News for hackers. Stuff that matters.
Re:Shutting down our unencrypted public DNS service by 1vuio0pswjnm7 on Tuesday December 13, 2022 @11:39PM (#33980071)
Turning off EDNS and DNSSEC would surely reduce if not eliminate the risk of amplification attacks.

If anyone has the idea that traditional 512-byte UDP-based DNS is now useless, then I think that's crazy. I still use it all the time, particularly on the home network. I would be willing to bet some (not all) DoH providers are using traditional 512-byte DNS for their backend queries. I use remote DoH heavily outside the browser. I also run DoH servers on local computers.

Re:Shutting down our unencrypted public DNS service by LinuxBender on Wednesday December 14, 2022 @09:46AM (#33984127)
I would be willing to bet some (not all) DoH providers are using traditional 512-byte DNS for their backend queries.

You are correct. In fact they have no choice in this matter unless they are just daisy-chaining to other DoH/DoT servers. The real internet still uses plain unencrypted UDP and there is no guarantee the server one is talking to supports EDNS. The root servers do not support DoT/DoH and most corporate DNS servers do not support DoH/DoT. Some of those also do not support EDNS. A small handful of the paid DNS providers offer DoT but it isn't like clients would know to use that by default. Some cell phones and some browsers are the only clients that to my knowledge will try to enumerate if DoT/DoH is available.

Regarding 512 byte queries, EDNS is opportunistic. Not everyone supports it and one can not assume it is supported. That is negotiated. DNS Flag day(s) [1] were supposed to encourage everyone to enable EDNS and standard size limits of 1232. Without EDNS some traffic will revert to TCP and not everyone has that enabled to my surprise.

I have a handful of DoT servers and they just talk plain UDP to the root servers. I've thought about making some of them public as a learning exercise to see what riff-raff shows up though I suspect I will be spending some time tuning rate limits and firewall rules.

As a side note, I was actually surprised to find that Android figured out I had DoT on my home network and I didn't even git it any hints. Seems it just probed the gateway for 853 and got lucky.

[1] - https://www.dnsflagday.net/2020/

Re:Shutting down our unencrypted public DNS service by 1vuio0pswjnm7 on Wednesday December 14, 2022 @04:07PM (#33990565)
There is much "probing" from "tech" companies like Google and Apple. You should try running NetGuard on Android, block everything and observe what tries to connect.

It is one thing to use DoH if port 53 is being filtered, but that is a relatively small population of internet users. Forcing everyone to use DoH inside an ad-sponsored application like a web browser or a corporate OS like Android, versus providing it as an option, is questionable, IMO.

Do you use OpenWRT. OpenWRT routers with mwan3 enabled by default are pinging open resolvers, public DNS caches, like GoogleDNS, Cloudflare and Cisco OpenDNS to check for connectivity. These are considered "reliable IP addresses to ping".

https://web.archive.org/web/20220629175529if_/https://github...

https://openwrt.org/docs/guide-user/network/wan/multiwan/mwa...

Why not ping a root server instead. Even a com nameserver is more important than Google LLC.

EDNS is opportunistic but we can disable/remove it altogether before compiling our DNS servers. Or we can use DNS software, e.g., djbdns, that will never support it.