Skip to main content.

Encrypting DNS lookups

2014-05-28

Live demo in BSD Now Episode 039 | Originally written by TJ for bsdnow.tv | Last updated: 2015/06/30

NOTE: the author/maintainer of the tutorial(s) is no longer with the show, so the information below may be outdated or incorrect.

We briefly set up DNSCrypt in the OpenBSD router guide, but this tutorial will show you how to do it for any regular desktop or server system. This will also explain in a little more detail about what's actually happening and why you might want to use it. So, why would you want to encrypt your DNS lookups? Probably because DNS is a horrible, insecure system. It has no authentication, and can be spoofed very easily at any point in the connection. DNSSEC helps try to solve this problem, but it's not in very wide deployment right now. DNSSEC and DNSCrypt go hand in hand, complimenting each other. Even if you choose a "good" server, any of the hops between you and that server can take over and redirect your queries. Once they've done so, they could even do horrible things like redirect bsdnow.tv to linux.com. Imagine trying to go to this website to learn about security, but being redirected to a website promoting buggy software! Don't let this nightmarish situation happen to you - keep your DNS secure. The tool we'll be highlighting today is called dnscrypt-proxy, and it was originally developed by OpenDNS. There are versions for lots of operating systems, and all the BSDs should have a native port or package available. After installing it from your favorite source, we'll set it up for a single desktop or server system. If you want to run it on your entire network, which is probably the best way, consult the OpenBSD router tutorial linked above. Combining dnscrypt-proxy with a caching resolver like BIND or Unbound is an ideal setup. The port will not do any caching by itself, so every lookup has to make a round trip to the DNS server. That takes more time and more bandwidth, so consider using it with a caching resolver on your gateway. Let's first have a look at what files were included with the software. On OpenBSD:

$ pkg_info -L dnscrypt-proxy

Information for inst:dnscrypt-proxy-1.3.3

Files:
/usr/local/bin/hostip
/usr/local/include/dnscrypt/plugin.h
/usr/local/include/dnscrypt/private.h
/usr/local/include/dnscrypt/version.h
/usr/local/man/man8/dnscrypt-proxy.8
/usr/local/man/man8/hostip.8
/usr/local/sbin/dnscrypt-proxy
/usr/local/share/doc/dnscrypt-proxy/README-PLUGINS.markdown
/usr/local/share/doc/dnscrypt-proxy/README.markdown
/usr/local/share/doc/dnscrypt-proxy/TECHNOTES
/etc/rc.d/dnscrypt_proxy 

Or on the simpler FreeBSD port,

$ pkg info -l dnscrypt-proxy

dnscrypt-proxy-1.4.0:
        /usr/local/bin/hostip
        /usr/local/etc/rc.d/dnscrypt-proxy
        /usr/local/man/man8/dnscrypt-proxy.8.gz
        /usr/local/man/man8/hostip.8.gz
        /usr/local/sbin/dnscrypt-proxy
        /usr/local/share/dnscrypt-proxy/dnscrypt-resolvers.csv
        /usr/local/share/licenses/dnscrypt-proxy-1.4.0/LICENSE
        /usr/local/share/licenses/dnscrypt-proxy-1.4.0/MIT
        /usr/local/share/licenses/dnscrypt-proxy-1.4.0/catalog.mk

In both cases it includes the daemon binary, some man pages and an rc.d script for autostarting. Once you've read over the man page, we can tell dnscrypt-proxy to start up automatically. You can use the included rc.d scripts with your BSD of choice's methods, but I'll provide a generic way that should work for everyone.

# vi /etc/rc.local

We'll add a line like this:

/usr/local/sbin/dnscrypt-proxy -a 127.0.0.1:53 -R dnscrypt.eu-nl -u _dnscrypt-proxy -l /dev/null -d

In this case, "_dnscrypt-proxy" is the name of the unprivileged user. We tell the daemon to listen on localhost, port 53, and to send all its logs to /dev/null. They're worthless anyway. We also want to daemonize the script so it's always running in the background. It's possible to run it in the foreground, possibly in tmux. After we have that in place, let's tell our system to use our local resolver instead of whatever you were using before.

# echo "nameserver 127.0.0.1" > /etc/resolv.conf

Depending on your network settings and whether you're using DHCP, this file may get overwritten automatically with other DNS servers. You can change that behavior in your DHCP client's configuration file, usually located at /etc/dhclient.conf. Alternatively, you can take a forceful approach and lock the file from all changes:

# chflags schg /etc/resolv.conf

Now we can start up the service using the same command we added to rc.local:

# dnscrypt-proxy -a 127.0.0.1:53 -R dnscrypt.eu-nl -u _dnscrypt-proxy -l /dev/null -d

All your DNS lookups should now be encrypted. We can test it by checking a domain name like so:

$ nslookup bsdnow.tv

Server:         127.0.0.1
Address:        127.0.0.1#53

Non-authoritative answer:
Name:   bsdnow.tv
Address: 65.39.148.220

As long as it says "Server: 127.0.0.1" then you are indeed using the local resolver. If you're using pf as your firewall, you can block all "normal" DNS lookups from leaking by using the example in that tutorial. That's good to fall back on in case something was misconfigured somewhere else. There is a list of other DNSCrypt-capable servers on the homepage. The man page for dnscrypt-proxy will show you how to switch to another server. It's probably a good idea to use one close to your physical location for low latency.

Latest News

New announcement

2017-05-25

Hi, Mr. Dexter. Also, we understand that Brad Davis thinks there should be more real news....

Two Year Anniversary

2015-08-08

We're quickly approaching our two-year anniversary, which will be on episode 105. To celebrate, we've created a unique t-shirt design, available for purchase until the end of August. Shirts will be shipped out around September 1st. Most of the proceeds will support the show, and specifically allow us to buy...

New discussion segment

2015-01-17

We're thinking about adding a new segment to the show where we discuss a topic that the listeners suggest. It's meant to be informative like a tutorial, but more of a "free discussion" format. If you have any subjects you want us to explore, or even just a good name...

How did you get into BSD?

2014-11-26

We've got a fun idea for the holidays this year: just like we ask during the interviews, we want to hear how all the viewers and listeners first got into BSD. Email us your story, either written or a video version, and we'll read and play some of them for...


Episode 220: Opening ZFS in 2017

2017-11-15

Direct Download:HD VideoMP3 AudioTorrent This episode was brought to you by Headlines The First PS4 Kernel Exploit: Adieu The First PS4 Kernel Exploit: Adieu Plenty of time has passed since we first demonstrated Linux running on the PS4. Now we will step back a bit and explain how we managed to jump...

Episode 219: We love the ARC

2017-11-08

Direct Download:HD VideoMP3 AudioTorrent This episode was brought to you by Headlines Papers We Love: ARC: A Self-Tuning, Low Overhead Replacement Cache Ever wondered how the ZFS ARC (Adaptive Replacement Cache) works? How about if Bryan Cantrill presented the original paper on its design? Today is that day. Slides It starts by looking back at a fundamental paper...

Episode 218: A KRACK in the WiFi

2017-11-01

Direct Download:HD VideoMP3 AudioTorrent This episode was brought to you by Headlines FreeBSD 10.4-RELEASE Available FreeBSD 10.4-RELEASE is out. The FreeBSD Project dedicates the FreeBSD 10.4-RELEASE to the memory of Andrey A. Chernov. Some of the highlights: 10.4-RELEASE is the first FreeBSD release to feature full support for eMMC storage, including eMMC partitions, TRIM...

Episode 217: Your questions, part II

2017-10-25

Direct Download:HD VideoMP3 AudioTorrent This episode was brought to you by Headlines OpenBSD 6.2 Released OpenBSD continues their six month release cadence with the release of 6.2, the 44th release On a disappointing note, the song for 6.2 will not be released until December Highlights: Improved hardware support on modern platforms including ARM64/ARMv7 and octeon,...