Return to note index?

DNS notes

What DNS server is used, does it support ECS, is that threat or possibility, and everything that doesn’t have a better place? For DNS resolvers, refer to r/resolv.tsv

Automaattinen sisällysluettelo / Automatically generated Table of Contents

Identifying DNS resolver

The above list is based on redirect2me/which-dns README alternatives section

Identifying ECH support

At it’s current state of implementation, Encrypted Client-Hello requires DNS-over-HTTPS in the browser level or it won’t be used. If downgrade from application level DoH to OS resolver is allowed, ECH will get disabled at least temporary. Thus I think this list belongs here close enough.

What is ECS?

EDNS Client-Subnet is a DNS extension letting the authoritative nameserver know your subnet, generally a /24 (IPv4) or a /56 (IPv6), but the revealed subnet size is up to your DNS resolver configuration.

See also simpler explanation at PrivacyGuides.org DNS Overview.

If you are reading my personal notes (that being useful for you would bring me a bit of happiness), please note that I am somewhat indecisive and change the DNS resolver a lot (at least daily judging by my feelings), but do check the git log.

Why to use ECS?

Android DoH3 option: dns.google

[…] The longer the distance the data must travel from the data centre to the end-user device, the more energy the transmission consumes – regardless of the transmission path used. Intercontinental transmission networks are fundamentally very efficient. Transferring data from the United States to Europe may consume a fraction of the energy compared to the last kilometre from the base station to the mobile phone.

If you utilize services of internet giants or content delivery networks, ECS will likely give you the shortest distance, the lowest latency, the highest speed and may help with decreasing your digital carbon footprint.

I was also surprised to find speedy Google Play Store download in the middle of sea (Helsinki-Tallinn) when switching from non-ECS to ECS nameserver. I wonder if they had an edge node somewhere in clsoe proximity or if it was juat happenstance.

The above means GAFAM, if you don’t use them in any form, there may not be a need for ECS.

If those matter to you, you may also like to consider increasing your minimum TTL to around an hour in a local server.

Why to not use ECS?

Android DoH3 option: cloudflare-dns.com

[…] we [Cloudflare] don’t pass along the EDNS subnet information. This information leaks information about a requester’s IP and, in turn, sacrifices the privacy of users. This is especially problematic as we work to encrypt more DNS traffic since the request from Resolver to Authoritative DNS is typically unencrypted. We’re aware of real world examples where nationstate actors have monitored EDNS subnet information to track individuals, which was part of the motivation for the privacy and security policies of 1.1.1.1.

[…]

We are working with the small number of networks with a higher network/ISP density than Cloudflare (e.g., Netflix, Facebook, Google/YouTube) to come up with an EDNS IP Subnet alternative that gets them the information they need for geolocation targeting without risking user privacy and security. Those conversations have been productive and are ongoing. […]

ECS will decrease the cost of mass surveillance as instead of having to surveill everything happening on the network, anyone between your DNS server and the authoritative nameserver can see which IP addresses access the site with a reasonable accuracy.

Then there are those with commercial interests, particularly outside of Europe, advertisers may be interested in making money out of the additional metadata. There may also be adblockers which don’t block the DNS request, causing the advertising company to receive your IP address (or close enough to it) even if you didn’t see the advertisement itself.

Some say the less metadata is produced, the smaller incentive there is for starting collecting and monetizing it.

This isn’t even mentioning that the internet isn’t a nice place or foreign advanced persistent threats or threat actors, who may not need a reason to attack you. CISA: Mitigating Cyber Threats with Limited Resources: Guidance for Civil Society

Additionally researchers (below) have used it to perform cache poisoning against an individual target directing them to a wrong location and with low TTL making it near impossible to audit later.

What domains do you use? What if someone far above you knew regardless of Encrypted Client-Hello?

Are the domains you use DNSSEC-signed? Do you verify DNSSEC locally? Do you use HTTPS everywhere? Do you know to not accept warnings about certificate issues? Do the other (less technical) users of your network? Would you or them be a delicious target? Do you even use GAFAM services?

See also:

Later I have been torn on whether the quote above is correct and helps decrease my digital climate footprint more or less than adblocking on DNS level, but what really put the scales towards ECS for me was late night GApple update that was keeping me from sleeping. So ECS is for busy people who want to sleep? The CISA link above makes me question this the very next day considering I belong to gender and sexual minorities, Pirate Party of Finland, and everything…

Why to use private ECS?

Android DoH3 option: ?

Do you want the benefits of ECS with the privacy and security of not having ECS? Private ECS is a compromise solution in the middle, although not without its own issues.

Your private DNS provider will lie for you and say that your IP address is somewhere else where it will also place many others from your ISP. However what if it says you are a customer of another ISP, possibly even located in another country? It tends to have greater accuracy with IPv4 than IPv6, see AdGuard Google Domains issue. What if no one else uses the same DNS server as you, especially from your ISP? I guess you can always advocate your DNS provider so it could be someone else too (I couldn’t)? If it works most of time, does that outweight the times it won’t work? Is perfect the enemy of good enough?

In that case you may get even worse performance be in even worse situation than without ECS. Then again if everything works properly, you will get the benefit of ECS without the privacy impact and lessened security impact.

See the next section for testing “where you are.” Consider also what is important for you if you had to pick one or two from privacy, performance and climate.

See also:

Is this a relevant question?

It’s likely greener to just use adblocking DNS no matter where it is located, preferably on router level. I don’t trust router/DHCP provided DNS and encrypt it on the end device anyway. And if something needs unfiltered access (AdNauseam?), give it DNS over HTTPS like all browsers and curl have the ability nowadays.

Are you someone whom someone might want bad things to just for existing?

Identifying support for ECS

Or what is being sent to the authoritative servers.

# https://support.google.com/interconnect/answer/7658602
dig +short TXT o-o.myaddr.l.google.com.
# https://www.akamai.com/blog/developers/introducing-new-whoami-tool-dns-resolver-information
dig +short TXT whoami.ds.akahelp.net.
dig +short TXT whoami.ipv6.akahelp.net.
dig +short TXT whoami.ipv4.akahelp.net.
# https://powerdns.org/useful-names/
dig +short TXT whoami-ecs.lua.powerdns.org.
dig +short TXT whoami-ecs.v6.powerdns.org.
dig +short TXT whoami-ecs.v4.powerdns.org.

DNS0.eu or Quad9?

In my experience DNS0.eu tends to have better filtering and reporting options than Quad9, while servers being located only in the European Union is mildly problematic when your users start traveling outside it either for work or leisure, which across continents tends to bring round-trips overseas. Additionally private ECS (see above) tends to be bad poor for IPv6 and for very small AS like a school, it directs to another side of the country, but that is a very minor issue.

Meanwhile Quad9 blocking seems almost as good in tests like this and they give me impression of more transparency (as opposed to DNS0.eu only having a Twitter X account). Quad9 also has more options on whether to ECS or not (see above).

The end-users traveling outside of the EU is also solved as they have servers all around the world.

Back to DNS0.eu, while disabling private ECS is not an option, they do have other options; default filters, no filters, heavier filtering (zero) and kids.

CLI applications

Mobile applications

With the exception of those apps that config I remember otherwise or share it with desktop versions etc.

Android

Use either cloudflare-dns.com (which doesn’t have ECS) or dns.google (which has ECS) as the (Settings → Network & Internet → Advanced →) Private DNS server as they have special handling and are thus DNS over HTTPS3 instead of the usual DNS over TLS. This can be confirmed with https://1.1.1.1/help (when using cloudflare-dns.com). However is connectivity in limited networks and maybe a bit faster speed in bad network more important than a level of security reached by a filtering resolver?

Then setup your web browser (including Firefox (other than stable which disables about:config) and Chrome) to use DNS over HTTPS with your preferred server and while at it enabling HTTPS only mode.

At least https://security.cloudflare-dns.com/dns-query won’t downgrade to system DNS resolver so malware.testcategory.com is blocked and that will hopefully affect other filtering DNS servers and actual malicious domains as well. Meanwhile nudity.testcategory.com loads as expected outside of https://family.cloudflare-dns.com/dns-query.

If testing Cloudflare, see also:

Do other Android based OSes contain the special handling of specific Private DNS domains turning into DNS-over-HTTP/3?

Rethink

NOTE! This pretends to be a VPN and thus breaks things depending on seeing the IP directly such as wireless debugging LAN IP, Briar LAN connections, cause warnings in Ooni Probe and disable automatic testing, Syncthing Fork will not autostart due to detecting the network as metered, unless it’s given permission to run in metered networks.

NOTE ESPECIALLY! Android Auto cannot be used when there is a “VPN” connected (why? ask Google, not me). Additionally you may encounter questionable battery drain.

  1. Use either GitHub or F-Droid release as Google Play doesn’t have blocklists.
  2. Enable it.
  3. In Android Settings, Internet, Advanced, VPN, select Rethink, make it always-on and block connections not using it.
  4. Disable private DNS in Android settings too, as it conflicts.
  5. In Rethink itself open Configure.
  1. Remember to also visit Android app details for Rethink, in battery menu select unrestricted and in network allow unlimited data even with data saver.
  2. I also have a suspicion that Android Developer Setting Always keep mobile data active is interfering with Rethink as always-on VPN causing connectivity issues or it not being sure whether “metered” or unmetered network is being used.
    1. The setting is enabled by default nowadays, to access it, go to about phone and rapidly tap Software build number (backtranslated to English from Finnish (like everything else (TODO: check in English)).
    2. Once you are a developer, System Settings (within Settings) should have a new Developer Settings menu Mobile data always active is under Connection properties section (which is above Input)

Hopefully there is no situation where Rethink stops working and thinks it’s still working. As can be deduced from this section, sometimes Rethink and I disagree with each other. I don’t guarantee I know what I am doing.

Using Obtainium with APKPure/Aegon

I think a few of the blocklists in Rethink are blocking apkpure’s domain breaking Obtainium and their official app and the steps to fix that are:

  1. Use a DNS server that doesn’t have the block (https://open.dns0.eu/ or https://unfiltered.adguard-dns.com/dns-query if private ECS is desirable?)
  2. Select Apps in Rethink’s main screen (the biggest button below Proxy and Logs.
  3. Search for Obtainium or APKPure and select it.
  4. Select Domain Rules.
  5. Select the floating + from bottom right.
  6. Select Wildcard, enter *.winudf.com and select Trust.
  7. Select Okay and now Obtainium/APKPure should work assuming no DNS is blocking it (check the logs).

The Trust could also be set globally, but what business does any other app have for that domain?

FFUpdater

Return to note index?

Dear reader, you may be missing a content blocker! 🙀 Please consider installing one to protect yourself, and your close ones, from manipulation and targeted malvertising! Personally I love both Privacy Badger and uBlock Origin (with EFF DNT Policy Allowlist) together, while AdNauseam alone would be more direct protest tool to oppose how the internet is nowadays. Android users may be better served by Rethink while for iOS there is AdGuard. Learn more about targeted advertising! PS. I am sorry if you are already protected and this silly EasyList targeting(?) script doesn't detect that, thank you for taking the steps towards a safer internet! 💜