6.6 KiB

Raw Blame History

layout	title	subtitle	description	cover	date
post	Setting DoT on mobile and desktop	Enhancing your personal privacy by setting custom DoT servers on all your devices	Enhancing your personal privacy by setting custom DoT servers on all your devices	/assets/pages/dns.png	2019-07-20 19:09 -0400

Changing your default DNS servers to ones that use DNS-over-TLS can do a lot to make your systems more secure and private. DNS is also a serious tool for censorship and tracking if used foolishly. Before choosing a provider, make sure you actually read their privacy policy and terms of service. There are some good recommendations here (I'm partial to UncensoredDNS) and of course I have to shill my own. Once you've chosen a provider, you'll need to get set up.

Basic Information

For the very basics, I recommend reading sections 1 - 2 of a previous post. It has good information and sets you up for this article.

Another useful term to know is Anycast. A lot of servers (including mine) have it set up so you only have to set and remember one IP address or hostname and you automatically use the server geographically nearest to you, the one with the lowest latency.

DoT stands for DNS-over-TLS. It's a protocol that wraps DNS queries and responses in the TLS protocol. By default, most systems use plaintext DNS and this is very insecure. Plaintext is . . . plaintext; anyone can snoop on your connection and see what websites you're visiting. If you're using DNS-over-TLS, the only parties that know where you're going is you and the DNS server itself. This article focuses on that because it's more secure and private. DNS-over-HTTPS (DoH) is another option but far fewer clients support it, it's more difficult to set up, and there are far fewer DoH providers.

Setup

Linux, Windows, and Android are all fairly simple to set up. I don't have any Apple products so I the information there likely won't be complete or particularly good. I still recommend reading it, however.

Linux

Unbound is what I use for DNS on all of my systems. It's wonderfully easy to use and works very well. Once you've used it for a while and have built up a cache, it's much faster than third-party resolvers.

(stolen from here)

Filename: /etc/unbound/unbound.conf

Debian

include: "/etc/unbound/unbound.conf.d/*.conf"

server:
  tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt

forward-zone:
  name: "."
  forward-tls-upstream: yes

  forward-addr: 198.251.90.114@853#uncensored.any.nixnet.xyz
  forward-addr: 212.83.138.44@853#resolver1.lelux.fi
  forward-addr: 91.239.100.100@853#anycast.censurfridns.dk
  forward-addr: 185.95.218.42@853#dns.digitale-gesellschaft.ch

Arch

include: "/etc/unbound/unbound.conf.d/*.conf"

server:
  use-syslog: yes
  do-daemonize: no
  username: "unbound"
  directory: "/etc/unbound"
  # TODO: fix DNSSEC check
  # trust-anchor-file: trusted-key.key
  tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt

forward-zone:
  name: "."
  forward-tls-upstream: yes

  forward-addr: 198.251.90.114@853#uncensored.any.nixnet.xyz
  forward-addr: 212.83.138.44@853#resolver1.lelux.fi
  forward-addr: 91.239.100.100@853#anycast.censurfridns.dk
  forward-addr: 185.95.218.42@853#dns.digitale-gesellschaft.ch

Using Unbound as a local resolver

echo "nameserver 127.0.0.1" | sudo tee /etc/resolv.conf && sudo chattr +i /etc/resolv.conf

This sets 127.0.0.1 as your nameserver and locks the file by adding the immutable flag (chattr +i). To remove the flag and make it editable again, run chattr -i /etc/resolv.conf.

Windows

I know the title is for DNS-over-TLS but, from what I've found, DoT on Windows is incredibly difficult and I can't find much on it. This tell you how to change your plaintext DNS configuration.

Open the Control Panel
Click Network and Internet
Click Network and Sharing Center
Click Change adapter settings in the left pane
Right-click the network interface connected to the internet, and select the Properties option
Select and check the Internet Protocol Version 4 (TCP/IPv4) option
Click the Properties button
Click Use the following DNS server addresses
Enter your primary and secondary DNS addresses. If you're using mine, the primary would be 198.251.90.114 and secondary would be from some other provider (such as UncensoredDNS's 91.239.100.100)
Click OK
As with all things Windows, reboot to finish applying the changes.

macOS

I got this tutorial from phiffer.org. I don't have anything from Apple so I can't test it but a friend of mine did and said it works.

Use Homebrew to install knot-resolver then set up a service so it runs on startup with sudo brew services start knot-resolver
Use your favourite text editor to modify /usr/local/etc/kresd/config and add this to the very end of the file: {% raw %}policy.add(policy.all(policy.TLS_FORWARD({{'198.251.90.114', hostname='uncensored.any.dns.nixnet.xyz'}}))){% endraw %}
Restart kresd with sudo brew services restart knot-resolver
At this point, you should check what DNS server you're currently using to make sure it actually changes. You can do that with kdig nixnet.xyz
Go to Apple Menu > System Preferences > Advanced > DNS then add 127.0.0.1
Test again with kdig nixnet.xyz. This time, one of the last couple IP addresses you see should show up something like 127.0.0.1@53(UDP).

That's it!

Android

Note that DoT is only available on Android Pie and up. For other versions, try Nebulo. I go over the process of installing and using it in my last post. Once you've gone through that, you're pretty much good to. If you want to add additional servers tap the server icon, then the plus at the bottom, and add whatever IP addresses or hostnames you'd like. Mine is included by default as NixNet Uncensored so all you have to do is select it.

iOS

As far as I've been able to find, you can't. I'm sorry ¯\_(ツ)_/¯

6.6 KiB Raw Blame History