7 ms·

Shutting down our unencrypted public DNS service

265 points by mikece 4y ago

nes350 4y ago
Dead for me. Archive link: https://archive.vn/L53p4 https://archive.vn/L53p4
- danpalmer 4y ago
  It works fine for me.
wpietri 4y ago
Reading both this link and the previous announcement, I don't understand why they are doing this. Leaving the plain UDP port 53 option surely can't be a big burden. Is this because as a VPN they're committed to privacy? If so, I wonder if this is a net privacy gain. Some people will surely switch to the encrypted versions, but others will just go looking for a different dotted quad to drop in, one possibly less secure.
- INTPenis 4y ago
  I use UncensoredDNS, which is a much smaller project but also a free DNS service like Mullvad's. And they also shut down all of their unencrypted ports earlier this year. Here[1] is their reason; "The reason for this radical change is twofold: 1) I want encourage adoption of encrypted and authenticated DNS, and 2) I am sick of fighting UDP amplification attacks." 1. https://blog.uncensoreddns.org/blog/39-the-unfriendly-internet-turning-off-cleartext-lookups-in-september/ https://blog.uncensoreddns.org/blog/39-the-unfriendly-intern...
  - wpietri 4y ago
    Ah, right. I have questions about the first, but the latter makes a ton of sense to me. Thanks!
  - Siira 4y ago
    These encrypted DNS services are usually blocked here in Iran. The unencrypted ones are compromised, too. I use self-hosted dnscrypt.
  - RobotToaster 4y ago
    Interesting, I use OpenNIC, another free DNS service, and they don't seem to have any problems.
    - pixl97 4y ago
      "Don't have any problems" and "Don't have problems that they are telling you about" are different things. They may have an abuse@opennic address they've never opened. An ignored problem isn't a problem, well until it is. Or they may deal with it and not mention the costs of doing so.
  - 1vuio0pswjnm7 4y ago
    Turning off EDNS and DNSSEC would surely reduce if not eliminate the risk of amplification attacks. If anyone has the idea that traditional 512-byte UDP-based DNS is now useless, then I think that's crazy. I still use it all the time, particularly on the home network. I would be willing to bet some (not all) DoH providers are using traditional 512-byte DNS for their backend queries. I use remote DoH heavily outside the browser. I also run DoH servers on local computers.
    - LinuxBender 4y ago
      I would be willing to bet some (not all) DoH providers are using traditional 512-byte DNS for their backend queries. You are correct. In fact they have no choice in this matter unless they are just daisy-chaining to other DoH/DoT servers. The real internet still uses plain unencrypted UDP and there is no guarantee the server one is talking to supports EDNS. The root servers do not support DoT/DoH and most corporate DNS servers do not support DoH/DoT. Some of those also do not support EDNS. A small handful of the paid DNS providers offer DoT but it isn't like clients would know to use that by default. Some cell phones and some browsers are the only clients that to my knowledge will try to enumerate if DoT/DoH is available. Regarding 512 byte queries, EDNS is opportunistic. Not everyone supports it and one can not assume it is supported. That is negotiated. DNS Flag day(s) [1] were supposed to encourage everyone to enable EDNS and standard size limits of 1232. Without EDNS some traffic will revert to TCP and not everyone has that enabled to my surprise. I have a handful of DoT servers and they just talk plain UDP to the root servers. I've thought about making some of them public as a learning exercise to see what riff-raff shows up though I suspect I will be spending some time tuning rate limits and firewall rules. As a side note, I was actually surprised to find that Android figured out I had DoT on my home network and I didn't even git it any hints. Seems it just probed the gateway for 853 and got lucky. [1] - https://www.dnsflagday.net/2020/ https://www.dnsflagday.net/2020/
      - 1vuio0pswjnm7 4y ago
        There is much "probing" from "tech" companies like Google and Apple. You should try running NetGuard on Android, block everything and observe what tries to connect. It is one thing to use DoH if port 53 is being filtered, but that is a relatively small population of internet users. Forcing everyone to use DoH inside an ad-sponsored application like a web browser or a corporate OS like Android, versus providing it as an option, is questionable, IMO. Do you use OpenWRT. OpenWRT routers with mwan3 enabled by default are pinging open resolvers, public DNS caches, like GoogleDNS, Cloudflare and Cisco OpenDNS to check for connectivity. These are considered "reliable IP addresses to ping". https://web.archive.org/web/20220629175529if_/https://github.com/openwrt/packages/blob/master/net/mwan3/files/etc/config/mwan3 https://web.archive.org/web/20220629175529if_/https://github... https://openwrt.org/docs/guide-user/network/wan/multiwan/mwan3 https://openwrt.org/docs/guide-user/network/wan/multiwan/mwa... Why not ping a root server instead. Even a com nameserver is more important than Google LLC. EDNS is opportunistic but we can disable/remove it altogether before compiling our DNS servers. Or we can use DNS software, e.g., djbdns, that will never support it.
- jeroenhd 4y ago
  DoT and DoH are traditionally available over TCP (or reworked versions of TCP like QUIC), which have built in protections against address spoofing. Opening port 53 means having to set up a system to prevent abuse. Multiplication attacks through DNS are still as common as ever and mitigation can be incredibly difficult if a botnet is attacking a wide range of IP addresses. Putting everything behind encryption not only makes life just a tad more private (especially when using ODoH, using which your DNS server can't even know what domains your IP is visiting, though I'm not sure if they support that) while also reducing the complexity of the service they're running. There are downsides for sure, but I think they don't outweigh the benefits.
  - 0xbadcafebee 4y ago
    Only the UDP version of DNS is open to amplification attacks. The TCP version of DNS (which has been supported for 30+ years) should work fine, but some shitty firewalls block it, so people have not relied upon it, and as a result it's not very reliable to use TCP DNS everywhere. Rather than deal with the problem and make UDP-based DNS obsolete ("but UDP is faster!" + "but middleboxes!" is the reason nobody wants to deal with it), people are instead pushing DoH, which just shoves DNS over an HTTPS connection. It's like, if in response to cars on a certain stretch of road hitting bicycles, you know building a protected bike lane is the best solution. But it's expensive, and it may limit parking, or the amount of lanes for cars, or their max speed. So instead you require everyone to put their bicycle in a car, or just bike on the street and risk being hit. Nobody wants to deal with the real problem, so we instead institute hacks and try to ignore the problem as long as we can. Anything to avoid expense, cooperation, re-building.
    - alexiaa 4y ago
      you may have a point about amplification attacks, but that's not the main reason DoH/DoT exists. simply using legacy DNS over TCP will not magically make it encrypted.
    - jedisct1 4y ago
      DNSCrypt mainly uses UDP, doesn't allow amplification, allows client IP anonymization.
- alangibson 4y ago
  > Is this because as a VPN they're committed to privacy? Almost certainly. Mullvad is way out there when it comes to privacy. They recently got rid of recurring subscriptions because they said they didn't want to store any PII.
  - tpmx 4y ago
    Just to clarify: Saying no to recurring subscriptions is a BFD. They are what drive the revenue growth of every SaaS. Getting rid of them means they will earn less money in the short term (the next few years). It's very unusual. The vast majority focus primarily on getting this to work as friction-less as possible.
    - quickthrower2 4y ago
      BFD?
      - tpmx 4y ago
        Sorry. Big Fucking Deal.
  - alexiaa 4y ago
    > They recently got rid of recurring subscriptions because they said they didn't want to store any PII. as much as this may be a noble goal, as a user i want to have the option of a recurring subscription, especially if i pay monthly (which i prefer to, unless i'm really committed to a service or the yearly subscription is cheap enough that i'm sure i won't regret it). if it's just one or two services doing this it's not a huge deal, but imagine getting emails from tens of different services each month to renew, especially if you have to log in and enter your credit/debit card details on each one separately. is there a reason they can't simply store a token from stripe/paypal/etc, or is that still considered PII?
    - jontas 4y ago
      It sounds like you are not their target audience, which is fine, it just means a different service would be a better option for the way you value convenience vs privacy.
- josephcsible 4y ago
  > Leaving the plain UDP port 53 option surely can't be a big burden. Is this because as a VPN they're committed to privacy? You're right. They are doing this to better protect their users, just like when they stopped accepting recurring payments. > Some people will surely switch to the encrypted versions, but others will just go looking for a different dotted quad to drop in, one possibly less secure. I feel like almost everyone who already went out of their way to use Mullvad in the first place will do the former.
ck2 4y ago
Is the idea behind encrypted DNS to stop manipulation of the answer given? Because it can't be privacy, any ISP or router along the way can see the source/destination IP which is "naked" and basically has to always be?
- jacooper 4y ago
  They can't see that its a DNS request, it appera like any normal website connection.
- adgjlsfhk1 4y ago
  it is privacy. The ISP and routers can see the IP addresses but that gives a lot less info than the url since most websites will pull from a changing set of IPs due to server changes, cdns, and 3rd party content (e.g. ads). For a large number of sites, the IP addresses will just tell you that someone is looking at a website hosted by cloudflare/aws. (also just getting rid of the name is effective at getting the info away from low tech surveillance like schools where someone on the route is mildly interested in seeing/blocking connections but won't bother if it's annoying to do)
  - PaulHoule 4y ago
    There are many content blocking solutions that work at the DNS level. Encrypted DNS will bypass those.
    - Avamander 4y ago
      Only if you don't control the device, in which case you're dead in the water anyways.
      - PaulHoule 4y ago
        I am thinking about the system they use to censor the WiFi at the gym which works at the network level.
superkuh 4y ago
HTTPS is the systemd of protocols. Yes, it's fine for some things but can we please stop replacing every component of the stack with it?
- rubyist5eva 4y ago
  What's better?
  - superkuh 4y ago
    It's not about better. The internet is best served by having multiple options available, encrypted and clear text. When a CA based TLS service is the only option that means CAs control even more. And CAs fuck up, often, intentionally, unintentionally, and because of external pressures. The more people pile in one CA the more pressure. LetsEncrypt is great and I'm glad it exists, but everyone using it is bad for the internet's health.
    - rubyist5eva 4y ago
      I agree with you about CAs but maybe "better" wasn't the right word and what I meant is, what are the current alternatives? The only ones I know about are DoT and DoH which are mostly interchangeable.
    - spijdar 4y ago
      Is there really that significant of a difference between clear text and just accepting an arbitrary TLS cert without trusting a CA? I can understand criticizing the modern TLS/CA system if you're concerned about security, but how does clear text avoid the failings of "bad CAs" here? It's not like encrypting with a cert signed by a corrupt CA gives any entity the ability to do bad things, no more than would be possible over clear text, at least.
      - superkuh 4y ago
        In this context, as DNS over HTTPS, you're right. There's not much difference except that the provider has to only allow uses of it's DNS service that won't upset the CA TLS cert provider. And the user of DNS lookups has have a very modern computer (software-wise) to support the ever changing root certs; so using old, stable, software (and retro-computing) is further restricted. But it is much different in other contexts like HTTPS (HTTP/2 + HTTP/3) only browsers where now human people are unable to host a visitable website without getting a continued approval from a CA.
2Gkashmiri 4y ago
like my earlier comment, is there anything in the DNS that can help preventing DPI from ISP?
- elashri 4y ago
  Rate limiting is one thing you can use. Usually it is hard though with a scale.
  - 2Gkashmiri 4y ago
    rate limiting? what?
    - elashri 4y ago
      unless I misunderstood something, what I am talking about is response rate limiting [1]. It can help with defending against DNS amplification attacks [2] [1] https://www.infoblox.com/dns-security-resource-center/dns-security-solutions/dns-security-solutions-response-rate-limiting-rrl/ https://www.infoblox.com/dns-security-resource-center/dns-se... [2] https://kb.isc.org/docs/aa-01000 https://kb.isc.org/docs/aa-01000
      - 2Gkashmiri 4y ago
        sorry... my question was for residential internet connection ISP doing DPI
tinus_hn 4y ago
Never set this up, do you need a certificate for the ip address? Or how do you validate the certificate with https?
AndyMcConachie 4y ago
I run unbound on a tiny machine in my house for exactly this purpose. If you care about this kind of thing consider running your own recursive server. It is very easy. Takes almost no effort after I set it up.
- willis936 4y ago
  Just be sure to hard code the IP of an NTP server on the NTP client. I ran into a bootstrapping issue the last time I moved.
unethical_ban 4y ago
Hm, so I'm a little new to DoH, and I have it set up on my pi-hole with cloudflared and https://1.1.1.1/dns-query https://1.1.1.1/dns-query. But Mullvad shows https://doh.mullvad.net/dns-query https://doh.mullvad.net/dns-query. How does their domain get resolved if it is the resolver? They only show using it for Firefox and Android, so does the OS use "regular" DNS to resolve mullvad, then use DoH for all others? Still seems prime for a misconfiguration.
- DistractionRect 4y ago
  Yes, you usually have to bootstrap DoT or DoH with an unencrypted DNS query. If the IP is static you can add the domain to the hosts file or use the IP in place of the domain (as you can get signed tls certs for the IP address). Cloudflare does this with 1.1.1.1
- interroboink 4y ago
  It is a little small on the page[1], but see the "IP-addresses, ports and hostnames" section. In particular: > Note that the hostname is the same for both DoH and DoT despite that the subdomain is “doh”. > > DoT only uses port 853, while DoH uses port 443. > > Without ad blocking: > doh.mullvad.net has address 194.242.2.2 > doh.mullvad.net has IPv6 address 2a07:e340::2 > > With ad blocking: > adblock.doh.mullvad.net has address 194.242.2.3 > adblock.doh.mullvad.net has IPv6 address 2a07:e340::3 So, you can use hardcoded IP addresses (presumably they're static), to avoid that chicken-and-egg problem. [1] https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/ https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/
tonymet 4y ago
side note does anyone have a performance benchmark comparing UDP vs Http DNS?
naet 4y ago
Mullvad has a radical commitment to full on privacy that goes beyond other VPN providers. They won't even store your credit card info so by design there's no way to link your account back to you, even if someone seized their data or put legal pressure on them.
- devwastaken 4y ago
  If it has servers in a country, it can be seized, or ordered to monitor. Almost every country requires logs to comply with data laws, and receipts for taxes. Not all require handing over, however corps will willingly comply to avoid being regulated. Read the transparency reports for VPN's, they all actively assist law enforcement. That is the great detente that so far has fended off legislation.
strenholme 4y ago
There will come a day where I will have to give MaraDNS some form of DNS-over-HTTPS and/or DNS-over-TLS support if I want to keep it relevant. Right now, 1.1.1.1, 8.8.8.8, 9.9.9.9, and 4.2.2.1 all still support old school DNS-over-UDP, and Deadwood (part of MaraDNS) can do full recursion with just the root servers too. But, over the medium term, we will probably hit a point where unencrypted DNS stops being mainstream, just as unencrypted HTTP by and large stopped being used in the 2010s. This means that Deadwood (the caching/recursive DNS part of MaraDNS) will grow from being a tiny, efficient, 71680-byte server to being something a good deal more huge (TLS, HTTPS, etc. are really bloated compared to good old DNS-over-UDP).

265 points by mikece 4y ago

nes350 4y ago

Dead for me. Archive link: https://archive.vn/L53p4 https://archive.vn/L53p4

danpalmer 4y ago
It works fine for me.

wpietri 4y ago

Reading both this link and the previous announcement, I don't understand why they are doing this. Leaving the plain UDP port 53 option surely can't be a big burden. Is this because as a VPN they're committed to privacy? If so, I wonder if this is a net privacy gain. Some people will surely switch to the encrypted versions, but others will just go looking for a different dotted quad to drop in, one possibly less secure.

INTPenis 4y ago
I use UncensoredDNS, which is a much smaller project but also a free DNS service like Mullvad's. And they also shut down all of their unencrypted ports earlier this year. Here[1] is their reason; "The reason for this radical change is twofold: 1) I want encourage adoption of encrypted and authenticated DNS, and 2) I am sick of fighting UDP amplification attacks." 1. https://blog.uncensoreddns.org/blog/39-the-unfriendly-internet-turning-off-cleartext-lookups-in-september/ https://blog.uncensoreddns.org/blog/39-the-unfriendly-intern...
- wpietri 4y ago
  Ah, right. I have questions about the first, but the latter makes a ton of sense to me. Thanks!
- Siira 4y ago
  These encrypted DNS services are usually blocked here in Iran. The unencrypted ones are compromised, too. I use self-hosted dnscrypt.
- RobotToaster 4y ago
  Interesting, I use OpenNIC, another free DNS service, and they don't seem to have any problems.
  - pixl97 4y ago
    "Don't have any problems" and "Don't have problems that they are telling you about" are different things. They may have an abuse@opennic address they've never opened. An ignored problem isn't a problem, well until it is. Or they may deal with it and not mention the costs of doing so.
- 1vuio0pswjnm7 4y ago
  Turning off EDNS and DNSSEC would surely reduce if not eliminate the risk of amplification attacks. If anyone has the idea that traditional 512-byte UDP-based DNS is now useless, then I think that's crazy. I still use it all the time, particularly on the home network. I would be willing to bet some (not all) DoH providers are using traditional 512-byte DNS for their backend queries. I use remote DoH heavily outside the browser. I also run DoH servers on local computers.
  - LinuxBender 4y ago
    I would be willing to bet some (not all) DoH providers are using traditional 512-byte DNS for their backend queries. You are correct. In fact they have no choice in this matter unless they are just daisy-chaining to other DoH/DoT servers. The real internet still uses plain unencrypted UDP and there is no guarantee the server one is talking to supports EDNS. The root servers do not support DoT/DoH and most corporate DNS servers do not support DoH/DoT. Some of those also do not support EDNS. A small handful of the paid DNS providers offer DoT but it isn't like clients would know to use that by default. Some cell phones and some browsers are the only clients that to my knowledge will try to enumerate if DoT/DoH is available. Regarding 512 byte queries, EDNS is opportunistic. Not everyone supports it and one can not assume it is supported. That is negotiated. DNS Flag day(s) [1] were supposed to encourage everyone to enable EDNS and standard size limits of 1232. Without EDNS some traffic will revert to TCP and not everyone has that enabled to my surprise. I have a handful of DoT servers and they just talk plain UDP to the root servers. I've thought about making some of them public as a learning exercise to see what riff-raff shows up though I suspect I will be spending some time tuning rate limits and firewall rules. As a side note, I was actually surprised to find that Android figured out I had DoT on my home network and I didn't even git it any hints. Seems it just probed the gateway for 853 and got lucky. [1] - https://www.dnsflagday.net/2020/ https://www.dnsflagday.net/2020/
    - 1vuio0pswjnm7 4y ago
      There is much "probing" from "tech" companies like Google and Apple. You should try running NetGuard on Android, block everything and observe what tries to connect. It is one thing to use DoH if port 53 is being filtered, but that is a relatively small population of internet users. Forcing everyone to use DoH inside an ad-sponsored application like a web browser or a corporate OS like Android, versus providing it as an option, is questionable, IMO. Do you use OpenWRT. OpenWRT routers with mwan3 enabled by default are pinging open resolvers, public DNS caches, like GoogleDNS, Cloudflare and Cisco OpenDNS to check for connectivity. These are considered "reliable IP addresses to ping". https://web.archive.org/web/20220629175529if_/https://github.com/openwrt/packages/blob/master/net/mwan3/files/etc/config/mwan3 https://web.archive.org/web/20220629175529if_/https://github... https://openwrt.org/docs/guide-user/network/wan/multiwan/mwan3 https://openwrt.org/docs/guide-user/network/wan/multiwan/mwa... Why not ping a root server instead. Even a com nameserver is more important than Google LLC. EDNS is opportunistic but we can disable/remove it altogether before compiling our DNS servers. Or we can use DNS software, e.g., djbdns, that will never support it.
jeroenhd 4y ago
DoT and DoH are traditionally available over TCP (or reworked versions of TCP like QUIC), which have built in protections against address spoofing. Opening port 53 means having to set up a system to prevent abuse. Multiplication attacks through DNS are still as common as ever and mitigation can be incredibly difficult if a botnet is attacking a wide range of IP addresses. Putting everything behind encryption not only makes life just a tad more private (especially when using ODoH, using which your DNS server can't even know what domains your IP is visiting, though I'm not sure if they support that) while also reducing the complexity of the service they're running. There are downsides for sure, but I think they don't outweigh the benefits.
- 0xbadcafebee 4y ago
  Only the UDP version of DNS is open to amplification attacks. The TCP version of DNS (which has been supported for 30+ years) should work fine, but some shitty firewalls block it, so people have not relied upon it, and as a result it's not very reliable to use TCP DNS everywhere. Rather than deal with the problem and make UDP-based DNS obsolete ("but UDP is faster!" + "but middleboxes!" is the reason nobody wants to deal with it), people are instead pushing DoH, which just shoves DNS over an HTTPS connection. It's like, if in response to cars on a certain stretch of road hitting bicycles, you know building a protected bike lane is the best solution. But it's expensive, and it may limit parking, or the amount of lanes for cars, or their max speed. So instead you require everyone to put their bicycle in a car, or just bike on the street and risk being hit. Nobody wants to deal with the real problem, so we instead institute hacks and try to ignore the problem as long as we can. Anything to avoid expense, cooperation, re-building.
  - alexiaa 4y ago
    you may have a point about amplification attacks, but that's not the main reason DoH/DoT exists. simply using legacy DNS over TCP will not magically make it encrypted.
  - jedisct1 4y ago
    DNSCrypt mainly uses UDP, doesn't allow amplification, allows client IP anonymization.
alangibson 4y ago
> Is this because as a VPN they're committed to privacy? Almost certainly. Mullvad is way out there when it comes to privacy. They recently got rid of recurring subscriptions because they said they didn't want to store any PII.
- tpmx 4y ago
  Just to clarify: Saying no to recurring subscriptions is a BFD. They are what drive the revenue growth of every SaaS. Getting rid of them means they will earn less money in the short term (the next few years). It's very unusual. The vast majority focus primarily on getting this to work as friction-less as possible.
  - quickthrower2 4y ago
    BFD?
    - tpmx 4y ago
      Sorry. Big Fucking Deal.
- alexiaa 4y ago
  > They recently got rid of recurring subscriptions because they said they didn't want to store any PII. as much as this may be a noble goal, as a user i want to have the option of a recurring subscription, especially if i pay monthly (which i prefer to, unless i'm really committed to a service or the yearly subscription is cheap enough that i'm sure i won't regret it). if it's just one or two services doing this it's not a huge deal, but imagine getting emails from tens of different services each month to renew, especially if you have to log in and enter your credit/debit card details on each one separately. is there a reason they can't simply store a token from stripe/paypal/etc, or is that still considered PII?
  - jontas 4y ago
    It sounds like you are not their target audience, which is fine, it just means a different service would be a better option for the way you value convenience vs privacy.
josephcsible 4y ago
> Leaving the plain UDP port 53 option surely can't be a big burden. Is this because as a VPN they're committed to privacy? You're right. They are doing this to better protect their users, just like when they stopped accepting recurring payments. > Some people will surely switch to the encrypted versions, but others will just go looking for a different dotted quad to drop in, one possibly less secure. I feel like almost everyone who already went out of their way to use Mullvad in the first place will do the former.

ck2 4y ago

Is the idea behind encrypted DNS to stop manipulation of the answer given? Because it can't be privacy, any ISP or router along the way can see the source/destination IP which is "naked" and basically has to always be?

jacooper 4y ago
They can't see that its a DNS request, it appera like any normal website connection.
adgjlsfhk1 4y ago
it is privacy. The ISP and routers can see the IP addresses but that gives a lot less info than the url since most websites will pull from a changing set of IPs due to server changes, cdns, and 3rd party content (e.g. ads). For a large number of sites, the IP addresses will just tell you that someone is looking at a website hosted by cloudflare/aws. (also just getting rid of the name is effective at getting the info away from low tech surveillance like schools where someone on the route is mildly interested in seeing/blocking connections but won't bother if it's annoying to do)
- PaulHoule 4y ago
  There are many content blocking solutions that work at the DNS level. Encrypted DNS will bypass those.
  - Avamander 4y ago
    Only if you don't control the device, in which case you're dead in the water anyways.
    - PaulHoule 4y ago
      I am thinking about the system they use to censor the WiFi at the gym which works at the network level.

superkuh 4y ago

HTTPS is the systemd of protocols. Yes, it's fine for some things but can we please stop replacing every component of the stack with it?

rubyist5eva 4y ago
What's better?
- superkuh 4y ago
  It's not about better. The internet is best served by having multiple options available, encrypted and clear text. When a CA based TLS service is the only option that means CAs control even more. And CAs fuck up, often, intentionally, unintentionally, and because of external pressures. The more people pile in one CA the more pressure. LetsEncrypt is great and I'm glad it exists, but everyone using it is bad for the internet's health.
  - rubyist5eva 4y ago
    I agree with you about CAs but maybe "better" wasn't the right word and what I meant is, what are the current alternatives? The only ones I know about are DoT and DoH which are mostly interchangeable.
  - spijdar 4y ago
    Is there really that significant of a difference between clear text and just accepting an arbitrary TLS cert without trusting a CA? I can understand criticizing the modern TLS/CA system if you're concerned about security, but how does clear text avoid the failings of "bad CAs" here? It's not like encrypting with a cert signed by a corrupt CA gives any entity the ability to do bad things, no more than would be possible over clear text, at least.
    - superkuh 4y ago
      In this context, as DNS over HTTPS, you're right. There's not much difference except that the provider has to only allow uses of it's DNS service that won't upset the CA TLS cert provider. And the user of DNS lookups has have a very modern computer (software-wise) to support the ever changing root certs; so using old, stable, software (and retro-computing) is further restricted. But it is much different in other contexts like HTTPS (HTTP/2 + HTTP/3) only browsers where now human people are unable to host a visitable website without getting a continued approval from a CA.

2Gkashmiri 4y ago

like my earlier comment, is there anything in the DNS that can help preventing DPI from ISP?

elashri 4y ago
Rate limiting is one thing you can use. Usually it is hard though with a scale.
- 2Gkashmiri 4y ago
  rate limiting? what?
  - elashri 4y ago
    unless I misunderstood something, what I am talking about is response rate limiting [1]. It can help with defending against DNS amplification attacks [2] [1] https://www.infoblox.com/dns-security-resource-center/dns-security-solutions/dns-security-solutions-response-rate-limiting-rrl/ https://www.infoblox.com/dns-security-resource-center/dns-se... [2] https://kb.isc.org/docs/aa-01000 https://kb.isc.org/docs/aa-01000
    - 2Gkashmiri 4y ago
      sorry... my question was for residential internet connection ISP doing DPI

tinus_hn 4y ago

Never set this up, do you need a certificate for the ip address? Or how do you validate the certificate with https?

AndyMcConachie 4y ago

I run unbound on a tiny machine in my house for exactly this purpose. If you care about this kind of thing consider running your own recursive server. It is very easy. Takes almost no effort after I set it up.

willis936 4y ago
Just be sure to hard code the IP of an NTP server on the NTP client. I ran into a bootstrapping issue the last time I moved.

unethical_ban 4y ago

Hm, so I'm a little new to DoH, and I have it set up on my pi-hole with cloudflared and https://1.1.1.1/dns-query https://1.1.1.1/dns-query. But Mullvad shows https://doh.mullvad.net/dns-query https://doh.mullvad.net/dns-query. How does their domain get resolved if it is the resolver? They only show using it for Firefox and Android, so does the OS use "regular" DNS to resolve mullvad, then use DoH for all others? Still seems prime for a misconfiguration.

DistractionRect 4y ago
Yes, you usually have to bootstrap DoT or DoH with an unencrypted DNS query. If the IP is static you can add the domain to the hosts file or use the IP in place of the domain (as you can get signed tls certs for the IP address). Cloudflare does this with 1.1.1.1
interroboink 4y ago
It is a little small on the page[1], but see the "IP-addresses, ports and hostnames" section. In particular: > Note that the hostname is the same for both DoH and DoT despite that the subdomain is “doh”. > > DoT only uses port 853, while DoH uses port 443. > > Without ad blocking: > doh.mullvad.net has address 194.242.2.2 > doh.mullvad.net has IPv6 address 2a07:e340::2 > > With ad blocking: > adblock.doh.mullvad.net has address 194.242.2.3 > adblock.doh.mullvad.net has IPv6 address 2a07:e340::3 So, you can use hardcoded IP addresses (presumably they're static), to avoid that chicken-and-egg problem. [1] https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/ https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/

tonymet 4y ago

side note does anyone have a performance benchmark comparing UDP vs Http DNS?

naet 4y ago

Mullvad has a radical commitment to full on privacy that goes beyond other VPN providers. They won't even store your credit card info so by design there's no way to link your account back to you, even if someone seized their data or put legal pressure on them.

devwastaken 4y ago
If it has servers in a country, it can be seized, or ordered to monitor. Almost every country requires logs to comply with data laws, and receipts for taxes. Not all require handing over, however corps will willingly comply to avoid being regulated. Read the transparency reports for VPN's, they all actively assist law enforcement. That is the great detente that so far has fended off legislation.

strenholme 4y ago

There will come a day where I will have to give MaraDNS some form of DNS-over-HTTPS and/or DNS-over-TLS support if I want to keep it relevant. Right now, 1.1.1.1, 8.8.8.8, 9.9.9.9, and 4.2.2.1 all still support old school DNS-over-UDP, and Deadwood (part of MaraDNS) can do full recursion with just the root servers too. But, over the medium term, we will probably hit a point where unencrypted DNS stops being mainstream, just as unencrypted HTTP by and large stopped being used in the 2010s. This means that Deadwood (the caching/recursive DNS part of MaraDNS) will grow from being a tiny, efficient, 71680-byte server to being something a good deal more huge (TLS, HTTPS, etc. are really bloated compared to good old DNS-over-UDP).