How a device finds encrypted DNS by itself

2 comments

• WarOnPrivacy1 hour ago
  <i>a lookup for _dns.resolver.arpa, a name reserved for ... asking whether an encrypted version exists, and where it can be reached</i><p>Neat! Let&#x27;s try: <i>nslookup _dns.resolver.arpa</i><p><pre><code> [mine] unblound.lan can&#x27;t find _dns.resolver.arpa: Non-existent domain [1.1.1.1] can&#x27;t find _dns.resolver.arpa: Non-existent domain [8.8.8.8] No internal type for both IPv4 and IPv6 Addresses (A+AAAA) records available for _dns.resolver.arpa [9.9.9.9] Name: _dns.resolver.arpa</code></pre>
  • ButlerianJihad1 hour ago
    You have asked the wrong question. This standard does not describe an “A” or “AAAA” record. Use the &quot;-query&quot; option to nslookup(1). Or, use dig(1).<p><a href="https:&#x2F;&#x2F;datatracker.ietf.org&#x2F;doc&#x2F;html&#x2F;rfc9462#name-discovery-using-resolver-ip" rel="nofollow">https:&#x2F;&#x2F;datatracker.ietf.org&#x2F;doc&#x2F;html&#x2F;rfc9462#name-discovery...</a><p>This is a <i>proposed standard</i>. The reserved domain is very new. Widespread deployment is not expected or mandatory.
    • WarOnPrivacy1 hour ago
      &gt; You have asked the wrong question.<p>I figured it was something like that.<p><pre><code> dig @1.1.1.1 _dns.resolver.arpa SVCB ;; ANSWER SECTION: _dns.resolver.arpa. 300 IN SVCB 1 one.one.one.one. alpn=&quot;h2,h3&quot; port=443 ipv4hint=1.1.1.1,1.0.0.1 ipv6hint=2606:4700:4700::1111,2606:4700:4700::1001 key7=&quot;&#x2F;dns-query{?dns}&quot; _dns.resolver.arpa. 300 IN SVCB 2 one.one.one.one. alpn=&quot;dot&quot; port=853 ipv4hint=1.1.1.1,1.0.0.1 ipv6hint=2606:4700:4700::1111,2606:4700:4700::1001</code></pre>
• rdme6 days ago
  running my own resolver as system DNS i can confirm apple devices fire _dns.resolver.arpa on every network join, but since verified DDR needs a TLS cert covering the resolver&#x27;s IP it&#x27;s effectively public-resolver-only, so for a LAN resolver the right move is just answering NODATA instead of leaking the query upstream.