« Previous 1 2
Encrypting DNS traffic on Linux with DoT
Curious Looks
Deploying DoT Globally
If you want to enable DoT on more than a single interface, you can adjust the global settings for the service in the resolved.conf file:
grep -v '^#' /etc/systemd/resolved.conf [Resolve] DNS=1.1.1.1#one.one.one.one DNSOverTLS=yes
Then, restart the service with
systemctl restart systemd-resolved
after making the changes.
Conclusions
The DoT standard supports encrypted communication on a DNS server over a dedicated network port. You can also ensure the authenticity of a server with the help of the X.509 certificate. To give applications on a system secure access to a DNS server, the local resolver also needs to support this standard. On Linux, the systemd-resolved service is the ideal choice for this job, because it is included in the software repositories of the vast majority of popular distributions and lets you configure the services easily.
Infos
- RFC 8484: https://datatracker.ietf.org/doc/html/rfc8484
- Public DNS servers with DoH support: https://dnscrypt.info/public-servers/
- RFC 7858: https://datatracker.ietf.org/doc/html/rfc7858
- Cloudfare DNS: https://one.one.one.one
- Knot DNS server: https://www.knot-dns.cz
The Author
Thorsten Scherf is the global Product Lead for Identity Management and Platform Security in Red Hat's Product Experience group. He is a regular speaker at various international conferences and writes a lot about open source software.
« Previous 1 2
Buy this article as PDF
(incl. VAT)
Buy ADMIN Magazine
US / Canada
UK / Australia
Related content
-
DNSSEC-aware DNS caching with Unbound
If you don't have access to a DNSSEC-aware name server, you can set up your own with Unbound. -
Transport Encryption with DANE and DNSSEC
Those who think that enabling STARTTLS in the mail client will make their mail traffic more secure are wrong. Only those who bank on DANE can be sure that a mail server or a firewall will not switch off encryption in transit. -
DNS name resolution with HTTPS
Now that web content is encrypted by HTTPS, the underlying name resolution is often unprotected. We look at the classic DNS protocol and investigate whether DNS over HTTPS could be the solution to ensure the confidentiality of DNS requests. -
Samba domain controller in a heterogeneous environment
The open source Samba service can act as an Active Directory domain controller in a heterogeneous environment. -
Solving the security problems of encrypted DNS
DNS encryption offers WiFi users good protection in public spaces; however, in the enterprise, it prevents the evaluation and filtering of name resolution.