send you ads know better how to target you. Your driveway needs a
recoating, you get back, and find flyers in your mailbox for sealant
services.

Using <news:w7j6uskpmuxu$.dlg@v.nguard.lh>, VanguardLH wrote:

> More like you have a auditor watch your house, and after getting
> back everything you have has been recorded, so anyone else wanting to
> send you ads know better how to target you. Your driveway needs a
> recoating, you get back, and find flyers in your mailbox for sealant
> services.

You're always trusting somebody's DNS server.
I guess that's why there so many to choose from. :0

A critical question to answer that is unknown to me is what happens if you
specific an encrypted ad blocking server IP address for a static Wi-Fi
connection?

For example, instead of setting an ad blocking DNS server in the Private
DNS Android setting of, say "dns.quad9.net", instead you set your Android
static Wi-Fi DNS server to "9.9.9.9" (which is supposedly the same thing).

What happens?
Do you get the ad blocking encryption either way?
If they're both set, who wins?
If only the DNS server is set for static Wi-Fi, is it encrypted & ad
blocking?

Only your hairdresser knows for sure.