3

If a computer is already connected to the internet through VPN, is there point in encrypting DNS queries? From DNScrypt:

DNSCrypt is a protocol that authenticates communications between a DNS client and a DNS resolver. It prevents DNS spoofing. It uses cryptographic signatures to verify that responses originate from the chosen DNS resolver and haven't been tampered with.

Implementations are available for most operating systems, including Linux, OSX, Android, iOS, BSD and Windows.

DNSCrypt is not affiliated with any company or organization, is a documented protocol using highly secure, non-NIST cryptography, and its reference implementations are open source and released under a very liberal license.

Please note that DNSCrypt is not a replacement for a VPN, as it only authenticates DNS traffic, and doesn't prevent "DNS leaks", or third-party DNS resolvers from logging your activity.

I'm thinking a VPN must be rather useless in the first place if it leaks DNS...which is a lot.

| improve this question | |
  • // , What research have you tried already? – Nathan Basanese Sep 30 '18 at 23:18
4

It depends on what you are trying to achieve.

If you are trying to prevent DNS leaks, DNSCrypt isn't what you need. DNSCrypt is intended to prevent DNS spoofing, which is quite different. You could think of it as Privacy vs Man-in-the-Middle.

DNSCrypt is a protocol that authenticates communications between a DNS client and a DNS resolver. It prevents DNS spoofing. [...] and doesn't prevent "DNS leaks", or third-party DNS resolvers from logging your activity.

If you want to verify your VPN doesn't leak DNS, you should look into its configuration. there is usually an option which might not be checked by default. You can test it here for example https://www.dnsleaktest.com/

For DNSCrypt, it's up to you to decide if it's suited to you. If you don't think it's overkill, go for it.

In the end, it all depends on your VPN Server/Provider and the level of trust you have in its configuration.

| improve this answer | |
  • You make a good point. My confusion arose because DNScrypt encrypts the DNS traffic, so this sounded to me like something to prevent man-in-the-middle. What is special about DNScrypt compared to OpenDNS that makes it not vulnerable to DNS poisoning? – ArnoldS May 7 '16 at 21:08
  • @ArnoldS if you are going to use a VPN the packets are going to be encrypted either way, included the DNS traffic. – Christos May 9 '16 at 13:48
  • @Christos Only if all the traffic is sent through the VPN. This sometime needs to be specified in the configuration. – Hiruma May 11 '16 at 16:50
  • @Hiruma, if DNSCrypt doesn't prevent DNS leaks, then could you please advise, is there any way to hide my DNS requests from the VPN provider? – A S Aug 24 '18 at 3:37
  • 1
    // , This is not correct. DNSCrypt DOES prevent DNS Leaks at the "last mile" of internet communication, the connection between your browser and the DNS provider. – Nathan Basanese Sep 30 '18 at 23:14
2

There is another point. With the advent of Windows-10, dns-leak has become a problem as windows chooses the fastest dns-resolver.

I noticed that when I am using VPN (CyberGhost), my traffic should be going through their dns - BUT - on using DNS Leak, it was showing me my isp's DNS.

I contacted my VPN and they didn't pay much heed stating everything is good and green.

Windows 10 is so smart, that even if static dns resolvers are provided for the network adapter it ignores that and selects the local dns and its faster.

I solved this problem by using DNSCrypt proxy. Since it sends the dns request back to the same machine (127.0.0.1), windows thinks it is the fastest route and from there dns-crypt handles request.

Now DNS Leak doesn't show my local dns address.

Two ways of using this :

1) Use DNSCrypt on the WAN Network adapter only [should be done].

2) Use DNSCrypt on the TAP-Adapter and WAN Network adapter [Pointless though], as VPN is encrypting traffic anyway.

| improve this answer | |
0

It depends. Securely configured DNScrypt servers and clients DO ensure zero DNS leakage. Dnscrypt encrypts DNS traffic. That means it cannot be viewed or successfully tampered with on the way to and from the downstream DNScrypt server. DNSCRYPT servers also remove any identifying data that could be sent upstream, and often offer "No forwarding to external/upstream DNS servers (recursive)"

From what I have gathered, DNSCrypt on its own may not be 100% secure. Security depends on the quality of the results obtained by your preferred DNSCRYPT server, given the server itself has not been compromised. Countering this drawback, DNSSEC validates the entire chain of command from upstream to downstream, and is implemented at the domain level, making it impossible to forge. Because this is a feature that must be enabled on a per-domain basis, and because very few domains have implemented DNSSEC, this makes DNSSEC largely redundant, until adoption increases. After months of use, I only found one obscure domain that was truly 'validated' by DNSSEC. DNSSEC overhead also noticeably increases latency. It is for these two reasons I stopped using it.

Given DNSCRYPT ensures zero DNS leakage, every query is encrypted and signed, technically you could use a dedicated DNSCRYPT/DNSSEC server for DNS query's, and a dedicated VPN for data traffic, breaking DNS and data into two separate streams. Splitting the stream could result in enhanced security; or possibly less, it totally depends on the VPN provider and the DNSCRYPT provider. Some DNSCRYPT servers use Google as an upstream and or companion (safebrowsing / adblock) server, as you will witness in DNS leak tests. So make sure you test and look before you assume anything. Bear in mind there will be more DNS logs accessible on your system(s) if logging is enabled for DNSCRYPT & any other Stub resolver, such as DNSMASQ. Logging is one of the primary factors VPN users ensure their providers are NOT doing. As for security benefits, using DNSCRYPT along side a VPN can enhance your security by giving you the option to implement your own blocklists to ensure malware domains and trackers are avoided over VPN.

Summing up, using VPN DNS puts attack surface squarely on their side, and on the integrity of your device, with potential DNS leaks; (adding the directive, block-outside-dns, to your openvpn configuration can fix this) Using DNScrypt brings more attack surface on your side but protects against DNS leaks, and host blocklists can reduce exposure to malware exponentially. Either way your records are as private as the integrity of your chosen providers, and your device, which is always the case anyway.

I am no expert; further insight by experts in this field would be greatly appreciated.

| improve this answer | |
  • You appear to repeat what is already mentioned in the question, raise DNSSEC, which is beside the point, then you talk about latency. The question was asking about VPNs not protecting DNS queries. You have not actually addressed the question. – schroeder♦ May 12 '18 at 22:34
  • 1
    Noted and updated. – Tyler Dec 7 '18 at 0:28
  • // , I'm curious, what was the reason for bringing up DNSSEC? Did you bring it up as an example of a relatively similar transit layer security technique that you considered as an alternative to DNSCRYPT, the transit layer security technique in question? Awesome summary, by the way. – Nathan Basanese Jan 16 '19 at 3:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.