Unauthorized Third-Party DoH Resolver Usage Bypassing Corporate DNS

Ali AlEnezi@site

•updated Sep 15, 2026•0•0•1

Detects outbound network traffic attempting to reach known public DNS-over-HTTPS (DoH) resolvers. This rule monitors for specific SNI fields in TLS handshakes or HTTP/2 :authority headers that indicate communication with common third-party DoH services, which may be used to bypass internal DNS filtering and monitoring controls.