3 ms·
It would be nice to have encrypted DNS, but it is pointless if the server is untrustworthy. This defaults to Open DNS, a commercial service that gives false re
by ds9 13y ago
It would be nice to have encrypted DNS, but it is pointless if the server is untrustworthy. This defaults to Open DNS, a commercial service that gives false results (replacing NXDOMAIN) unless the user signs up giving personal info!
And for the same reason I don't want to use my ISP's DNS. I did a quick websearch for public DNS servers that give honest results without requiring an account, but did not see any mention of encryption compatible with this.
- dsl 13y agoIt defaults to OpenDNS because they have been sponsoring development and run the only publicly available DNSCrypt resolvers. You are free to modify the code for the clients to point to your own server, setup your own server using the proxy code provided, or configure your authoritative DNS servers to talk securely to OpenDNS and protect the entire chain using DNSCurve (which DNSCrypt is based on).
- simcop2387 13y agoThe best i've been able to come up with is using something like dnsmasq plus a public resolver. it'll filter the results for you so that you can have their fake A records get turned into nxdomains. it's not a perfect solution (they can change the a records and you have to reconfigure) but it certainly seems to help.
- jedisct1 13y agoYou don't need dnsmasq for that. dnscrypt ships with the ldns-blocking plugin to block list of domains and IPs: https://github.com/jedisct1/dnscrypt-proxy/blob/master/src/plugins/example-ldns-blocking/example-ldns-blocking.c https://github.com/jedisct1/dnscrypt-proxy/blob/master/src/p...