RFC 7858: DNS over TLS (2016)

Re:RFC 7858: DNS over TLS (2016) by krylon on Tuesday April 10, 2018 @07:01AM (#16800438)

Stupid question: What do I need to do to use DNS-over-TLS? I am running a recursive resolver in my home network (BIND9), so if that is a requirement, it is not a problem.

EDIT: I misunderstood; I though this would encrypt communication between resolvers and authoritative nameservers, too. :(

[ Parent | on HN ]

Re:RFC 7858: DNS over TLS (2016) by BuildTheRobots on Tuesday April 10, 2018 @07:50AM (#16800625)

Your recursive resolver is still going off over the internet and querying (root) DNS entries in clear text. My understanding is that this would wrap it in TLS to stop your ISP (or coffee shop) either spying on what sites you're resolving (read visiting) or even man-in-the-middling and re-writing your DNS responses.

[ Parent | on HN ]

Re:RFC 7858: DNS over TLS (2016) by bpicolo on Tuesday April 10, 2018 @09:20AM (#16801116)

mitm seems like the most important bit. They'll know what sites you visit regardless when you actually fire off a request to the site, yeah?

[ Parent | on HN ]

Re:RFC 7858: DNS over TLS (2016) by cat199 on Tuesday April 10, 2018 @09:44AM (#16801258)

DNSSEC already solves MITM if it is actually adopted by the domain being queried..

[ Parent | on HN ]

Re:RFC 7858: DNS over TLS (2016) by dbkaplun on Tuesday April 10, 2018 @07:44AM (#16800599)

I found this guide (with slight modifications) helpful for setting up stubby as a localhost DNS resolver to proxy through 1.1.1.1 with DNS-over-TLS on macOS: https://medium.com/nlnetlabs/privacy-using-dns-over-tls-with...

[ Parent | on HN ]

Re:RFC 7858: DNS over TLS (2016) by swiley on Tuesday April 10, 2018 @07:15AM (#16800483)

If you run your own recursive resolver that kind of defeats the point doesn't it?

[ Parent | on HN ]