71–77 of 77 posts
When you use a VPN (OpenVPN) is there still a way to use DNSCrypt? My VPN provider seems to force their own DNS. Tried OpenVPN config manual pages to no help.
pull-filter ignore "dhcp-option DNS"
Earlier quoted context omitted.
Hi there, I work in advertising, and I absolutely use the EDNS0 data to track users. I'm okay with a 1:250ish potential error rate since outside of facebook and google, you probably don't go to the same websites as your neighbour. Thanks for your hard work.
I'm curious: what's the reason for doing this rather than just logging the IP addresses that hit your server directly? Is this a way to get around VPNs that leak the real IP via DNS? Or does this allow you to get something back from users with ad blockers that block the request, but no the DNS lookup (I don't know if this is the case)? Is it just a performance optimization (just a DNS lookup vs. a HTTP request)?
When you use a VPN (OpenVPN) is there still a way to use DNSCrypt? My VPN provider seems to force their own DNS. Tried OpenVPN config manual pages to no help.
You need to upgrade to OpenVPN v 4.0 or greater. Then investigate the option string below: pull-filter ignore "dhcp-option DNS"
Earlier quoted context omitted.
From section 11 of the draft: "To protect users' privacy, Recursive Resolvers are strongly encouraged to conceal part of the IP address of the user by truncating IPv4 addresses to 24 bits. 56 bits are recommended for IPv6, based on [RFC6177]. ISPs should have more detailed knowledge of their own networks. That is, they might know that all 24-bit prefixes in a /20 are in the same area. In those cases, for optimal cach…
It's to return local DNS records so you resolve to a nearby server.
Earlier quoted context omitted.
It's to return local DNS records so you resolve to a nearby server.
I have one more question. DNS requests are carried by the IP protocol, so when someone makes a DNS interrogation the DNS server already gets the client's full IP address in the IP header. Isn't redundant to place (a portion of) the IP address in a DNS packet? Or maybe for some reason the DNS server is quicker to get this information from the DNS packet rather than from the IP packet's header?
Earlier quoted context omitted.
So much to respond to here. I am one of those companies running a recursive DNS service, DNSFilter.com We are not advertising driven. OpenDNS cut the ads a few years ago. We do not run open resolvers, we just have paying customers who wish to use our service. The DNS extensions you are referring to are the EDNS0 Client Subnet extension. It is in wide use by authoritative servers for major CDNs and is supported by a n…
How was OpenDNS able to cut the ads yet provide free service?
The default port of 443 is somewhat bizarre, it's almost guaranteed to conflict on a server. They could have applied to IETF / IANA for port 253 (it currently reserved / unassigned).
It is intentional. There are creepy providers out there that really want you to use their DNS so they can surveil/gaslight you, so they block or redirect traffic to well-known DNS ports. Putting it on 443 forces a choice between letting people manage their own DNS or blocking every store on the planet.
I would also say that most DNSCrypt-capable providers I know of can also do it on port 53.