3 ms·

To point out, the Android private dns feature is DNS over TLS (853), not DNS over Https. So this wouldn't have worked. That said, the Android private dns featu

To point out, the Android private dns feature is DNS over TLS (853), not DNS over Https. So this wouldn't have worked. That said, the Android private dns feature is incredibly simple to use, applies to VPNs, and is the best implementation I've seen. Currently I use it with NextDns, and this post makes me wonder if a TLS to DNS module for nginx, or some proxy, exists...

BaronSamedi 6y ago
For your home network DNS: a server with dnsmasq -> stubby -> DNS over TLS -> NextDNS works quite well. Fast with dnsmasq caching and reasonably secure, plus NextDNS can block unwanted domains (ads, malware, etc.)
tialaramex 6y ago
Using nginx seems like a bad fit for DoT? I can see it for DoH where maybe there's enough HTTP stuff you can re-use but for DoT essentially all you want is the TLS stack right? One of the things any of these approaches will need is a mechanism to get trustworthy certificates†. But since you're a DNS server I think it likely makes sense to do DNS proof of control (so dns-01 under Let's Encrypt or another ACME service) rather than spin up other services. † If you don't have this, your resolver clients can't be sure it's you they're talking to, if you don't care about that then you didn't need DNS privacy anyway.
- gruez 6y ago
  >† If you don't have this, your resolver clients can't be sure it's you they're talking to, if you don't care about that then you didn't need DNS privacy anyway. You can get certificates for IP addresses, eg. https://1.1.1.1/ https://1.1.1.1/
  - tialaramex 6y ago
    Sure, I do not anticipate most home users will want this or should attempt it. You can see why Cloudflare wanted 1.1.1.1 but https://[2001:8b0:fbb0:1247:1b24:1c24:1d23:714]/ https://[2001:8b0:fbb0:1247:1b24:1c24:1d23:714]/ doesn't exactly trip off the tongue.
- fanf2 6y ago
  nginx works very nicely as a DNS-over-TLS to DNS-over-TCP proxy, but yes you might want to choose stunnel instead if you don’t also want DoH. (I have run DoH and DoT in production since 2018, using OpenResty, i.e. nginx plus LuaJIT, with the DoH protocol conversion written by me in Lua, and DoT using basic nginx as described in TFA.)
m-p-3 6y ago
I've had some issues on some restrictive network where DoT wouldn't go through, but DoH did. I wished both were supported at the OS level.

BaronSamedi 6y ago

For your home network DNS: a server with dnsmasq -> stubby -> DNS over TLS -> NextDNS works quite well. Fast with dnsmasq caching and reasonably secure, plus NextDNS can block unwanted domains (ads, malware, etc.)

tialaramex 6y ago

Using nginx seems like a bad fit for DoT? I can see it for DoH where maybe there's enough HTTP stuff you can re-use but for DoT essentially all you want is the TLS stack right? One of the things any of these approaches will need is a mechanism to get trustworthy certificates†. But since you're a DNS server I think it likely makes sense to do DNS proof of control (so dns-01 under Let's Encrypt or another ACME service) rather than spin up other services. † If you don't have this, your resolver clients can't be sure it's you they're talking to, if you don't care about that then you didn't need DNS privacy anyway.

gruez 6y ago
>† If you don't have this, your resolver clients can't be sure it's you they're talking to, if you don't care about that then you didn't need DNS privacy anyway. You can get certificates for IP addresses, eg. https://1.1.1.1/ https://1.1.1.1/
- tialaramex 6y ago
  Sure, I do not anticipate most home users will want this or should attempt it. You can see why Cloudflare wanted 1.1.1.1 but https://[2001:8b0:fbb0:1247:1b24:1c24:1d23:714]/ https://[2001:8b0:fbb0:1247:1b24:1c24:1d23:714]/ doesn't exactly trip off the tongue.
fanf2 6y ago
nginx works very nicely as a DNS-over-TLS to DNS-over-TCP proxy, but yes you might want to choose stunnel instead if you don’t also want DoH. (I have run DoH and DoT in production since 2018, using OpenResty, i.e. nginx plus LuaJIT, with the DoH protocol conversion written by me in Lua, and DoT using basic nginx as described in TFA.)

m-p-3 6y ago

I've had some issues on some restrictive network where DoT wouldn't go through, but DoH did. I wished both were supported at the OS level.