How a device finds encrypted DNS by itself

How a device finds encrypted DNS by itself(blog.dundns.eu)

16 points by majorchord 6 days ago | 4 comments

a lookup for _dns.resolver.arpa, a name reserved for ... asking whether an encrypted version exists, and where it can be reached

Neat! Let's try: nslookup _dns.resolver.arpa

    [mine] unblound.lan can't find _dns.resolver.arpa: Non-existent domain 

    [1.1.1.1] can't find _dns.resolver.arpa: Non-existent domain

    [8.8.8.8] No internal type for both IPv4 and IPv6 Addresses (A+AAAA) 
    records available for _dns.resolver.arpa

    [9.9.9.9] Name:  _dns.resolver.arpa

ButlerianJihad 1 hour ago | |

You have asked the wrong question. This standard does not describe an “A” or “AAAA” record. Use the "-query" option to nslookup(1). Or, use dig(1).

https://datatracker.ietf.org/doc/html/rfc9462#name-discovery...

This is a proposed standard. The reserved domain is very new. Widespread deployment is not expected or mandatory.

WarOnPrivacy 1 hour ago | | |

> You have asked the wrong question.

I figured it was something like that.

    dig @1.1.1.1 _dns.resolver.arpa SVCB

    ;; ANSWER SECTION:
    _dns.resolver.arpa.     300     IN      SVCB    1 one.one.one.one.
     alpn="h2,h3" port=443 ipv4hint=1.1.1.1,1.0.0.1
      ipv6hint=2606:4700:4700::1111,2606:4700:4700::1001 key7="/dns-query{?dns}"

    _dns.resolver.arpa.     300     IN      SVCB    2 one.one.one.one.
     alpn="dot" port=853 ipv4hint=1.1.1.1,1.0.0.1
      ipv6hint=2606:4700:4700::1111,2606:4700:4700::1001

rdme 6 days ago |

running my own resolver as system DNS i can confirm apple devices fire _dns.resolver.arpa on every network join, but since verified DDR needs a TLS cert covering the resolver's IP it's effectively public-resolver-only, so for a LAN resolver the right move is just answering NODATA instead of leaking the query upstream.