How a device finds encrypted DNS by itself | Hacker News Reader

How a device finds encrypted DNS by itself

blog.dundns.eu

36 pointsmajorchord6 comments

a lookup for _dns.resolver.arpa, a name reserved for ... asking whether an encrypted version exists, and where it can be reached

Neat! Let's try: nslookup _dns.resolver.arpa

    [mine] unblound.lan can't find _dns.resolver.arpa: Non-existent domain 

    [1.1.1.1] can't find _dns.resolver.arpa: Non-existent domain

    [8.8.8.8] No internal type for both IPv4 and IPv6 Addresses (A+AAAA) 
    records available for _dns.resolver.arpa

    [9.9.9.9] Name:  _dns.resolver.arpa

You have asked the wrong question. This standard does not describe an “A” or “AAAA” record. Use the "-query" option to nslookup(1). Or, use dig(1).

https://datatracker.ietf.org/doc/html/rfc9462#name-discovery...

This is a proposed standard. The reserved domain is very new. Widespread deployment is not expected or mandatory.

> You have asked the wrong question.

I figured it was something like that.

    dig @1.1.1.1 _dns.resolver.arpa SVCB

    ;; ANSWER SECTION:
    _dns.resolver.arpa.     300     IN      SVCB    1 one.one.one.one.
     alpn="h2,h3" port=443 ipv4hint=1.1.1.1,1.0.0.1
      ipv6hint=2606:4700:4700::1111,2606:4700:4700::1001 key7="/dns-query{?dns}"

    _dns.resolver.arpa.     300     IN      SVCB    2 one.one.one.one.
     alpn="dot" port=853 ipv4hint=1.1.1.1,1.0.0.1
      ipv6hint=2606:4700:4700::1111,2606:4700:4700::1001

A device that only exposes an IP field can use DDR without extra user configuration, but it still has to implement DDR and an encrypted DNS protocol in the first place...

running my own resolver as system DNS i can confirm apple devices fire _dns.resolver.arpa on every network join, but since verified DDR needs a TLS cert covering the resolver's IP it's effectively public-resolver-only, so for a LAN resolver the right move is just answering NODATA instead of leaking the query upstream.

> since verified DDR needs a TLS cert covering the resolver's IP it's effectively public-resolver-only

Why would you think this? It's trivial to get certs for internal services that mainstream devices trust, they just have to use names from a portion of the public DNS space that you can demonstrate control over. It doesn't actually have to be publicly exposed.

Reply on news.ycombinator.com