6 ms·

Mullvad encrypted DNS is also available to all - whether paying for VPN services or not. In addition they also support optional content blocking[1] via blockli

Mullvad encrypted DNS is also available to all - whether paying for VPN services or not. In addition they also support optional content blocking[1] via blocklists, just set the desired TLS/HTTPS DNS server. [1] https://github.com/mullvad/dns-blocklists https://github.com/mullvad/dns-blocklists

Etheryte 3y ago
FYI the standalone encrypted DNS profiles for macOS (.mobileconfig files) do not work if you're using Little Snitch or Lulu to block unwanted network traffic. This is a limitation of macOS that Apple hasn't bothered to fix.
- WirelessGigabit 3y ago
  Doesn't work how? Little Snitch / Lulu don't use the profile? As in DNS traffic is not encrypted? Little Snitch / Lulu die? Do you have like a ticket for more explanation?
  - Etheryte 3y ago
    You can have one or the other active at a time, but not both simultaneously. If you have the DNS profile turned on and then proceed to turn on Little Snitch/Lulu, the DNS profile will get turned off by macOS and whatever other DNS configuration you have will take precedence. It's mentioned in passing by Mullvad in the docs [0]: > If you have more than one profile added then macOS seems to use only the last one that you installed. If you remove a profile then it appears that it will not use any of the other profiles. This isn't unique to Little Snitch/Lulu and Mullvad though, you would run into the same problem with any application that creates a network filter by using a profile, see [1] for example. Since the full blown Mullvad VPN app does not use system profiles, it does work in tandem with Little Snitch/Lulu. [0] https://mullvad.net/en/help/dns-over-https-and-dns-over-tls#macOS https://mullvad.net/en/help/dns-over-https-and-dns-over-tls#... [1] https://git.codeproxy.net/paulmillr/encrypted-dns/issues/13 https://git.codeproxy.net/paulmillr/encrypted-dns/issues/13
    - TheNewsIsHere 3y ago
      As a tangential aside: this limitation on Network Extensions is infuriating. I can understand why it exists, but one of the results is that if you’re using an Endpoint Security extension, it can’t also act as a filter. I’ve never been able to get CrowdStrike Falcon and Little Snitch to work on the same machine because of this. It would be nice if you could have n filters (and a limit on n isn’t unreasonable).
- Erratic6576 3y ago
  I guess the solution is to use unbound
- quyleanh 3y ago
  Even when I don’t use any firewall app, the DNS profile doesn’t work on macOS. There is a bug that other apps (and even system) can bypass it. Not like in iOS, DNS profile work very well.
SV_BubbleTime 3y ago
Can you help me out with the threat model for encrypted DNS? As I see it, the model is that I need to contact a site, and use DNS to get the IP - but either my ISP or my VPN provider can see I’m visiting that IP whether I looked it up just now, or knew it already. So unless the model is I’m using a VPN, but am leaking via someone else’s logging DNS, I don’t really get it.
- Etheryte 3y ago
  Personally my main motivation is I don't want anyone to snoop what sites I visit and then sell that data, my ISP included, but there are other issues too. To quote Cloudflare [0]: > Queries could be directed to a resolver that performs DNS hijacking. For example, in the UK, Virgin Media and BT return a fake response for domains that do not exist, redirecting users to a search page. This redirection is possible because the computer/phone blindly trusts the DNS resolver that was advertised using DHCP by the ISP-provided gateway router. [0] https://blog.cloudflare.com/dns-encryption-explained/ https://blog.cloudflare.com/dns-encryption-explained/
  - _Algernon_ 3y ago
    Cant your ISP reverse lookup the IPs you connect to based on your IP headers anyways?
    - jrockway 3y ago
      They can, but pretty much everything will reverse lookup to Cloudflare or AWS.
      - gruez 3y ago
        SNI reveals the exact site though
        mmwelt 3y ago
        As I understand it, this is now being addressed by ESNI[1] and ECH[2]. Hopefully ECH will continue being more widely deployed. [1] https://www.cloudflare.com/learning/ssl/what-is-encrypted-sni/ https://www.cloudflare.com/learning/ssl/what-is-encrypted-sn... [2] https://blog.cloudflare.com/encrypted-client-hello/ https://blog.cloudflare.com/encrypted-client-hello/

Etheryte 3y ago

FYI the standalone encrypted DNS profiles for macOS (.mobileconfig files) do not work if you're using Little Snitch or Lulu to block unwanted network traffic. This is a limitation of macOS that Apple hasn't bothered to fix.

WirelessGigabit 3y ago
Doesn't work how? Little Snitch / Lulu don't use the profile? As in DNS traffic is not encrypted? Little Snitch / Lulu die? Do you have like a ticket for more explanation?
- Etheryte 3y ago
  You can have one or the other active at a time, but not both simultaneously. If you have the DNS profile turned on and then proceed to turn on Little Snitch/Lulu, the DNS profile will get turned off by macOS and whatever other DNS configuration you have will take precedence. It's mentioned in passing by Mullvad in the docs [0]: > If you have more than one profile added then macOS seems to use only the last one that you installed. If you remove a profile then it appears that it will not use any of the other profiles. This isn't unique to Little Snitch/Lulu and Mullvad though, you would run into the same problem with any application that creates a network filter by using a profile, see [1] for example. Since the full blown Mullvad VPN app does not use system profiles, it does work in tandem with Little Snitch/Lulu. [0] https://mullvad.net/en/help/dns-over-https-and-dns-over-tls#macOS https://mullvad.net/en/help/dns-over-https-and-dns-over-tls#... [1] https://git.codeproxy.net/paulmillr/encrypted-dns/issues/13 https://git.codeproxy.net/paulmillr/encrypted-dns/issues/13
  - TheNewsIsHere 3y ago
    As a tangential aside: this limitation on Network Extensions is infuriating. I can understand why it exists, but one of the results is that if you’re using an Endpoint Security extension, it can’t also act as a filter. I’ve never been able to get CrowdStrike Falcon and Little Snitch to work on the same machine because of this. It would be nice if you could have n filters (and a limit on n isn’t unreasonable).
Erratic6576 3y ago
I guess the solution is to use unbound
quyleanh 3y ago
Even when I don’t use any firewall app, the DNS profile doesn’t work on macOS. There is a bug that other apps (and even system) can bypass it. Not like in iOS, DNS profile work very well.

SV_BubbleTime 3y ago

Can you help me out with the threat model for encrypted DNS? As I see it, the model is that I need to contact a site, and use DNS to get the IP - but either my ISP or my VPN provider can see I’m visiting that IP whether I looked it up just now, or knew it already. So unless the model is I’m using a VPN, but am leaking via someone else’s logging DNS, I don’t really get it.

Etheryte 3y ago
Personally my main motivation is I don't want anyone to snoop what sites I visit and then sell that data, my ISP included, but there are other issues too. To quote Cloudflare [0]: > Queries could be directed to a resolver that performs DNS hijacking. For example, in the UK, Virgin Media and BT return a fake response for domains that do not exist, redirecting users to a search page. This redirection is possible because the computer/phone blindly trusts the DNS resolver that was advertised using DHCP by the ISP-provided gateway router. [0] https://blog.cloudflare.com/dns-encryption-explained/ https://blog.cloudflare.com/dns-encryption-explained/
- _Algernon_ 3y ago
  Cant your ISP reverse lookup the IPs you connect to based on your IP headers anyways?
  - jrockway 3y ago
    They can, but pretty much everything will reverse lookup to Cloudflare or AWS.
    - gruez 3y ago
      SNI reveals the exact site though
      - mmwelt 3y ago
        As I understand it, this is now being addressed by ESNI[1] and ECH[2]. Hopefully ECH will continue being more widely deployed. [1] https://www.cloudflare.com/learning/ssl/what-is-encrypted-sni/ https://www.cloudflare.com/learning/ssl/what-is-encrypted-sn... [2] https://blog.cloudflare.com/encrypted-client-hello/ https://blog.cloudflare.com/encrypted-client-hello/