3 ms·
Thanks for the nice guide. I wouldn’t use Google DNS as a default though, they don’t have a good record when it comes to respecting privacy.
by zakk 8y ago
Thanks for the nice guide. I wouldn’t use Google DNS as a default though, they don’t have a good record when it comes to respecting privacy.
- ricardbejarano 8y agoTrue. I put it as a failover for Cloudflare's 1.1.1.1 because they both support DNS over TLS and DNS over HTTPS and even though DNS servers are rarely down, I didn't want to recommend a single point of failure with Cloudflare's 1.1.1.1 and 1.0.0.1, but you are free to choose whatever resolvers you want. Thanks for the feedback!
- floatingatoll 8y agoIt’s ironic to see a guide to securing anything recommend using plaintext MITM-able DNS rather than instructing users to build and configure a safe DNS-over-HTTPS resolver to the exact same IPs.
- ricardbejarano 8y agoIIRC, Google DNS and Cloudflare DNS both support "DNS over TLS" and "DNS over HTTPS", that's the reason I recommend them in the first place.
- vladvasiliu 8y agoIt's not enough for the servers to support it, the resolver has to actually use it too. Your guide instructs people to configure the Cloudflare / Google DNS in system preferences, which will query those via plaintext DNS on port 53. GP's point is that if you want to secure DNS, it's a bit more involved, hence the build in "instructing people to build and configure a HTTPS resolver". I don't actually use this, as my home router handles DNS over TLS for everything, but a quick google search turns this up: https://blog.because-security.com/t/use-cloudflare-dns-with-tls-on-mac-os-x-gui-and-cli-way/315 https://blog.because-security.com/t/use-cloudflare-dns-with-....