3 ms·

> Please note that pretty much all the DNS leak detection tests by the VPN providers will be a false positive, as the only thing they check is if you are using

> Please note that pretty much all the DNS leak detection tests by the VPN providers will be a false positive, as the only thing they check is if you are using their DNS servers. Rest assured that your DNS queries are well protected by the Portmaster and there is no need to be concerned." [1] That's a confusing statement... does this mean they change your DNS server/provider by default, if you are using a VPN? [1] https://docs.safing.io/portmaster/install/status/vpn-compatibility https://docs.safing.io/portmaster/install/status/vpn-compati...

byteshock 4y ago
I think it’s because SPN uses a different IP/node per connection you make. DNS leak detection tests will ask your browser to resolve unique subdomains. If the DNS server that requests the lookup is different from your connecting IP to the website, they will say you have a DNS leak. https://security.stackexchange.com/questions/42752/how-does-dnsleaktest-com-find-my-dns-provider https://security.stackexchange.com/questions/42752/how-does-...
- dhaavi 4y ago
  That would be true if would be resolving all DNS yourself. Nowadays everyone uses a recursive resolver. See my other answer for details about this case.
dhaavi 4y ago
Pretty much all VPNs use their own DNS servers. Their "DNS Leak Tests" just check if queries come from that DNS server. Portmaster overrides any custom DNS server and enforces the ones the user set - or are set by default. This "breaks" the VPN leak test. You'd need to use a leak test from the DNS provider for it to work. Thanks for the feedback. I will look into improving the text.
- DavideNL 4y ago
  > "overrides any custom DNS server and enforces the ones the user set - or are set by default" If Portmaster "enforces DNS servers with the ones that are set", after installing Portmaster and without the user changing anything, i'd say that's a decrease of privacy; Your VPN provider can see your traffic in any case (even when you're not using their DNS server.) So, if Portmaster would change this to whatever your default is (Cloudflare, Google, etc.), people are then suddenly sharing their DNS requests with yet another 3th party.
  - dhaavi 4y ago
    There is a welcome screen that informs you of Portmaster handling and securing DNS queries with the option to change the provider. But especially with a VPN the privacy is increased as it effectively becomes DNS-over-TLS/HTTPS-over-VPN. The VPN still sees your destination IP addresses, so the privacy improvement is not increased by a lot, but still.
    - DavideNL 4y ago
      > with the option to change the provider. Ah right, that sounds good. So the user is aware of it. > But especially with a VPN the privacy is increased as it effectively becomes DNS-over-TLS/HTTPS-over-VPN. I disagree; VPN providers use an internal IP as DNS server and your connection to this DNS server goes through a secured VPN tunnel anyway. So, by sharing your DNS requests with an external 3th party you gain nothing, and it's even a decrease of your privacy since now Google/Cloudflare/etc collects all these requests.
    - maxloh 4y ago
      Seems that there isn't an option to use the default ISP's DNS server. :(
      - dhaavi 4y ago
        You can use anything: DNS Configuration Guide: https://docs.safing.io/portmaster/guides/dns-configuration https://docs.safing.io/portmaster/guides/dns-configuration
        maxloh 4y ago
        I found the option after completed the setup process. The problem was that there isn't a "keep my DNS as is" option in the initial setup dialog (or not an obvious one), so we are forced to pick one from the four secure DNS.

byteshock 4y ago

I think it’s because SPN uses a different IP/node per connection you make. DNS leak detection tests will ask your browser to resolve unique subdomains. If the DNS server that requests the lookup is different from your connecting IP to the website, they will say you have a DNS leak. https://security.stackexchange.com/questions/42752/how-does-dnsleaktest-com-find-my-dns-provider https://security.stackexchange.com/questions/42752/how-does-...

dhaavi 4y ago
That would be true if would be resolving all DNS yourself. Nowadays everyone uses a recursive resolver. See my other answer for details about this case.

dhaavi 4y ago

Pretty much all VPNs use their own DNS servers. Their "DNS Leak Tests" just check if queries come from that DNS server. Portmaster overrides any custom DNS server and enforces the ones the user set - or are set by default. This "breaks" the VPN leak test. You'd need to use a leak test from the DNS provider for it to work. Thanks for the feedback. I will look into improving the text.

DavideNL 4y ago
> "overrides any custom DNS server and enforces the ones the user set - or are set by default" If Portmaster "enforces DNS servers with the ones that are set", after installing Portmaster and without the user changing anything, i'd say that's a decrease of privacy; Your VPN provider can see your traffic in any case (even when you're not using their DNS server.) So, if Portmaster would change this to whatever your default is (Cloudflare, Google, etc.), people are then suddenly sharing their DNS requests with yet another 3th party.
- dhaavi 4y ago
  There is a welcome screen that informs you of Portmaster handling and securing DNS queries with the option to change the provider. But especially with a VPN the privacy is increased as it effectively becomes DNS-over-TLS/HTTPS-over-VPN. The VPN still sees your destination IP addresses, so the privacy improvement is not increased by a lot, but still.
  - DavideNL 4y ago
    > with the option to change the provider. Ah right, that sounds good. So the user is aware of it. > But especially with a VPN the privacy is increased as it effectively becomes DNS-over-TLS/HTTPS-over-VPN. I disagree; VPN providers use an internal IP as DNS server and your connection to this DNS server goes through a secured VPN tunnel anyway. So, by sharing your DNS requests with an external 3th party you gain nothing, and it's even a decrease of your privacy since now Google/Cloudflare/etc collects all these requests.
  - maxloh 4y ago
    Seems that there isn't an option to use the default ISP's DNS server. :(
    - dhaavi 4y ago
      You can use anything: DNS Configuration Guide: https://docs.safing.io/portmaster/guides/dns-configuration https://docs.safing.io/portmaster/guides/dns-configuration
      - maxloh 4y ago
        I found the option after completed the setup process. The problem was that there isn't a "keep my DNS as is" option in the initial setup dialog (or not an obvious one), so we are forced to pick one from the four secure DNS.