Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Public DNS Now Supports DNS-Over-TLS

security.googleblog.com

Post reply on HN
Print view View original

1–10 of 15 posts

Re: Google Public DNS Now Supports DNS-Over-TLS

#2

Post by m_sahaf »

I've been running a local DNS to DNS-over-TLS proxy on my machine for quite awhile using CoreDNS. The entire Corefile is:

  # Capture plain DNS requests and proxy them to DNS-over-TLS

  .:53 {
      forward . 127.0.0.1:5301 127.0.0.1:5302 127.0.0.1:5303 [::1]:5301 [::1]:5302 [::1]:5303
      log . {
          class error
      }
      cache
  }

  # Quad9 DNS. Differentiator: Automatically blocks domains known to be associated with malicious activity

  .:5301 {
      forward . tls://9.9.9.9 {
          tls_servername dns.quad9.net
      }
      cache
  }

  # Cloudflare. Differentiator: Fast and uses EDNS Padding

  .:5302 {
      forward . tls://1.1.1.1 tls://1.0.0.1 {
          tls_servername tls.cloudflare-dns.com
      }
      cache
  }

  # Google. Differentiator: ... Google?

  .:5303 {
      forward . tls://8.8.8.8 tls://8.8.4.4 {
          tls_servername dns.google
      }
      cache
  }
It's really easy to throw on more resolvers as they come. The last one for Google was just added today.

Re: Google Public DNS Now Supports DNS-Over-TLS

#3

Post by _nhynes_ »

Here's the stubby config if anyone is interested:

  # Google
  - address_data: 8.8.8.8
    tls_auth_name: "dns.google"
    tls_pubkey_pinset:
      - digest: "sha256"
        value: nxmRHK4Oq08HNWWYZwakeCHmiKvsDsEaBPS3blQ+nSE=
  - address_data: 8.8.4.4
    tls_auth_name: "dns.google"
    tls_pubkey_pinset:
      - digest: "sha256"
        value: nxmRHK4Oq08HNWWYZwakeCHmiKvsDsEaBPS3blQ+nSE=
where the pinset is generated using

  openssl s_client -connect '8.8.8.8:853' 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
source: https://blog.because-security.com/t/use-cloudflare-dns-with-...

Re: Google Public DNS Now Supports DNS-Over-TLS

#5

Post by _8j50 »

crsv wrote: post #4

What are the implications of this for those of us unfamiliar with DNS feature space?

Your DNS queries are encrypted using TLS. For optimum privacy,use this with eSNI(encrypted server name indicator for TLS).

Cloudlfare's 1.1.1.1 supports it as well which I highly recommend over Google.

Re: Google Public DNS Now Supports DNS-Over-TLS

#6

Post by bewo001 »

_8j50 wrote: post #5
crsv wrote: post #4

What are the implications of this for those of us unfamiliar with DNS feature space?

Your DNS queries are encrypted using TLS. For optimum privacy,use this with eSNI(encrypted server name indicator for TLS). Cloudlfare's 1.1.1.1 supports it as well which I highly recommend over Google.

This is a DNS provided by Google, a company that earns money by analysing user data. If you want privacy, run your own DNS.

Re: Google Public DNS Now Supports DNS-Over-TLS

#7

Post by londons_explore »

bewo001 wrote: post #6
_8j50 wrote: post #5

Earlier quoted context omitted.

Your DNS queries are encrypted using TLS. For optimum privacy,use this with eSNI(encrypted server name indicator for TLS). Cloudlfare's 1.1.1.1 supports it as well which I highly recommend over Google.

This is a DNS provided by Google, a company that earns money by analysing user data. If you want privacy, run your own DNS.

Google has specifically stated that logs from Google DNS are not retained long term, and will never be correlated from logs from other Google services.

I trust those claims.

Re: Google Public DNS Now Supports DNS-Over-TLS

#8

Post by aorth »

It wasn't obvious to me immediately, but the hostname of Google's DNS-over-TLS servers is: dns.google

This is important for validating the TLS certificate that is provided by their servers on 8.8.8.8 and 8.8.4.4 (equivalent to requiring a matching hostname for TLS certificates in web browsers). I see that other commenters in this thread have correctly used this hostname in their examples for CoreDNS and Stubby.

Part of a configuration for the Unbound DNS server would look like:

  forward-zone:
    name: "."
    forward-tls-upstream: yes
    forward-addr: 8.8.8.8@853#dns.google
    forward-addr: 8.8.4.4@853#dns.google
See the configuration guide for using DNS-over-TLS on unbound on the DNS Privacy site: https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Clients#D...

Re: Google Public DNS Now Supports DNS-Over-TLS

#10

Post by _8j50 »

londons_explore wrote: post #7
bewo001 wrote: post #6

Earlier quoted context omitted.

This is a DNS provided by Google, a company that earns money by analysing user data. If you want privacy, run your own DNS.

Google has specifically stated that logs from Google DNS are not retained long term, and will never be correlated from logs from other Google services. I trust those claims.

Why do you trust those claims? And why can't they change their mind?
Post reply on HN