Dependancies

In this mode, the only dependancy is OpenSSL. If this is installed in a non-standard location on your system use the --with-ssl option to configure below to specify where it is. 

Download the getdns source

> git clone https://github.com/saradickinson/getdns.git
> cd getdns
> git checkout feature/upstream_handling

Build the code

> git submodule update --init
> libtoolize -ci
> autoreconf -fi
> mkdir build
> cd build
> ../configure --prefix=<install_location> --without-libidn --with-getdns_query --enable-stub-only
> make

If you want to see detailed debug information as messages are processed then add the --enable-debug-stub option to the configure line above

Run the daemon

The command below will run the daemon listening on port 53 of the loopback address and sending queries to the NLnet Labs test DNS Privacy server (at 185.49.141.38 and 2a04:b900:0:100::38) over TLS.

It also specifies an idle timeout on the TLS connection of 10s with the '-e 10000' option. This test server does not support EDNS0 TCP Keepalive yet, so this timeout will always be used.

IPv4 only

> sudo src/test/getdns_query -s @185.49.141.38 -l L -z 127.0.0.1@53 -e 10000

IPv4 and IPv6

> sudo src/test/getdns_query -s @185.49.141.38 @2a04:b900:0:100::38 -l L -z 127.0.0.1@53 -z ::1@53 -e 10000

Exit the daemon at any time by hitting CTRL-C.

Strict vs Opportunistic

The above command will run the daemon without trying to authenticate the TLS connection (a form of Opportunistic Privacy).

If you have authentication information for the DNS Privacy server and you want to use Strict Privacy then you can specify this when starting the daemon in the following ways:

• Domain name: append the domain name to the IP address with a ~ e.g. @185.49.141.38~getdnsapi.net and add the '-m' flag
• SPKI pinset: specify the pinset using the '-K flag e.g. -K 'pin-sha256="foxZRnIh9gZpWnl+zEiKa0EJ2rdCGroMWm02gaxSc9S="' and add the '-m' flag

Test the daemon

A quick test can be done by using dig to the loopback address

> dig @127.0.0.1 www.example.com

Modify your upstream resolvers

For getdns to re-send outgoing DNS queries over TLS the recursive resolvers configured on your machine must be changed to send all the queries over the loopback interface. This depends on the operating system being run

Linux/Unix systems

• Edit the /etc/resolv.conf file
• Comment out the existing nameserver entries

• Add the following (only add the IPv4 address if you don't have IPv6)

  Code Block
  nameserver 127.0.0.1 nameserver ::1

OS X

• Open System Preferences->Network->Advanced->DNS
• Use the '-' button to remove the existing nameservers
• Use the + button to add '127.0.0.1' and '::1' (only add the IPv4 address if you don't have IPv6)
• Hit 'OK' in the DNS pane and then 'Apply' on the Network pane