DoH in unbound

Decronym Bot , 10 months ago

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters	More Letters
DNS	Domain Name Service/System
Git	Popular version control system, primarily for code
HTTP	Hypertext Transfer Protocol, the Web
HTTPS	HTTP over SSL
PiHole	Network-wide ad-blocker (DNS sinkhole)
SSL	Secure Sockets Layer, for transparent encryption

---

[Thread #111 for this sub, first seen 6th Sep 2023, 05:45] [FAQ] [Full list] [Contact] [Source code]

vegetaaaaaaa , 10 months ago

I’m interested in the same thing (both query upstream DNS over HTTPS servers, and answer to DoH queries), but using dnsmasq. I haven’t had much time to look into this yet, but will definitely try to implement it later, so any recommendations would be appreciated. So far my research notes on this topic only contain:

<span style="color:#323232;">https://wiki.archlinux.org/index.php/Dnscrypt-proxy
</span><span style="color:#323232;">https://packages.debian.org/sid/main/nss-tlsd
</span><span style="color:#323232;">https://packages.debian.org/sid/main/tlslookup
</span><span style="color:#323232;">https://blitiri.com.ar/git/r/dnss/b/master/t/f=README.md.html
</span>

BlackEco , 10 months ago (edited 10 months ago)

Do you want Unbound to query upstream DNS over HTTPS servers or do you want unbound to answer to DoH queries?

For the former, unbound cannot query upstream DoH servers, only DoT and DNS at the moment. An issue is still open for setting DoH as upstream. A solution is to use cloudflared or dnsproxy to proxy DNS queries to DoH upstream servers.

As for the latter, unbound can be set to answer to DoH queries.

badgrandpa OP , 10 months ago

Ok so how can is set up unbound with DoT?

foggenbooty , 10 months ago

Are you using the Unbound built into OPNsense, or something else? I ask because it’s easy to configure Unbound in OPNsense for DoT. If your ISP isn’t blocking DoT it will be just as secure.

And yes, it will be much more private. Right now if you’re using neither DoT or DoH your ISP will be able to see all your DNS requests in the clear. With either of the above it will be encrypted and they will not be able to read them.

badgrandpa OP , 10 months ago

I installed it on mini pc along with AdGuard home

badgrandpa OP , 10 months ago

I’ve seen it on pfsense it’s easy yes