alt Hacker News>notably Windows
At least they're honest, using host <spynet2.microsoft.com> to replicate Apple's <smoot.> & <security.> subdomains.
>This does work for unencrypted DNS and DoT over port 853, but it fails for DoT over any other port and DoH
My task for today is to learn more about this (I'm only doing the unencryptedDNS part) and then implement an entire subnet that is whitelist-only (for all DNS). I think what you wrote will help solve this better, thanks.
Oh hey, found you in a 2024 HN thread while searching for info on that smoot subdomain. I guess you've been at this for a while.
FWIW, Microsoft hardcodes dozens of subdomains, not just that one. Windows includes hardcoded domain names for all sorts of services that are important to them, like the universal backdoor and its self-healing functions (naturally), and servers used for Microsoft account sign-in and telemetry (of course). They really wanna make sure nothing stops them from uploading your disk encryption keys to their servers! (or something)