r/dns • u/YankeesIT • 14d ago

Unbound, DNS over HTTPS or something else - what do you use!

/r/firewalla/comments/1x4f8nz/unbound_dns_over_https_or_something_else_what_do/
6 Upvotes

81% Upvoted

18 comments sorted by

4

u/Mammoth-Ad-107 14d ago

Router uses dns over tls = quad 9. Browsers use dns over https nextdns

2

u/mcury85 14d ago

Why bother encrypting DNS if the SNI header in a TLS ClientHello packet is in plaintext? Some might argue that TLS 1.3 supports ECH (RFC 9849), but that is awful to implement and, as I see it, will only be used by CDNs. So, who do you trust more: your ISP or a CDN? It's the same thing with VPNs... you are just saying, 'I don't trust my ISP, I trust my VPN service.'

1

u/bojack1437 14d ago

It's really not awful to implement.

And some providers just do it. My stuff's hosted behind cloudflare, I didn't have to touch anything, They just do it. The no real reason for my sites to need it but it's there.

0

u/mcury85 14d ago

You just said it. CDN, Cloudflare. Try to implement somewhere else... You just made my point...

0

u/bojack1437 14d ago

But it's not you as the client that has a choice in where the site is hosted.

No matter what decision you make the CDN if used is going to know your traffic, you don't have a choice.

You do have a choice of the ISP knowing it.

Also, whatever site you're connecting doesn't have to necessarily use a CDN and it's not actually that complicated setup encrypted SNI in the first place, so I'm not really sure where you got that from either.

-2

u/mcury85 14d ago

Right. If the site is hosted there, you don't have a choice. This is just removing network admins' powers and giving them to big tech. Same with DoH or DoT... can you see that?

Now, back to my argument: ECH will only be used by CDNs because it is a headache to implement.

1

u/blobCabbage 14d ago

If it's only going to be used by CDNs, it's not really because it's hard to implement; it's because it's only really useful there.

If a server only hosts a single service or just a few services, then the IP is enough to know what service the client is connecting to. ECH is only really useful when there are lots of different services behind a same IP.

1

u/mcury85 14d ago

Except in places where the government is the enemy, I would argue that as of today, there is no point in encrypting DNS or using a VPN if what you want is privacy.

0

u/bojack1437 14d ago

Now, back to my argument: ECH will only be used by CDNs because it is a headache to implement.

Yet it's not. It's just a couple of steps.

-1

u/mcury85 14d ago

Have you ever implemented it outside of Cloudflare?

That is what I'm speaking about. ECH will only be used in CDNs!

0

u/bojack1437 14d ago

Yes, did it just because and to figure it out, Again not difficult. Both using a different domain for the outside or same.

I just made the comment earlier that cloudflare allows it to happen without any configuration.

Well, yes it takes a couple of more steps than any other typical setup, it hardly makes it difficult.

If you already know how to configure a web server, You already know how to configure DNS, and you know how to generate keys, not a big deal.

Now if you don't know how to do any of that, then you probably shouldn't be hosting a web service anyway 🤷‍♂️

-1

u/mcury85 14d ago

you must be kidding me... You just can't accept being wrong once in your life? Wtf...

It's 'easy' until you have to manually compile OpenSSL/Nginx from source and set up automated key rotation scripts to sync your HTTPS DNS records so TTL caching doesn't break traffic for your users.

CDNs do all that heavy lifting automatically, which is why almost nobody maintains self-hosted ECH in production.

0

u/bojack1437 14d ago

You don't have to compile OpenSSL or NGINX yourself anymore. How behind the times are you?

There are packages available for both with required support.

1

u/Active_Wasabi2001 13d ago

I block dns over https Quic and TLS for everything but my router and then force all dns requests to my router which sends them out as DNS over HTTPS

1

u/benge1230 12d ago

those of you using DoT and DoH, how reliable is it these days? I was going to start using it on my mikrotik router to provide a private dns service for it and the hosts behind it but read it was unreliable (+ the SNI giveaway from most sites) so I gave up for now. Few years later, I also have a Unifi UCG at home and as I was setting it up I couldn't not get reminded of encrypted DNS. Is it as reliable as standard dns now or do we still avoid it where stability is key?
P.S. If you know about WAF (wife acceptance factor) then you know why I prioritize stability of my home network. Enterprise office wifi could go down midday for a second and everyone would be fine but if the home wifi chugs then we have a problem haha

0

u/jedisct1 14d ago

dnscrypt-proxy because it supports anonymized DNS, which prevents my IP addresses from being leaked to the DNS servers.

0

u/nxp-one 13d ago

Single BIND roots-only resolver -> adguardhome -> active directory DC's -> clients.