DNS over TLS – Thoughts and Implementation
1–10 of 88 posts
Re: DNS over TLS – Thoughts and Implementation
#2Article starts by stating that DNS doesn't provide a means to guarantee integrity of the returned DNS data.
Then mentions DNSSEC as a protocol which exists to provide such guarantee and promptly dismisses it along with DNSCURVE and DNSCRYPT as protocols which have been so infrequently deployed as to be non-existent.
Further on states that DNS over TLS and DNS over HTTPS don't solve the integrity problem but that is ok because DNSSEC will provide that.
My head is spinning.
Re: DNS over TLS – Thoughts and Implementation
#3Article starts by stating that DNS doesn't provide a means to guarantee integrity of the returned DNS data. Then mentions DNSSEC as a protocol which exists to provide such guarantee and promptly dismisses it along with DNSCURVE and DNSCRYPT as protocols which have been so infrequently deployed as to be non-existent. Further on states that DNS over TLS and DNS over HTTPS don't solve the integrity problem but that is o…
You're correct DNSSEC and DNS-over-TLS/DoH (DNS-over-HTTPS) both provide different, and necessary, aspects of securing records in DNS.
DNSSEC == authentication of records. DNS-over-TLS/DoH == privacy, and authenticity of the server/client.
Both are independently useful and enforce different things for us. The biggest issue with DNSSEC is that since it's not been widely adopted, what should you do with records that either are not signed, or are incorrectly signed? Most software doesn't really have a great way of raising DNS issues to the application in a way that users or something else could provide a security exception.
Re: DNS over TLS – Thoughts and Implementation
#4I used Stubby and Quad9 for a few months last year but I found the latency pretty terrible unfortunately. I would be curious to hear what other people are using and what their experience has been.
Re: DNS over TLS – Thoughts and Implementation
#5I used Stubby and Quad9 for a few months last year but I found the latency pretty terrible unfortunately. I would be curious to hear what other people are using and what their experience has been.
You need to keep the connection open.
Re: DNS over TLS – Thoughts and Implementation
#6I used Stubby and Quad9 for a few months last year but I found the latency pretty terrible unfortunately. I would be curious to hear what other people are using and what their experience has been.
I used SSH SOCKS tunnels with stubby to keep myself online inside China's state firewall two recent trips. commercial VPN are routinely slowed down or blocked, if you have the luxury of an SSH enabled host "outside" you can use, Stubby and this are good, to get around DNS rewriting tricks and port/ip filters.
Yes, you have have slower paths, trombone paths. But in the circumstances I was in, Stubby was a godsend.
Also check out the dns security option in Android Pie.
Re: DNS over TLS – Thoughts and Implementation
#7I used Stubby and Quad9 for a few months last year but I found the latency pretty terrible unfortunately. I would be curious to hear what other people are using and what their experience has been.
I used SSH SOCKS tunnels with stubby to keep myself online inside China's state firewall two recent trips. commercial VPN are routinely slowed down or blocked, if you have the luxury of an SSH enabled host "outside" you can use, Stubby and this are good, to get around DNS rewriting tricks and port/ip filters. Yes, you have have slower paths, trombone paths. But in the circumstances I was in, Stubby was a godsend. Als…
Interesting. Can I ask what you used for your SSH host so that latency was bearable?
Re: DNS over TLS – Thoughts and Implementation
#8I used Stubby and Quad9 for a few months last year but I found the latency pretty terrible unfortunately. I would be curious to hear what other people are using and what their experience has been.
You need to keep the connection open.
Can't that only be done for a max of 10 seconds though? So beyond 10 seconds, you have the connection overhead all over again no?
Re: DNS over TLS – Thoughts and Implementation
#9Prediction: DNS-over-TLS won't win. I don't think it's going to be able to get around the non-standard port issue.
Instead, I think DNS-over-HTTP is gonna be the champ. The overhead of HTTP is a minor issue, but, I think using a standard port more than makes up for it. I think the real inflection point is going to be once QUIC is more widely deployed. Combined with TLS's 0-RTT connection setup, we'll be able to get back to answering a DNS query in a single round trip (like today), but with assurances that the data wasn't monitored or tampered with between the client and the recursive resolver.
Re: DNS over TLS – Thoughts and Implementation
#10Earlier quoted context omitted.
You need to keep the connection open.
Can't that only be done for a max of 10 seconds though? So beyond 10 seconds, you have the connection overhead all over again no? https://dnsprivacy.org/wiki/display/DP/Configuring+Stubby
Yes. IIRC from my testing a while back, both 1.1.1.1 and 9.9.9.9 close TLS connections either immediately or after a short timeout. Short timeout could work if you're running a larger network, but not so much at home.