7 DNS Privacy¶
In my experience, DNS (Domain Name Server) is often overlooked in conversations about privacy, especially when compared to something like a VPN or browser. However, DNS can make or break even the strongest privacy setup.
What is DNS?¶
DNS stands for “Domain Name System” which is one of the most important building blocks of the modern internet, but to understand what DNS is for we first need to know how computers communicate. Unlike humans, computers dont understand letters or words, so computers need a way to translate a domain name to an IP address, for example if I wanted to go to ‘www.google.com’ my computer would need to know the literal IP address of that server, this is where DNS comes into play. When you assign a DNS server to your computer you are essentially giving your computer a table of IPs mapped to domain names, for example the IP that corresponds to ‘https://google.com’” is ‘142.250.190.132’. So a good DNS server would be able to point my request to “www.google.com” to its real IP ‘142.250.190.132’ (Note: the formatting you see in IPV4 addressing is still heavily abstracted for human readability however that goes beyond the scope of this paper).
DNS Privacy¶
Now DNS is essential for any modern internet user, but how can it leak my information? Well first we need to cover the most popular DNS servers, these are 1.1.1.1 (Cloudflare) and 8.8.8.8 / 8.8.4.4 (Google).
Now that we’ve covered the most popular DNS servers lets talk about how a DNS query works. Say I set my DNS server to 1.1.1.1 and try to connect to ‘www.google.com’. My computer will first query 1.1.1.1 and find the corresponding IP address for that domain name. Now here is where it is very important to remember, A VPN DOES NOT HIDE THIS REQUEST. Depending on the server you use, a DNS query might be logged and visible, this is why it is extremely important to use a secure DNS.
DNS over TLS¶
As previously mentioned there are methods to encrypt DNS traffic to mitigate snooping, these are most commonly known as DoT, DoH or DNScrypt. According to a cloudflare blog post: “DNS over HTTPS / TLS solves this. These new protocols ensure that communication between your device and the resolver is encrypted, just like we’ve come to expect of HTTPS traffic”.
Local DNS¶
If you have a fancy or modern router there is also a chance that you might automatically be assigned a local DNS. Depending on your subnetting this might look like `10.0.0.1` , `192.168.0.1` or even just a random local IP where the DNS server is hosted. If you are in a heavily censored country this can expose what sites you are attempting to visit even through a VPN or tor, however certain protocols can help encrypt these requests such as DoH, DoT or DNScrypt which encrypt DNS traffic.
Better DNS options¶
The most commonly used private DNS would be cloudflares 1.1.1.1. This is a good server to use if you dont want to worry about certain sites not loading as this server has a huge pool of IPs. Google DNS servers (8..8.8.8 and 8.8.4.4) claim to store no information so it shold be up to the users discretion to trust this claim, I personally prefer cloudflare or Quad9 though.
If you want maximum privacy Quad9 (9.9.9.9) can also be a good option but this is less mainstream so it might run into some lookup issues occasionally.
VPN DNS servers¶
The two best VPN providers (PIA and Mullvad) also come with their own private DNS servers. It would not be a bad idea to use these servers if you already use the VPN along with it, just remember to set your browser to the VPN DNS server (or set your browser to use the hosts DNS) or you will run into DNS issues when trying to connect to websites.
Sources (ignore) https://blog.cloudflare.com/enable-private-dns-with-1-1-1-1-on-android-9-pie/
https://cybersecthreat.com/2020/07/24/windows-dns-logging/ (
)