-1

DNS traffic (requests and responses) has been encrypted by DNSCrypt. In this case, is hostname (https://www.example.com /destination IP adress) readable in transit by a third party during my TLS session? Actually i would like to clarify what does make hostname visible to others - unencrypted DNS traffic only or both unencrypted DNS and initial request to the destination server in the TLS session context?

1

From the DNSCrypt website:

DNSCrypt is a protocol that authenticates communications between a DNS client and a DNS resolver. It prevents DNS spoofing. It uses cryptographic signatures to verify that responses originate from the chosen DNS resolver and haven't been tampered with.

[...]

Please note that DNSCrypt is not a replacement for a VPN, as it only authenticates DNS traffic, and doesn't prevent "DNS leaks", or third-party DNS resolvers from logging your activity.

So yes, your DNS requests will still be readable since they are just authenticated and not encrypted.

What makes DNS request readable is that's it is not an encrypted protocol to start with. In the case of the TLS session, the IP of the server (you got from the DNS answer) is used to establish the connection. Thus a reverse DNS lookup can reveal the address of the server your are connecting to anyway. Though the content of the communication will remain confidential in normal conditions of operation.

  • This isn't correct. DNSCrypt exchanges between the client and server are encrypted. What they mean is upstream communication from the server is not encrypted. Neither is communication between a standard DNS client and the DNSCrypt proxy on the local network (this is the usual configuration since the system resolver is rarely DNSCrypt capable). – Monstieur Apr 2 '18 at 8:01
  • The dnscrypt protocol seems to be in some limbo state right now anyway. Though, according to my extract here, my answer does make perfect sense. Maybe it has been rendered obsolete by a new version of the protocol, this is 2 years old already after all. – M'vy Apr 3 '18 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.