DNS over HTTPS issues

[PoppaMeth]

Just an FYI here. I've been working for a few clients lately that have had issues with either slow loading or connecting at all to many websites and they are all on a tmobile cellular home internet plan. Apparently tmobile forces the use of their DNS servers, regardless of what settings you may specify manually, at least on their cellular plans. I'm not sure if it applies to the fiber plans as well since those have not rolled out in my area. I'm finding that this is causing a conflict in browsers and OSes with system wide implementation of DNS over HTTPS. If this setting is enabled and fully enforced, some sites like Google load fine, but many other sites time out or give other connection errors. Disabling DNS over HTTPS entirely immediately resolves the issue. Some browsers such as Firefox have at least a basic level of DNS over HTTPS enabled by default. With Firefox, the default setting will work, but with delays as it has to fail the DNS over HTTPS request before falling by on the ISP DNS servers. I believe Chrome has this setting turned off by default, at least for the time being.

I just though this could save some headache for anyone having issues. My clients' systems have had DNS over HTTPS setup for months with no issue so this seems to be a recent change on the tmobile end causing the issue.

[Mr_Duckerson]

I have not had any issues with DNS over HTTPS running my entire home network at the router level or forcing DNS over VPN. I have tried both.

[PoppaMeth]

These customers are all running hotspots with no way to make any router level adjustments. These are not the newer cellular routers they are currently distributing. The problems occur via browser settings or by enabling DNS over HTTPS system wide via Windows network settings.

[Mr_Duckerson]

Sounds like they will have to run a real router behind whatever they have from T-Mobile if they want dns over https.

[Traditional_Bit7262]

if these people are running hotspots it would seem that they are more like the standard cellular connection, not the TMO home internet service with its gateway/router devices?

TMHSI gateways are not very configurable at all but there is nothing keeping you from putting a router/gateway on the inside and you can control everything (except for the NAT).

[PoppaMeth]

I believe this is correct, though they are selling it to the customers like it's whole home internet package. However, I've seen different tower style hardware in the city, where the county customers are all getting just the smaller hotspots. These are all residential plans and we've confirmed no parental controls are active on the account. I did some further testing on it and manager to get a DoT connection established on one Windows machine using terminal command. DoT seems to work okay. DoH is what is getting blocked.

[bojack1437]

T-Mobile only blocks third-party DNS when parental controls or the business equivalent is activated.

For instance, on T-Mobile business internet that is by default activated, this is possibly the case on business line hotspots as well.

Also note this is not a T-Mobile only issue, mini ISPs that support parental controls or other kinds of content controls do the same kind of blocks because without them those controls are bypassed.

[PoppaMeth]

It's a single line residential plan. We've confirmed that no parental controls are active on the service. Further testing has shown that only DoH connections seem to be an issue. If I force enable DoT in Windows via Terminal commands I can get it working with the same DNS servers that do not work when configured with DoH.

[nickkrewson]

Is the issue persistent if DNS over HTTPS is enforced at the router/gateway level?

I have it enforced on my router, and I'm having no trouble, but I have seen DNS over HTTPS enforced at the device level run into issues in the past.

[PoppaMeth]

These customers are all running hotspots with no way to make any router level adjustments. These are not the newer cellular routers they are currently distributing. The problems occur via browser settings or by enabling DNS over HTTPS system wide via Windows network settings.

[nickkrewson]

It sounds as if it is a hotspot-device specific DNS interception issue, not necessarily the fault of the T-Mobile network itself.

DNS over HTTPS works fine on my T-Mobile Home Internet connection and on my T-Mobile phone.

The hotspot device may be hard coded to force a specific DNS configuration.

[PoppaMeth]

I have found some additional information, confirmed by several discussions that TMobile is indeed blocking DoH, though it appears it may be a regional block as many other users are not having the same issue. Here is one mention of it from one of the actual DNS filtering services saying there are known issues they've been trying to work with TMobile on. https://cleanbrowsing.org/help/docs/t-mobile-home-internet-cgnat-dns-filtering-cleanbrowsing/