Getting Started with DNS over HTTPS on Firefox (opens in new tab)

This concern started being addressed in the latest DoH draft.

I know people are working on encrypted SNI but that will take time.

I have no clue how often this attack vector has been used in the real world, but last time I read about it, I got the impression that it would not be very hard for a skilled attacker to pull off. (DNSSEC would work, too, but as you say, most clients do not make use of it.)

Unbound also allows you to set a min-ttl, which is taboo in the DNS admin realm, but very useful for adding a small amount of privacy, at the risk of poorly engineered websites being unreachable for a small period of time. See "cache-min-ttl:" Consider keeping that under 20 minutes.

I also log all query responses, then sort by request count and do additional prefetching of names I use, plus batches of random domain names to add some noise as others suggested. "log-queries: no" and "log-replies: yes". Logging this data can also help you spot websites that try to enumerate a users DNS and real IP by using unique A records per client.

Also make sure you don't have the "subnetcache" module loaded, as it will by default send client-subnet data, allowing enumeration of your private network.

https://spameatingmonkey.com/services

I've not used this myself, so I'm not recommending it. I only know that it exists.

I have my own DNS with min-ttl set. Further more I have firewalled all DNS-lookup except to a certain provider.

On top of this I have a installed a local CA on all devices.

Blocked domains are reverted to an local nginx that answer with a empty gif or 204, even when the request is on https (domains spoofed).

The access.log is very interesting to analyse, and sometimes you find bugs in iOS apps that crashes because they could not send their usage data to flurry.com or other domains.

You could also take inspiration from the NSA and actually perform random DNS queries & HTTP requests to various sites to disguise the true queries.

Another improvement would be actually offloading the resolver to another location via a VPN and querying from there.

Can you explain why it's important _not_ to have DNSSEC ?

In the most threatening MitM scenarios that we see, an adversary controls IP traffic to their victims (usually only relatively briefly). If we can use DNSSEC this gets them a denial of service and nothing further. But with your preferred options they are able to silently interpose as the victim, and tools you've worked on like Let's Encrypt will help "re-assure" the public that nothing is wrong. I have no doubt that ISRG would say they have no liability when the relying parties are screwed over - that's after all exactly what their commercial equivalents say all the time - but it'd be an easier argument to make if you weren't here saying that when it comes to the one thing that _would_ work you'd "rather not see it succeed".

Do you at least have something _instead_ you think would give people these benefits ?

Which shouldn't be an excuse for not doing DNSSEC validation if only because your own zones can be signed. You know, the ones you will be constantly ssh'ing to, and blindly accept new ssh server keys from because hey, it's your zone and you trust it.

2. Configure network settings to use 127.0.0.1 as the resolver

You now have end to end DNSSEC protected DNS (when the domain supports it. Where support is admittedly low). The best a MITM can do is block your lookups. In the same way they can also block your HTTPS connections.

[edit] Of course, the above will now fail by default in Firefox, because they wont use your local system resolver. Every other app on your system will be secured though. Until they also start getting their own custom made name resolution systems too.

For privacy reasons, DNS over TLS and DNS over HTTPS are still a good idea. So even with DNSSEC you would need one of those.

There's also this interesting app: https://play.google.com/store/apps/details?id=app.intra

https://github.com/systemd/systemd/pull/8849

But for DoH to make sense, the server must be outside of my private network and my ISP's network.

For a reference, this is what I get when I set my dns as 1dot1dot1dot1.cloudflare-dns.com on Android P:

https://cloudflare-dns.com/help/#eyJpc0NmIjoiWWVzIiwiaXNEb3Q...

I guess for me that equates to Firefox on 3 systems. Although I have three separate Firefox profiles, so I guess that's 9 times it needs configuring. And at some point 3 copies of Chrome, and another 3 Chromiums I guess. And then whatever other apps decide they want their own custom name resolution. That's assuming I'm actively notified that they have been changed to work that way, and assuming I remember to do it after each install.

Because by the sound of it, without remembering to configure my systems, I'm going to end up in a situation where I'm now shipping off a list of all the websites I visit to some American corp for safe keeping, by default. Along with everyone else in the World.

I can't even sit here in the UK, visiting a UK website, without asking an American corp for the IP. At least today, I'm asking my ISP for the IP. A company based in my legal jurisdiction, with whom I have a business relationship.

[edit] I forgot Firefox on my phone too. Thankfully I don't have a tablet.