Інструкція користувача

As we know, the DNS (Domain Name System) protocol does not encrypt requests, and data is transmitted openly. DNS traffic is vulnerable to cybercriminals as there is an opportunity to 'eavesdrop' on the communication channel and intercept unprotected personal data. ISPs can monitor traffic and collect data about what sites you visit.

Special DNS protocol extensions, DNS over TLS (DNS over TLS, or DoT, RFC7858) and DNS over HTTPS (DNS over HTTPS, or DoH, RFC8484) are developed to ensure the security of DNS traffic. Their main purpose is to encrypt DNS traffic to prevent interception and provide additional privacy and security. We won't cover the theory in detail in this article. Information on how DoT and DoH work can be found on the following pages:

There are also lists of public DNS services that support DoT/DoH:

Starting with version 3.0, KeeneticOS supports DNS over TLS and DNS over HTTPS protocols. Below, we will guide you to encrypt your DNS traffic, as sent over the router, by default.

Let's show an example of configuration via the web interface. We will use Cloudflare's free DNS service, which supports DoT/DoH protocols.

For the DoT/DoH protocol to work, system components: 'DNS-over-TLS proxy' and 'DNS-over-HTTPS proxy' are needed to be installed. Please open 'System component options' menu by clicking on the 'Component options' button in the 'Management - System settings' section and mark the required components for installation.

Proceeding then with the setup on the 'Internet safety' page under the 'Network rules' menu section. Navigate to 'DNS configuration' tab.

DNS-over-TLS

Click the 'Add server' link at the bottom of the page.

The fields for filling in the server parameters will appear. Specify the DNS server address (in our example 1.1.1.1 and 1.0.0.1), the TLS domain name (in our example cloudflare-dns.com), and, if necessary, the Connection interface (the default setting is 'Any interface').

For example:

In the 'DNS server address' field, it is allowed to specify the FQDN domain name, e.g.:

DNS-over-HTTPS

Click the 'Add server' link at the bottom of the 'DNS Configuration' tab.

Fields to fill in specific parameters will appear. In the 'DNS server type' field, specify 'DNS-over-HTTPS', in the 'DNS server address' field, specify the name of the DNS server and, if necessary, specify the connection interface (the default setting is 'Any interface'). These queries use the DNS message format. In our example, the https://cloudflare-dns.com/dns-query and https://dns.comss.one/dns-query servers are added.

For example:

Checking the settings

The Cloudflare service also supplies verification pages. Let's open a special webpage at the address https://www.cloudflare.com/ssl/encrypted-sni/ to check the browser security.

Click the 'Check My Browser' button on that page to start the DNS query processing test.

If the above settings are configured correctly, the test should be completed successfully for 'Secure DNS', 'DNSSEC', and 'TLS 1.3'. The correct output of DoT/DoH and browser security checks depends on the availability of DoT/DoH servers/addresses in the ISP/operator network.

To repeat the test, please press the 'Run the test again' button on the page.

If the test failed, it is possible that third-party DNS servers were previously assigned in the IP settings of the network adapter in Windows, Linux, macOS. In this case, all DNS requests will be handled through third-party DNS, and DoT/DoH will not work. Remove the previously specified third-party DNS addresses and retest.

Also, note that if you specify multiple DoT/DoH addresses from different services, the result of the check depends on which server is currently in priority. For example, if the DoH server specified is https://dns.google/dns-query in DNS message format, it will fail the 'Secure DNS' check.