dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers

brueggus · August 14

Let me introduce you to...

Public DNSCrypt resolvers hosted by LowEnd providers

The project exists since December 2022 but I wanted to make sure that everything's running smoothly before I expose it to the LET crowd.

In a nutshell, DNSCrypt is a protocol which encrypts and authenticates your DNS requests, so that a third party (like your ISP) can no longer tinker with them. You have to run a DNSCrypt client like dnscrypt-proxy locally or in your network and point your DNS requests there instead of towards your Wi-Fi router or public resolvers like Google's 8.8.8.8. Your DNSCrypt client will take care of the encryption and forward your requests to a public DNSCrypt resolver (like one of those I run for dnscry.pt).

None of the resolvers do any filtering of any kind. I don't store any logs of your requests. All I do is collect metrics using Munin.

Most of the servers have been taken from my collection of idlers, but I'd like to give a shout-out to our generous sponsors who provide resources to the project free of charge:

Terrahost (Sandefjord and Amsterdam)
Kuroit (London)
Internetport (Stockholm)

If you're interested in giving it a try, further instructions can be found here. There's also a list of all resolvers.

If you're using dnscrypt-proxy, you don't have to handpick resolvers near your location. Instead, use the auto-generated resolver list. Configuration instructions can be found in the file header or in the "Get Started" guide on the website.

I hope this is useful for some of you. I'm using DNSCrypt for years and have switched to my resolver list recently.

Let me know if you have any feedback or questions. I'm also open for suggestions for new locations.

LTniger · August 14

Finaly briuges posted here. Another grean forum had this for ages.

babywhale · August 14

im wondering what the speeds are like

Maounique · August 14

@babywhale said: im wondering what the speeds are like

Theoretically, at least twice slower than a normal DNS query.

LTniger · August 14

@Maounique said:

@babywhale said: im wondering what the speeds are like

Theoretically, at least twice slower than a normal DNS query.

Due to computation for encryption?

kait · August 14

Great project, any plans on putting DoT and or DoH on those machines? I am more of a DoT fan.

Maounique · August 14

@LTniger said: Due to computation for encryption?

No, redirect to local proxy, a less used (at least compared to anycast google) DNS, repacking the request, etc. Try a regular and a dnscrypt request and see the difference. For a domain you haven't before to see the whole chain's response.

brueggus · August 14

@babywhale said:
im wondering what the speeds are like

Your ISP's resolvers or Google/Quad9 will likely be a few milliseconds faster - I don't have as many POPs as they do (yet).

Here's an example using my shitty Vodafone Cable home connection (compare the "Query time"):

dnscry.pt Amsterdam
==================
$ dig -p 5300 A lowendtalk.com @127.0.0.1

; <<>> DiG 9.18.14 <<>> -p 5300 A lowendtalk.com @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24527
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;lowendtalk.com.         IN  A

;; ANSWER SECTION:
lowendtalk.com.      300 IN  A   172.67.68.9
lowendtalk.com.      300 IN  A   104.26.9.4
lowendtalk.com.      300 IN  A   104.26.8.4

;; Query time: 63 msec
;; SERVER: 127.0.0.1#5300(127.0.0.1) (UDP)
;; WHEN: Mon Aug 14 19:38:16 CEST 2023
;; MSG SIZE  rcvd: 91


Quad9
======
$ dig A lowendtalk.com @2620:fe::fe

; <<>> DiG 9.18.14 <<>> A lowendtalk.com @2620:fe::fe
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23385
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;lowendtalk.com.         IN  A

;; ANSWER SECTION:
lowendtalk.com.      300 IN  A   172.67.68.9
lowendtalk.com.      300 IN  A   104.26.9.4
lowendtalk.com.      300 IN  A   104.26.8.4

;; Query time: 53 msec
;; SERVER: 2620:fe::fe#53(2620:fe::fe) (UDP)
;; WHEN: Mon Aug 14 19:42:15 CEST 2023
;; MSG SIZE  rcvd: 91

I repeated that test multiple times and got response times between 23 ms to 86 ms for Quad9 and 29 ms to 63 ms for dnscry.pt. It all depends on your connection and how far you are from the nearest POP.

Maounique · August 14

I stand corrected. It still adds up on complex pages as most are these days.

brueggus · August 14

@Maounique said:

@LTniger said: Due to computation for encryption?

No, redirect to local proxy, a less used (at least compared to anycast google) DNS, repacking the request, etc. Try a regular and a dnscrypt request and see the difference. For a domain you haven't before to see the whole chain's response.

Exactly... I do cache responses so my resolvers won't dig through the whole DNS hierarchy for every requests, but the big ones have way more cache hits. But it's a matter of milliseconds and the internet doesn't feel any slower for me since I switched to DNSCrypt, even with my Pi-Hole in the chain.

@kait said:
Great project, any plans on putting DoT and or DoH on those machines? I am more of a DoT fan.

It's been a while since I looked into DoT/DoH. I'm using the Rust implementation (https://github.com/DNSCrypt/encrypted-dns-server) on my resolvers which has support for DoH but needs another component (https://github.com/DNSCrypt/doh-server) + certificates to be installed.
So it might or might not happen in the future.

LTniger · August 14

You need something like Jin Maek does - he sends mini arm servers to have huge amount of pops for his ping.

shruub · August 14

I wonder, did you reach out to the "sponsor hosts", or did they reach out to you? Seems like a cool thing to support!

brueggus · August 14

@shruub said:
I wonder, did you reach out to the "sponsor hosts", or did they reach out to you?

Both - 3 out of 5 providers I contacted can be found in the OP, the other two did not respond.
I also got three offers from providers but the locations they offered are already covered. But thinking about it, it won't hurt to have multiple resolvers in the same region...

Seems like a cool thing to support!

Thanks

MannDude · August 14

@brueggus said:

@shruub said:
I wonder, did you reach out to the "sponsor hosts", or did they reach out to you?

Both - 3 out of 5 providers I contacted can be found in the OP, the other two did not respond.
I also got three offers from providers but the locations they offered are already covered. But thinking about it, it won't hurt to have multiple resolvers in the same region...

Seems like a cool thing to support!

Thanks

Let me know if you want some VMs.

Can do, right now:

Liberty Lake, Washington
Naaldwijk, Netherlands

In the next couple of months will have:

Kansas City, Missouri
Allentown, Pennsylvania

Will be happy to float you resources in those two new locations as well.

brueggus · August 18

Thanks to @MannDude , @crunchbits and @skhron, who are generously providing VMs for the project, we're now running 40 resolvers 🎉

removed: Zurich
added: London
added: Warsawa
added: Naaldwijk
added Liberty Lake, WA
added Spokane, WA
added Phoenix, AZ

The dnscry.pt resolvers have been added to the "official" list of DNSCrypt resolvers that ships with dnscrypt-proxy by default yesterday, which I'm very happy about.

I'm currently looking into adding DoH support to the resolvers which isn't as difficult as I thought, but would still require a weekend or two to get this done properly.

Let's have another round of stickers to celebrate 40 dnscry.pt resolvers. If you'd like to pimp your laptop or your neighbor's car (don't!), send me your postal address (please include the country!) and whether you'd like one or two* stickers. When they're gone, they're gone.
* I may only send one if I run our of stickers...

kait · August 18

@brueggus said: I'm currently looking into adding DoH

No DoT

Congrats on the 40 number, we need them great people like you running stuff like enc dns.

tentor · August 18

@kait said:

@brueggus said: I'm currently looking into adding DoH

No DoT

There is small difference between them, I suppose server that provides DoH is capable to serve DoT as well

fazar · August 18

+1 for dot

Phisher · August 19

Any plans on anonymized dns support?
https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-DNS

brueggus · August 21

@Phisher said: Any plans on anonymized dns support?

Anonymized DNS might be added this weekend. DoH is next on my agenda.
The software stack I use at the moment does not have DoT support, so that's unlikely to happen

Also: Last call for stickers! If you want some, let me know within the next 24h. I'll get the next batch shipped on Wednesday.

MrLime · August 21

@brueggus said:

@Phisher said: Any plans on anonymized dns support?

Anonymized DNS might be added this weekend. DoH is next on my agenda.
The software stack I use at the moment does not have DoT support, so that's unlikely to happen

Also: Last call for stickers! If you want some, let me know within the next 24h. I'll get the next batch shipped on Wednesday.

Great work so far, looking forward to reading the update posts.

brueggus · August 24

Stickers have been sent out to anyone who reached out!

Salt Lake City will be removed soon due to networking issues the provider is unable to resolve. I'll add Las Vegas instead (nowhere close, I know...) and Los Angeles and another location in the Netherlands (sponsored by Crowncloud ) will be added soon™

shruub · August 27

The sticker do be looking shiny

zer0r00t · August 30

There seems to be some issues with DNSSEC implementation according to dnscheck.tools

brueggus · August 30

@zer0r00t said:
There seems to be some issues with DNSSEC implementation according to dnscheck.tools

Weird. I don't get such error. Could you send me the resolvers you use ("Your DNS resolvers are:" on the website) so I can check?

zer0r00t · August 30

@brueggus said: Could you send me the resolvers you use

Your DNS resolvers are:
EU-SKHRON-20230626
88.218.206.137
ptr: 88.218.206.137.hosted-by.skhron.com.ua
Warsaw, Mazovia, PL
EU-SKHRONV6-20230626
2a09:b280:fe00:24::a
ns: ns1.skhron.com.ua
Warsaw, Mazovia, PL
PL-MEV-20130117
2a03:cfc0:803f:964:b5fa:0:1:96c6
ns: ns1.webhorizon.net
Warsaw, Mazovia, PL
WebHorizon
185.244.30.123
Warsaw, Mazovia, PL

brueggus · August 30

@zer0r00t said: There seems to be some issues with DNSSEC implementation

I did some tests (with dnscheck.tools and manually using dig) and I'm unable to reproduce the issue:

The resolvers' config looks fine as well. Are you still seeing the errors? Maybe it was some weird temporary issue?

zer0r00t · August 30

Hmm this is weird. 5 mins ago everything passed but now it's back to initial state

abangnoob · September 1

nice work, i'll try it now

brueggus · September 2

@zer0r00t said:
Hmm this is weird. 5 mins ago everything passed but now it's back to initial state

I did some more checks and testing but I cant find any issue with the config. Is it always the same checks that fail on the website?

Due to the Dedipath closure I have replaced the resolver in Atlanta with a generous donation by KnownHost. Two resolvers sponsored by Crowncloud in Amsterdam and Los Angeles have been provisioned as well. Thanks for supporting the project!

I planned to add Jacksonville and Las Vegas but those servers were hosted by Dedipath, so that won't happen until I find a replacement. Denver is deprecated as well and may go offline anytime. Still looking for a replacement.

I'll be on vacation for the next two weeks, so Anonymized DNS is delayed further. It's not that difficult to enable, it's just a flag in the config files, but I have to adapt my tool to generate the resolver lists to create another list for anonymized relays. Stay tuned.

brueggus · September 24

Exciting news (at least for some, hopefully): All resolvers support Anonymized DNSCrypt and DNS over HTTPS (DoH) now.
I have zero experience with DoH, so please test them and let me know if you run into any issues.

New resolver lists:

Anonymized DNSCrypt relays: https://www.dnscry.pt/anon-relays.md
DNS over HTTPS (DoH) resolvers: https://www.dnscry.pt/doh-resolvers.md

And we have some new locations:

Las Vegas
Istanbul, Turkey - sponsored by @worldbus
Hong Kong - sponsored by @spiketel
Portland, OR - sponsored by @hostEONS
Salt Lake City, UT - sponsored by @hostEONS

Howdy, Stranger!

Categories

In this Discussion

dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers

Comments

Howdy, Stranger!

Quick Links

Categories

In this Discussion

dnscry.pt - Public DNSCrypt resolvers hosted by LowEnd providers

Comments