Sdns – Lightweight, fast recursive dns server with dnssec support

Re:Sdns – Lightweight, fast recursive dns server with dnssec... by gigatexal on Wednesday October 31, 2018 @04:52PM (#18349207)

Will this:

docker run -d --name sdns -p 53:53 -p 53:53/udp -p 853:853 -p 8053:8053 -p 8080:8080 sdns

Give me a secure DNS box or do I have to do the TLS myself with say let’s encrypt?

[ Parent | on HN ]

Re:Sdns – Lightweight, fast recursive dns server with dnssec... by tptacek on Wednesday October 31, 2018 @05:11PM (#18349314)

What do you mean by "secure DNS box"? This is a DNSSEC-validating resolver, which means it will check DNSSEC signatures, for whatever that is worth to you. It won't encrypt your DNS traffic. It may accept DoH/DNS-TLS requests, but won't (AFAIK) make outgoing DoH requests, so all the requests you make will be visible from the server.

[ Parent | on HN ]

Re:Sdns – Lightweight, fast recursive dns server with dnssec... by tialaramex on Wednesday October 31, 2018 @06:17PM (#18349695)

AFAICT This does not include like an ACME implementation or anything like that, so:

You will need to obtain a suitable TLS certificate (for which you will have generated a private key).

For this to be of practical use outside of a toy, you will probably need to obtain the certificate from a different CA since you would want an ipAddress SAN (a certificate for the IP address of your DNS server, not the hostname) so that remote systems can use this server without also needing DNS, since if they have perfectly good DNS why use this server?

For a toy you can self-sign a certificate and set your test systems to trust that self-signed cert or whatever.

[ Parent | on HN ]