7 ms·

DNSCrypt: A tool for securing communications between a client and a DNS resolver

63 points by gits1225 13y ago

jicksta2 13y ago
I had issues with DNSCrypt after using it for a few months. I had strange DNS resolution issues, felt I couldn't truly trust it, and found myself disabling/re-enabling it too often to see if it was the point of failure. I now use https://proxy.sh https://proxy.sh for a private VPN with the Viscosity VPN client which properly sends DNS traffic over the VPN. That said, I'll probably give DNSCrypt a try again in the coming months. YMMV
driverdan 13y ago
Note to DNSCrypt users: Apparently the update feature of 0.10 doesn't work. I've been running that version since it came out and it always said it's up to date. I assumed they just weren't actively developing it. Apparently it just didn't update because the current version is 0.19.
ds9 13y ago
It would be nice to have encrypted DNS, but it is pointless if the server is untrustworthy. This defaults to Open DNS, a commercial service that gives false results (replacing NXDOMAIN) unless the user signs up giving personal info! And for the same reason I don't want to use my ISP's DNS. I did a quick websearch for public DNS servers that give honest results without requiring an account, but did not see any mention of encryption compatible with this.
- dsl 13y ago
  It defaults to OpenDNS because they have been sponsoring development and run the only publicly available DNSCrypt resolvers. You are free to modify the code for the clients to point to your own server, setup your own server using the proxy code provided, or configure your authoritative DNS servers to talk securely to OpenDNS and protect the entire chain using DNSCurve (which DNSCrypt is based on).
- simcop2387 13y ago
  The best i've been able to come up with is using something like dnsmasq plus a public resolver. it'll filter the results for you so that you can have their fake A records get turned into nxdomains. it's not a perfect solution (they can change the a records and you have to reconfigure) but it certainly seems to help.
  - jedisct1 13y ago
    You don't need dnsmasq for that. dnscrypt ships with the ldns-blocking plugin to block list of domains and IPs: https://github.com/jedisct1/dnscrypt-proxy/blob/master/src/plugins/example-ldns-blocking/example-ldns-blocking.c https://github.com/jedisct1/dnscrypt-proxy/blob/master/src/p...
flueedo 13y ago
I've been using DNSCrypt on linux for probably a year. The only issue I had a few times some months ago was that the first nameserver would stop responding, the solution would be to switch to the second nameserver. Lately though I haven't had any issues, for me at least it has been fast and reliable.
bcl 13y ago
This isn't any better than using Google's DNS, your ISP's or OpenDNS directly. All your requests eventually go through a central location where they can be logged. Better to install your own caching dns server so they at least can't do traffic analysis on your repeat requests.
- apendleton 13y ago
  Depends on what you're trying to do. If you're trying to avoid logging, then sure, this doesn't get you much. If you're trying to secure yourself against local-network DNS attacks, this could be useful. There's also nothing to stop you from using a caching DNS server with DNScrypt (in fact, they give you instructions to do so).
  - jedisct1 13y ago
    Run dnscrypt-wrapper or unbound on your router. Then run dnscrypt-proxy or dnssec-trigger on your clients. You get secured against local-network DNS attacks, and this let you use any upstream resolvers (or none).
- dsl 13y ago
  OpenDNS has open sourced technology that allows you to secure DNS against eavesdropping, something no other technology will let you do at the DNS level (DNSSEC only does security, not privacy). They are also a major backer of DNSCrypt which provides transport security between recursive and authoritative servers. Without OpenDNS'es work, your cute little caching DNS server at home is still subject to the same interception as queries flowing to your ISPs DNS cache. So what if they optionally replace some NXDOMAIN queries so they can make a little bit of money? If they didn't have a business model that was up front, you'd claim they were obviously funded by the government. We as a community need to not be so hard on commercial companies that are actually trying to protect us. Some of them are ran by genuine geeks like us and trying to help out.
  - blibble 13y ago
    let's be honest here: they've released this in an attempt to stop/muddle DNSSEC adoption, as DNSSEC represents an existential threat to their business: messing with the answers to DNS requests
ecesena 13y ago
How does it compare to DNSCurve (http://dnscurve.org http://dnscurve.org)?
- jedisct1 13y ago
  How does it compare to DNSSIG? (http://dnssig.org http://dnssig.org)?
  - ecesena 13y ago
    I think DNSSIG is (at least designed) more for relationships among DNS servers and especially to protect the integrity of the DNS records, while this project seems more for securing the client-to-relay channel, with (I guess) focus on confidentiality.
    - jedisct1 13y ago
      Both focus on integrity. Read the dnscrypt project description and grep for "authentic", then grep for "encrypt". DNS confidentiality is useful when running an IP-over-DNS tunnel like iodine, not so much in combination with other protocols.
jedisct1 13y ago
I don't get why this is on the HN front page. dnscrypt is 2 years old, and nothing special happened to it lately. Did I miss something?

63 points by gits1225 13y ago

I had issues with DNSCrypt after using it for a few months. I had strange DNS resolution issues, felt I couldn't truly trust it, and found myself disabling/re-enabling it too often to see if it was the point of failure. I now use https://proxy.sh https://proxy.sh for a private VPN with the Viscosity VPN client which properly sends DNS traffic over the VPN. That said, I'll probably give DNSCrypt a try again in the coming months. YMMV

driverdan 13y ago

Note to DNSCrypt users: Apparently the update feature of 0.10 doesn't work. I've been running that version since it came out and it always said it's up to date. I assumed they just weren't actively developing it. Apparently it just didn't update because the current version is 0.19.

ds9 13y ago

It would be nice to have encrypted DNS, but it is pointless if the server is untrustworthy. This defaults to Open DNS, a commercial service that gives false results (replacing NXDOMAIN) unless the user signs up giving personal info! And for the same reason I don't want to use my ISP's DNS. I did a quick websearch for public DNS servers that give honest results without requiring an account, but did not see any mention of encryption compatible with this.

dsl 13y ago
It defaults to OpenDNS because they have been sponsoring development and run the only publicly available DNSCrypt resolvers. You are free to modify the code for the clients to point to your own server, setup your own server using the proxy code provided, or configure your authoritative DNS servers to talk securely to OpenDNS and protect the entire chain using DNSCurve (which DNSCrypt is based on).
simcop2387 13y ago
The best i've been able to come up with is using something like dnsmasq plus a public resolver. it'll filter the results for you so that you can have their fake A records get turned into nxdomains. it's not a perfect solution (they can change the a records and you have to reconfigure) but it certainly seems to help.
- jedisct1 13y ago
  You don't need dnsmasq for that. dnscrypt ships with the ldns-blocking plugin to block list of domains and IPs: https://github.com/jedisct1/dnscrypt-proxy/blob/master/src/plugins/example-ldns-blocking/example-ldns-blocking.c https://github.com/jedisct1/dnscrypt-proxy/blob/master/src/p...

flueedo 13y ago

I've been using DNSCrypt on linux for probably a year. The only issue I had a few times some months ago was that the first nameserver would stop responding, the solution would be to switch to the second nameserver. Lately though I haven't had any issues, for me at least it has been fast and reliable.

bcl 13y ago

This isn't any better than using Google's DNS, your ISP's or OpenDNS directly. All your requests eventually go through a central location where they can be logged. Better to install your own caching dns server so they at least can't do traffic analysis on your repeat requests.

apendleton 13y ago
Depends on what you're trying to do. If you're trying to avoid logging, then sure, this doesn't get you much. If you're trying to secure yourself against local-network DNS attacks, this could be useful. There's also nothing to stop you from using a caching DNS server with DNScrypt (in fact, they give you instructions to do so).
- jedisct1 13y ago
  Run dnscrypt-wrapper or unbound on your router. Then run dnscrypt-proxy or dnssec-trigger on your clients. You get secured against local-network DNS attacks, and this let you use any upstream resolvers (or none).
dsl 13y ago
OpenDNS has open sourced technology that allows you to secure DNS against eavesdropping, something no other technology will let you do at the DNS level (DNSSEC only does security, not privacy). They are also a major backer of DNSCrypt which provides transport security between recursive and authoritative servers. Without OpenDNS'es work, your cute little caching DNS server at home is still subject to the same interception as queries flowing to your ISPs DNS cache. So what if they optionally replace some NXDOMAIN queries so they can make a little bit of money? If they didn't have a business model that was up front, you'd claim they were obviously funded by the government. We as a community need to not be so hard on commercial companies that are actually trying to protect us. Some of them are ran by genuine geeks like us and trying to help out.
- blibble 13y ago
  let's be honest here: they've released this in an attempt to stop/muddle DNSSEC adoption, as DNSSEC represents an existential threat to their business: messing with the answers to DNS requests

ecesena 13y ago

How does it compare to DNSCurve (http://dnscurve.org http://dnscurve.org)?

jedisct1 13y ago
How does it compare to DNSSIG? (http://dnssig.org http://dnssig.org)?
- ecesena 13y ago
  I think DNSSIG is (at least designed) more for relationships among DNS servers and especially to protect the integrity of the DNS records, while this project seems more for securing the client-to-relay channel, with (I guess) focus on confidentiality.
  - jedisct1 13y ago
    Both focus on integrity. Read the dnscrypt project description and grep for "authentic", then grep for "encrypt". DNS confidentiality is useful when running an IP-over-DNS tunnel like iodine, not so much in combination with other protocols.

jedisct1 13y ago

I don't get why this is on the HN front page. dnscrypt is 2 years old, and nothing special happened to it lately. Did I miss something?