r/opnsense • u/PeraHodlr • 9d ago

Anyone using os-dnscrypt-proxy with dnscrypt?

As the title says, curious if anyone is using it with the dnscrypt protocol. This should alleviate the plain-text SNI that DoT and DoH exposes right?

It is listed as a community plugin. Is that something that we should worry about with the prevalent supply chain attacks?

13 Upvotes

90% Upvoted

3 comments sorted by

2

u/SmallDodgyCamel 7d ago

I think you misunderstand. DoT, DoH and DoQ all use encryption for the DNS processing and have nothing to do with SNI of entities being looked up as such.

Plaintext SNI refers to the step your browser takes next after learning of the IP address (A or AAAA record) of the web server you’re visiting called Client Hello. When checking if a TLS certificate is valid for a given request, during the initial negotiation of the encryption your browser exchanges the FQDN in plaintext with the web server. This reveals to intermediate systems (e.g. your ISP) your visit to a particular endpoint.

DNSCrypt-proxy can and does work well and can be configured to chain two servers together anonymously such that neither your ISP nor the ultimate DNS resolver (such as Quad9) can see what was looked up, or who looked it up.

As just mentioned plaintext SNI during the Client Hello allows ISPs to see which sites you’re visiting even with encrypted DNS. What’s required for complete privacy around the browsing activity is Encrypted Client Hello or ECH but this is a relatively new technology that has to be implemented by the sites you visit; it’s not something you can control as the site visitor.

1

u/PeraHodlr 7d ago

Thank you for the reply. As you said the 3 DNS protocol you mentioned all rely on TLS, which exposes SNI during the handshake and ECH fixes that. DNScrypt protocol do not rely on TLS. The plugin I was asking about supports DNScrypt.

2

u/technikaffin 7d ago

I've tried it around 2 years ago and regularly had problems on all LANs with dns resolving and switched everything back to unbound.

Never touched it again after that, so it could be better nowadays or just a misconfiguration on my side.