DNSCrypt: A tool for securing communications between a client and a DNS resolver
1–10 of 31 posts
Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver
#2I had issues with DNSCrypt after using it for a few months. I had strange DNS resolution issues, felt I couldn't truly trust it, and found myself disabling/re-enabling it too often to see if it was the point of failure. I now use https://proxy.sh for a private VPN with the Viscosity VPN client which properly sends DNS traffic over the VPN.
That said, I'll probably give DNSCrypt a try again in the coming months. YMMV
Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver
#3Note to DNSCrypt users: Apparently the update feature of 0.10 doesn't work. I've been running that version since it came out and it always said it's up to date. I assumed they just weren't actively developing it. Apparently it just didn't update because the current version is 0.19.
Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver
#4It would be nice to have encrypted DNS, but it is pointless if the server is untrustworthy. This defaults to Open DNS, a commercial service that gives false results (replacing NXDOMAIN) unless the user signs up giving personal info!
And for the same reason I don't want to use my ISP's DNS. I did a quick websearch for public DNS servers that give honest results without requiring an account, but did not see any mention of encryption compatible with this.
Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver
#5I've been using DNSCrypt on linux for probably a year. The only issue I had a few times some months ago was that the first nameserver would stop responding, the solution would be to switch to the second nameserver. Lately though I haven't had any issues, for me at least it has been fast and reliable.
Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver
#6This isn't any better than using Google's DNS, your ISP's or OpenDNS directly. All your requests eventually go through a central location where they can be logged. Better to install your own caching dns server so they at least can't do traffic analysis on your repeat requests.
Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver
#7It would be nice to have encrypted DNS, but it is pointless if the server is untrustworthy. This defaults to Open DNS, a commercial service that gives false results (replacing NXDOMAIN) unless the user signs up giving personal info! And for the same reason I don't want to use my ISP's DNS. I did a quick websearch for public DNS servers that give honest results without requiring an account, but did not see any mention…
It defaults to OpenDNS because they have been sponsoring development and run the only publicly available DNSCrypt resolvers.
You are free to modify the code for the clients to point to your own server, setup your own server using the proxy code provided, or configure your authoritative DNS servers to talk securely to OpenDNS and protect the entire chain using DNSCurve (which DNSCrypt is based on).
Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver
#8This isn't any better than using Google's DNS, your ISP's or OpenDNS directly. All your requests eventually go through a central location where they can be logged. Better to install your own caching dns server so they at least can't do traffic analysis on your repeat requests.
Depends on what you're trying to do. If you're trying to avoid logging, then sure, this doesn't get you much. If you're trying to secure yourself against local-network DNS attacks, this could be useful.
There's also nothing to stop you from using a caching DNS server with DNScrypt (in fact, they give you instructions to do so).
Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver
#9This isn't any better than using Google's DNS, your ISP's or OpenDNS directly. All your requests eventually go through a central location where they can be logged. Better to install your own caching dns server so they at least can't do traffic analysis on your repeat requests.
OpenDNS has open sourced technology that allows you to secure DNS against eavesdropping, something no other technology will let you do at the DNS level (DNSSEC only does security, not privacy). They are also a major backer of DNSCrypt which provides transport security between recursive and authoritative servers.
Without OpenDNS'es work, your cute little caching DNS server at home is still subject to the same interception as queries flowing to your ISPs DNS cache.
So what if they optionally replace some NXDOMAIN queries so they can make a little bit of money? If they didn't have a business model that was up front, you'd claim they were obviously funded by the government.
We as a community need to not be so hard on commercial companies that are actually trying to protect us. Some of them are ran by genuine geeks like us and trying to help out.
Re: DNSCrypt: A tool for securing communications between a client and a DNS resolver
#10This isn't any better than using Google's DNS, your ISP's or OpenDNS directly. All your requests eventually go through a central location where they can be logged. Better to install your own caching dns server so they at least can't do traffic analysis on your repeat requests.
OpenDNS has open sourced technology that allows you to secure DNS against eavesdropping, something no other technology will let you do at the DNS level (DNSSEC only does security, not privacy). They are also a major backer of DNSCrypt which provides transport security between recursive and authoritative servers. Without OpenDNS'es work, your cute little caching DNS server at home is still subject to the same intercep…
let's be honest here: they've released this in an attempt to stop/muddle DNSSEC adoption, as DNSSEC represents an existential threat to their business: messing with the answers to DNS requests