On Wed, Oct 23, 2019 at 02:40:53PM +0200, Otto Moerbeek wrote: > Hi, > > The patch below add opportunistic DoT to unwind. Some background > info: > > The purpose of unwind is to provide secure DNS services even when > the available nameservers are broken or filtered like in many hotels. > To do that, it prefers DNSSEC whenever possible and changes to do > resolving by itself if needed. > > DNSSEC only offers integrity and authenticity. To protect > eavesdropping on the requests in transit, encryption is needed, as > offered by e.g. DNS over TLS (DoT) and DNS over HTTP (DoT). unwind
That second DoT should be DoH. > already supports DoT for forwarders but only when explicitly > configured to do so. > > This diff makes unwind try DoT for forwarders and nameservers learned > via DHCP and fall back to plaintext if it does not work. > > Which DoT servers to use for testing? Most quad-whatever open DNS > resolvers like 9.9.9.9 support DoT so you can specify them as a > forwarder. But please note the privacy policies and realize they see > all your DNS queries. You might consider reading [1] which offers DoT > on 136.144.215.158 as well and has a good privacy policy and is in Not that the mentioned privacy page talsk about DoH and does not mention DoT, but the IP does offer DoT. [1] https://powerdns.org/doh/privacy.html -Otto
