Hacker News Reader

Comment by kylek | Hacker News Reader

I thought this was someone else providing an anonymized dns proxy at first, but it's just how to set up your own proxy. Not sure this saves anything over just using DoH to one of the listed providers directly (the requests still come from something you own and can technically be traced back to you, albeit with more effort?)

edit: I'm wondering what the ideal setup actually is. Would the root servers need to provide DoH endpoints?

View on HN

The "more effort" part was what I was going for -- no nation state or warrant-holding organization is going to be stymied by this, but as a personal/home user, I'd rather DoH resolvers not be able to tie my lookups to my personal IP which is doubtless held in many other cross-referencable locations (in my case, home-network wide proxying or Tor isn't feasible).

I wonder if it'd be feasible to proxy only the DNS requests over Tor. Maybe set up your network-level DNS proxy to route upstream queries through a Tor tunnel to a different DNS-over-HTTPS resolver. Perhaps even have the DNS proxy cache DNS records and proactively revalidate commonly used ones to avoid most of the latency overhead of Tor.

Unbound does prefetch [0]. Not sure abt the tor split tunnel, but is easy to setup one over WireGuard.

[0] https://en.m.wikipedia.org/wiki/Unbound_(DNS_server)#Feature...

It's definitely feasible. Old hardware + 2 network cards + pfsense makes a router that can do network-wide VPN. Even a lot of prosumer routers can do VPNs now, but I'm not sure how well it works.

In my opinion it would be ideal if all namerservers (including the root servers) would respond to DNS over TLS (DoT?) traffic which seems like it could be easily adopted but would probably increase the load considerably in some cases (i guess root servers see some massive amount of traffic)... i dont think this will happen anytime soon with DoH or DNS over TLS

I agree, I think I like the idea of DNS over TLS more than the other options, but DoH seems to be the one that's taking off. I don't feel it's quite a betamax situation, though

Reply on news.ycombinator.com