HomeLab: AdGuard: How to Secure DNS requests to Upstream DNS servers
The DNS requests to Upstream DNS can be secured to protect our privacy.
Intro
Like I described in the previous post, I wanted to secure the DNS requests from AdGuard to the upstream DNS.
Since my AdGuard runs in my Private Network, I don’t need to setup the “Encryption setting” in AdGuard to encrypt the DNS requests between my computer and AdGuard.
However, since the DNS requests from AdGuard to the upstream DNS go through Internet, the DNS requests should be encrypted.
upstream DNS servers I used before
I mainly used the IP of DNS servers ( Cloudflare DNS, Google DNS, and Quad9 ).
It was just simple and it was what I used to set in /etc/resolve.conf in Linux.
- 1.1.1.1: Quad9 DNS
- 8.8.8.8: Google DNS
- 9.9.9.9: Cloudflare DNS
With these upstream DNS servers, the DNS requests from AdGuard to those DNS servers are a plain text. It’s not secure.
How to Secure DNS requests to Upstream DNS
The DNS requests can be secured by replacing the list of upstream DNS servers with the TLS or HTTPS endpoints DNS servers.
The list of DNS servers can be found here.
In my case, I picked the DNS-over-HTTPS endpoints of those DNS severs I used to use.
DoT ( DNS over TLS ) vs. DoH ( DNS over HTTPS )?
Based on what I read on the Cloudflare post, the DoT is simpler to block and manage and the DoH is more secure since it is mixed with the typical HTTPS traffic.
I picked DoH ( DNS over HTTPS )
from a privacy perspective, DoH is arguably preferable. With DoH, DNS queries are hidden within the larger flow of HTTPS traffic. This gives network administrators less visibility but provides users with more privacy. — https://www.cloudflare.com/learning/dns/dns-over-tls/
Performance Concern In DoT and DoH
First, to resolve the domain name of upstream DNS servers ( because they starts with domain name ), DNS servers are required 😐. In AdGuard, these DNS servers are called “Bootstrap DNS servers”. If the IP based upstream DNS servers are used ( e.g. 1.1.1.1 ), then the “Bootstrap DNS servers” is not necessary.
Since AdGuard will cache the DNS, the DNS requests for the upstream DNS servers won’t slow down much.
Second, DoT and DoH spend extra time to encrypt the DNS requests, so they are slightly slower than the plain DNS requests.
Overall, the DoT and DoH are little slower than the DNS plain.
The screenshot below is one I caught after I replaced with DNS-over-HTTPS upstream servers. The DNS-over-HTTPS is slightly slower than DNS plain.
Next Post about AdGuard
In the next post, I will talk about why I decided to use Unbound DNS in my Local DNS.
