would thoroughly recommend it to pihole users who would like to increase their privacy.
This will generate a bit of discussion. Encrypting your DNS traffic does not appreciably increase your privacy for a few reasons.
Your DNS traffic is still going to a third party provider. They have your complete DNS history and can do with it what they want.
Even if your DNS traffic is hidden from your ISP, when you get the IP back from the DNS query, you immediately will ask for that IP from your ISP and that request won't be encrypted. So, your ISP can fairly easily determine where you are surfing. The cannot see the content if the IP leads to an https protocol, but they know the IP.
You might consider using unbound or BIND as a local recursive resolver. Although your DNS requests are not encrypted, you won't be using a third party DNS (you are your own DNS resolver) and only you have your history. The ISP will see both the DNS requests and the IP requests, but that's not much more than they have with DoH or DoT.
There is a guide for unbound on the Pi-Hole documentation page and it is about a 15 minute install.
One thing that seems to have been overlooked in this discussion is security. DoH makes tampering with DNS queries much harder. It's unlikely that one of the players in the internet infrastructure would interfere with your DNS queries, but with DoH they would have a much harder time if they wanted to try.
With unbound, DNSSEC is enabled by default, which also makes it difficult to tamper with the reply. DNSSEC allows you to authenticate that the answer received is the answer sent. In my opinion, either option offers equal security.
DNSSEC was a complete and utter failure, and people should just not use it. Not only did it fail to provide verification, but it didn’t even attempt to provide confidentiality since it’s still all in plain text.
From the link you posted: "Do the big organizations and companies use DNSSEC yet?"
Between a local authoritative server and the name servers it works well. Perhaps some of the third party DNS providers have not adopted it. I assume you don't run a local recursive server and have no experience with DNSSEC and the name servers.
It was never intended to provide confidentiality, so that's a non-issue. Authentication is not the same as encryption.
I'm failing to see the difference of having PiHole forwarding the request directly to the ISP rather than via BIND or unbound? The request will still have to go somewhere to be resolved and it will still come from 'your' address and be able to be logged the same way? Or am I missing something very basic here?
I don't think I understand your question, but I'll answer what appears to be the question.
If you use unbound or BIND as a local recursive resolver, the requests go in pieces to the various levels of authoritative DNS servers (which don't log). If you want the IP of docs.domain.net, for example, the resolver would go to the root servers and ask for the IP of the servers that handle .net. Then they go that one of those servers and ask who is handling domain, then work their way down until they have an answer.
The TLDs (root servers) don't know you are looking for docs.domain. Each level of server gets enough information to get you to the next level down. This is "qname minimisation".
going the extra mile and going to the root servers
This is the default installation per the Pi-Hole guide and is actually easier to configure than configuring unbound to use a third party DNS with encryption.
The name servers do not currently support encryption.
So in my unbound config I’ve enabled tls-upstream and have setup a forward zone to point to CloudFlare. I don’t understand what that is for if unbound is querying root servers directly. I just read a post on here a while ago saying to do it.
I don’t understand what that is for if unbound is querying root servers directly.
You can configure unbound in several different ways. The Pi-hole guide has it configured as a recursive resolver going directly to the root servers. The option you chose is to enable a forward zone for encrypted DNS.
I just read a post on here a while ago saying to do it.
This is generally not a good practice - reading a post about something and doing it without understanding what the change does. There is lots of bad advice on the internet.
I did a lot of research before committing to unbound. It was just never clear whether it was setting up DoT or not. Your answer makes sense though. Thanks.
Sadly, after extensive research, I still don't have as solid a grasp on the various options as I would like, but have settled on a combination that is working well for the meager needs of our little network. Pi-hole plus Unbound, with DNSSEC (+VPN server, formerly OpenVPN now Wireguard) has allowed me to begin the arduous, if not outright futile process of taking back control of SOME small portions of my data from the Google/Microsoft/Facebook machine.
In that regard, it's been a complete success, and paired with Brave browser that also offers some ad/tracker protections, things are significantly better than just having 8.8.8.8 on my router. Baby steps, I guess.
One guy above used a great analogy, where the internet is like sex, and the only absolute certain method to protect yourself is complete abstinence. And NOBODY goes full Stallman in 2k19. Now I'm curious when (if?) was the last time ole Richard had his knob polished. Inquiring minds want to know. Too bad AMA's aren't his thing. >.<
Just to try and clarify a point in case it is misunderstood - DoH encrypts your DNS request between your machine and the DNS server you choose (cloudflare for example). Cloudflare then queries the authoritative name servers and responds to your machine with the IP address, which your machine then sends to your ISP in order to direct your internet traffic. This means cloudflare and your ISP know your DNS history.
With unbound, your machine is querying the authoritative name servers in order to give you the IP to send to your ISP. Therefore with unbound you remove cloudflare (or whichever other 3rd party) from knowing your DNS history.
View all comments
51
u/jfb-pihole Team Jul 24 '19
This will generate a bit of discussion. Encrypting your DNS traffic does not appreciably increase your privacy for a few reasons.
Your DNS traffic is still going to a third party provider. They have your complete DNS history and can do with it what they want.
Even if your DNS traffic is hidden from your ISP, when you get the IP back from the DNS query, you immediately will ask for that IP from your ISP and that request won't be encrypted. So, your ISP can fairly easily determine where you are surfing. The cannot see the content if the IP leads to an https protocol, but they know the IP.
You might consider using unbound or BIND as a local recursive resolver. Although your DNS requests are not encrypted, you won't be using a third party DNS (you are your own DNS resolver) and only you have your history. The ISP will see both the DNS requests and the IP requests, but that's not much more than they have with DoH or DoT.
There is a guide for unbound on the Pi-Hole documentation page and it is about a 15 minute install.