1.1.1.1 on iPhone ignore app DNS

Zero Trust 1.1.1.1
1

Hello,

I was troubleshooting why my iPhone 7 Plus with iOS 13.1.3 is not validating my broken dnssec domain.
What I found is:
Chrome, App Store, Safari, etc. all of this app’s ignore 1.1.1.1 app and all dns traffic go to my default resolvers (from dhcp). All I checked on my router with tcpdump and it confirms. Same behavior is on cellular network.

ISC Dig see 1.1.1.1 resolvers in iPhone and use it correctly.

I had same iPhone 7 Plus (factory settings) with same iOS 13.1.3 and it was same.

2

It doesnt matter if i use DoT or DoH.
Dnslog is empty, except dns traffic from 1.1.1.1 app or request from ISC Dig App.

3

What do you see at https://1.1.1.1/help ?

4

https://1.1.1.1/help#eyJpc0NmIjoiWWVzIiwiaXNEb3QiOiJZZXMiLCJpc0RvaCI6Ik5vIiwicmVzb2x2ZXJJcC0xLjEuMS4xIjoiWWVzIiwicmVzb2x2ZXJJcC0xLjAuMC4xIjoiWWVzIiwicmVzb2x2ZXJJcC0yNjA2OjQ3MDA6NDcwMDo6MTExMSI6Ik5vIiwicmVzb2x2ZXJJcC0yNjA2OjQ3MDA6NDcwMDo6MTAwMSI6Ik5vIiwiZGF0YWNlbnRlckxvY2F0aW9uIjoiUFJHIiwiaXNwTmFtZSI6IkNsb3VkZmxhcmUiLCJpc3BBc24iOiIxMzMzNSJ9

But no DNSSEC validation?

image
image1242×2208 344 KB

5

Any update?