DNS Hook Feature...

With the adoption of DoH technology (DNS over HTTPS) - Endpoint Security solutions that rely on classic DNS [Do53] visibility no longer function. (This includes advanced VPN features like Domain Split Tunneling and advanced DNS security features).

Unlike other OSes Vendors that offer a DNSProxy System API framework to solve this problem,
Microsoft does not have such a capability or framework available for encrypted-DNS in the OS Stack.

It means that these network level security frameworks can no longer operate when DoH is enabled, forcing them to block / disable DoH functionality in a brute-force manner.

It would be great if eBPF could support a new hook to provide DNS visibility (like other OS frameworks already offer),
even when DoH is enabled in the OS Resolver.
This hook should include the ability to observe, inject or modify/drop DNS request/responses.

Start by researching the existing eBPF hook architecture and Windows DNSProxy System API gap described in the issue; no files or tests are named. Done would require a defined DNS hook that can observe, inject, modify, or drop DNS requests and responses when DoH is enabled.

Written by the indexing model from the issue text.