3 ms·

"At a minimum, my ISP can not see or tamper with DNS requests." Are you encrypting each DNS packet at the source (e.g. your home recursor/DNS-forwwarder)? If

"At a minimum, my ISP can not see or tamper with DNS requests." Are you encrypting each DNS packet at the source (e.g. your home recursor/DNS-forwwarder)? If yes, when are your sent packets decrypted? At the authoritative nameserver, or at some intermediary recursor? If no, how do you believe that your DNS packets are opaque and tamper resistant? There are very few authoritative nameservers on the internet that accept and return encrypted DNS packets. Thus third party recursors must send out unencypted DNS packets. Nothing protects these unencrypted packets from being captured, viewed or tampered with. It sounds more like you are creating a chain of recursors (that you control?) to make tracing the requests more difficult. If you are using any third party recursors are you concerned about applications you use that implement support for ends-client-subnet extensions?

cat199 9y ago
Pretty clear to me he's running DNS over the VPN, and so yes, 'ISP' referred to 'his immediately upstream ISP', and so yes, OP is "creating a chain of recursors (that you control?) to make tracing the requests more difficult" but also, as a result less difficult to tamper with by a less trusted party such as a mass market commercial ISP - tampering with his forwarder would entail either tampering with random many other peoples traffic or compromising the 'percieved as more secure' ISP. Pretty sure someone mucking around with TTL's on these packets to make sure they don't get too far out of intended range and the numerous other things would be aware of these issues..
LinuxBender 9y ago
My home ISP can not see my DNS packets. Those are the adversaries I am defending against specifically. All DNS packets on my home ISP are encapsulated in a VPN to my VPS nodes. I also pre-cache popular requests via cron and via settings in Unbound. From there, for sure, the risk increases. I am not sure I trust DNSSEC to help me much. That said, I rotate through many local recursors at each location, so they have to rewrite my traffic right as it leaves my node. That is doable, but that isn't really what I am defending against. Anything I care about, I validate in a script and write into /etc/hosts. You are correct, there are not that many recursors that support TLS. Beyond that, things like software updates I don't trust DNS at all and certainly not public mirrors. I validate packages with GPG signatures. Even that is tricky, because chicken+egg, so I validate the GPG sigs from trusted sources. On a funny side note, you would be surprised how many people rely on trusting GPG keys that are contained in a package, signed by those same keys, in the same repo.
- tptacek 9y ago
  DNSSEC doesn't really protect you at all here. The last mile between you and your recursor has no DNSSEC protection at all (DNSSEC is server-to-server). There are a whole bunch of other places to redirect your traffic before and after name resolution. And, of course, DNSSEC offers no privacy whatsoever: any ISP MITM can still see every domain name you're looking up, because DNSSEC is a signing-only protocol.

cat199 9y ago

Pretty clear to me he's running DNS over the VPN, and so yes, 'ISP' referred to 'his immediately upstream ISP', and so yes, OP is "creating a chain of recursors (that you control?) to make tracing the requests more difficult" but also, as a result less difficult to tamper with by a less trusted party such as a mass market commercial ISP - tampering with his forwarder would entail either tampering with random many other peoples traffic or compromising the 'percieved as more secure' ISP. Pretty sure someone mucking around with TTL's on these packets to make sure they don't get too far out of intended range and the numerous other things would be aware of these issues..

LinuxBender 9y ago

My home ISP can not see my DNS packets. Those are the adversaries I am defending against specifically. All DNS packets on my home ISP are encapsulated in a VPN to my VPS nodes. I also pre-cache popular requests via cron and via settings in Unbound. From there, for sure, the risk increases. I am not sure I trust DNSSEC to help me much. That said, I rotate through many local recursors at each location, so they have to rewrite my traffic right as it leaves my node. That is doable, but that isn't really what I am defending against. Anything I care about, I validate in a script and write into /etc/hosts. You are correct, there are not that many recursors that support TLS. Beyond that, things like software updates I don't trust DNS at all and certainly not public mirrors. I validate packages with GPG signatures. Even that is tricky, because chicken+egg, so I validate the GPG sigs from trusted sources. On a funny side note, you would be surprised how many people rely on trusting GPG keys that are contained in a package, signed by those same keys, in the same repo.

tptacek 9y ago
DNSSEC doesn't really protect you at all here. The last mile between you and your recursor has no DNSSEC protection at all (DNSSEC is server-to-server). There are a whole bunch of other places to redirect your traffic before and after name resolution. And, of course, DNSSEC offers no privacy whatsoever: any ISP MITM can still see every domain name you're looking up, because DNSSEC is a signing-only protocol.