49 ms·
Ironically, the instructions linked to in this article for running your own DNS server[1] suggest configuring it to forward all non-local queries to your ISP or
by js2 8y ago
Ironically, the instructions linked to in this article for running your own DNS server[1] suggest configuring it to forward all non-local queries to your ISP or Google DNS.
(It’s not clear to me whether Vixie is more bothered by the loss of privacy in using Google/Cloudflare/OpenDNS/etc and/or it’s the loss of privacy.)
If you’re going to do that, you might as well use dnsmasq or just use your ISPs servers directly. If your concern is privacy, you need to configure BIND to operate in recursive mode instead of as a forwarder (dnsmasq is a forwarder only, but you could use unbind if you don’t like BIND). But note that your ISP could in theory still snoop your recursive DNS queried. It all depends who you trust the least.
You could also, per my sibling comment, run dnsmasq locally and then run a recursive DNS server on a cloud server, using either a VPN or DOH in-between. That would give you a local cache with your own recursive DNS that your ISP can’t snoop. But do you trust your cloud provider? (Also make sure if you do this that you configure edns0 client subnet or your video streaming may break.)
[1] https://www.ionos.com/digitalguide/server/configuration/how-to-make-your-raspberry-pi-into-a-dns-server/ https://www.ionos.com/digitalguide/server/configuration/how-...
- reshie 8y agowell there is dnscrypt. i use a local cache for fast revisits. ya i'm not sure everyone having full dns servers would be a good thing or even practical.
- js2 8y agoDNSCrypt only provides authentication, not confidentiality, and it’s only between the client and the recursive server. So it doesn’t address either the performance or the privacy concern of routing all your DNS through someone else’s recursive servers. Edit: apparently it encrypts traffic as well: https://dnscrypt.info/faq/ https://dnscrypt.info/faq/ So it’s comparable to DoH which prevents your ISP from snooping but per my other comments here doesn’t address the privacy concern of now having to trust the upstream resolver.
- ryan-c 8y agoAre you sure you're not thinking of DNSCurve? It doesn't provide confidentiality, but AFAICT DNSCrypt does.
- js2 8y agoYou’re right. I went of the Wikipedia page for it which says: DNSCrypt wraps unmodified DNS traffic between a client and a DNS resolver in a cryptographic construction in order to detect forgery. Though it doesn't provide end-to-end security, it protects the local network against man-in-the-middle attacks. https://en.wikipedia.org/wiki/DNSCrypt https://en.wikipedia.org/wiki/DNSCrypt But according to dnscrypt.info it’s encrypted.
- zrm 8y agoDNSCrypt and DNSCurve both provide confidentiality (and are very similar to each other). The thing that doesn't provide confidentiality is DNSSEC.
- Panino 8y agoDNSCurve does provide confidentiality, using x25519-xsalsa20poly1305.