Version 1.0 of getdns offers a daemon mode which can be used to run getdns locally as a DNS-over-TLS stub resolver. The daemon can listen on the loopback address send all outgoing DNS queries over TLS to a DNS Privacy server. Version 1.1 of getdns includes some performance improvements to make this mode more robust, so it is currently recommended to use that code, rather than the 1.0 release. If you want to set this up on your laptop/desktop follow the step-by-step instructions below!
In this mode, the only dependancy is OpenSSL (version 1.0.2 or later is required for hostname authentication to be supported). If this is installed in a non-standard location on your system use the --with-ssl option to configure below to specify where it is.
The 1.1 branch will be available any day now. Until then please pick the code up directly from a branch in Sara Dickinson's fork of getdns as shown below!
If you want to see detailed debug information as messages are processed then add the --enable-debug-stub option to the configure line above
The command below will run the daemon listening on port 53 of the loopback address and sending queries to the NLnet Labs test DNS Privacy server (at 22.214.171.124 and 2a04:b900:0:100::38) over TLS.
It also specifies an example idle timeout on the TLS connection of 10s with the '-e 10000' option. (Note: the NLnet Labs test server does not support EDNS0 TCP Keepalive yet, so in that case this timeout will always be used.)
IPv4 and IPv6
Exit the daemon at any time by hitting CTRL-C.
Strict vs Opportunistic
The above command will run the daemon without trying to authenticate the TLS connection (a form of Opportunistic Privacy).
If you have authentication information for the DNS Privacy server and you want to use Strict Privacy then you can specify this when starting the daemon in the following ways:
A quick test can be done by using dig on the loopback address
For getdns to re-send outgoing DNS queries over TLS the recursive resolvers configured on your machine must be changed to send all the queries over the loopback interface. This depends on the operating system being run
Add the following (only add the IPv4 address if you don't have IPv6)
Once the change in step 1.6 is made your queries will be re-directed to the getdns daemon and sent over TLS! You can monitor the traffic using Wireshark watching on port 853.