alecmuffett / dohot Goto Github PK

Platform: Raspberry Pi - Buster Lite

Using your commit of 3 July I get an error:

Process: 6483 ExecStart=/opt/dnscrypt-proxy/dnscrypt-proxy -config dnscrypt-proxy.toml (code=exited, status=255/EXCEPTION).

Changing [sources.'public-resolvers'] to v3 as in : urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md', 'https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md']

fixes the problem.

I'm very much a newbie on this so on a fairly steep learning curve.

Incidentally regarding latency, the best I can manage here in Adelaide, Australia is around 465ms which probably reflects the fact that TOR exit nodes are mostly in Europe or US.

Debian Bullseye ships with DNSCrypt-Proxy v 2.0.45, meaning it is no longer required to run the precompiled binaries in Bullseye, and I imagine that will extend to derivatives, too.

DoHoT currently doesn't seem to mention and not doing local DNSSEC validation?

DoHoT seems to be based on dnscrypt-proxy which apparently doesn't do local DNSSEC validation. References:

• DNSCrypt/dnscrypt-proxy#1954
• DNSCrypt/dnscrypt-proxy#167 (comment)

Also cloudflared apparently doesn't do local DNSSEC validation. References:

• cloudflare/cloudflared#520
• https://community.cloudflare.com/t/does-the-cloudflared-dns-client-locally-verify-dnssec/335402

Thank you for all your work on DNS security!

BTW I am interested in documenting and including it in our security distro:
https://www.kicksecure.com/wiki/DNS_Security