HTTPS DNS query not blocked by rule

[agneevX]

Hello

I wanted to block cm.usatoday.com, so from QL, I blocked it.

However the website still opens because it does a HTTPS query instead of A.

# Query Log Block rule
||cm.usatoday.com^$important
# This does not work either
||*cm.usatoday.com^$important

How do I block this?

❯ dig cm.usatoday.com

; <<>> DiG 9.16.1-Ubuntu <<>> cm.usatoday.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37367
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;cm.usatoday.com.		IN	A

;; ANSWER SECTION:
cm.usatoday.com.	10	IN	A	0.0.0.0

;; Query time: 3 msec
;; SERVER: 10.0.0.10#53(10.0.0.10)
;; WHEN: Sun Jul 11 14:11:59 IST 2021
;; MSG SIZE  rcvd: 49

❯ dig https://cm.usatoday.com

; <<>> DiG 9.16.1-Ubuntu <<>> https://cm.usatoday.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60729
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;https://cm.usatoday.com.	IN	A

;; ANSWER SECTION:
https://cm.usatoday.com. 1200	IN	CNAME	vanities.gbahn.net.
vanities.gbahn.net.	3230	IN	CNAME	wh158-gbahn.production.gannettdigital.com.
wh158-gbahn.production.gannettdigital.com. 20 IN A 209.97.55.148

;; Query time: 243 msec
;; SERVER: 10.0.0.10#53(10.0.0.10)
;; WHEN: Sun Jul 11 14:12:05 IST 2021
;; MSG SIZE  rcvd: 152

[ainar-g]

That's a rather weird way to request domains, to be honest, but this seems to work for me:

||https://cm.usatoday.com^
||cm.usatoday.com^

[agneevX]

This can be a way to potentially bypass ad blocking, what do you think @ainar-g?

[ainar-g]

At the very least it's worth investigating further. It seems like http://cm.usatoday.com and even just /cm.usatoday.com work. These aren't HTTPS records, but rather just weird use of A records.

@ameshkov, you might be interested in this.