Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have installed DNSCrypt , its OpenDNS encrypted DNS patch for Ubuntu & other Linux users & it's working fine.

How do I know if my DNS is encrypted? I have googled but didn't find anything.

Status

one@onezero:~$ status dnscrypt 
dnscrypt start/running, process 1013
one@onezero:~$ sudo netstat -atnlp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.2:53            0.0.0.0:*               LISTEN      1013/dnscrypt-proxy

Updated

Wireshark

@Alvar

enter image description here

enter image description here

enter image description here

enter image description here

without DNSCrypt

enter image description here

share|improve this question
add comment

6 Answers 6

up vote 4 down vote accepted
+50

You could check it with Wireshark by listening to your network card, just follow these steps:

  1. sudo apt-get install wireshark (paste it into a terminal)
  2. start it from a terminal with sudo wireshark (you need to be sudo to be able to listen to your network card.)
  3. then start listening and filter out everything but your own ip.

Now just check if the dns protocols are encrypted.

  1. use the filter to only show dns
  2. Stop the scan.
  3. click on a list item that says dns and comes from your ip.
  4. Now click on the transmission protocol to see if it's encrypted.
share|improve this answer
    
@OneZero click on the red highlighted area that says dns, look in there, you should find out if it's encrypted in there. –  Alvar Feb 22 '12 at 19:40
    
updated................ –  One Zero Feb 22 '12 at 19:45
add comment

I installed dnscrypt 1.1 on ubuntu 12.10.

I edit /etc/NetworkManager/NetworkManager.conf to comment out dns=dnsmasq

Then add /etc/init/dnscrypt.conf and include in it the following:

 description "dnscrypt startup script"

 start on (local-filesystems and started dbus and stopped udevtrigger)
 stop on runlevel [016]

 script
         exec /usr/sbin/dnscrypt-proxy -a 127.0.0.1 -d
 end script

Next i change my network settings to to use 127.0.0.1 for dns:

Then I reboot and make sure dnscrypt is running and that dnsmasq is not:

 ps aux | grep dns
 root      6581  0.0  0.0  16116   720 ?        Ss   04:47   0:00 /usr/sbin/dnscrypt-proxy -a 127.0.0.1 -d

Now i open wireshark to verify that dns is encrypted:

It appears it isn't.

Visiting http://www.opendns.com/welcome/ verifies i am using opendns.

http://imgur.com/WtB3q,aKrrW,OxmM4

share|improve this answer
add comment

OK, I've got it!

Run dnscrypt-proxy --deamonize (it should already be running)

  1. Go to the Network icon at the top and go down to Network Settings.
  2. Go to your current connection and click Configure...
  3. Go to IPv4 Settings tab.
  4. Under DNS Servers and Search Domains fields enter: 127.0.0.1
  5. Head to http://opendns.com/welcome

If you get redirected to http://opendns.com/welcome/oops then it's not setup properly.

Sorry about that. I didn't want to go to the pain to set it all up, but it was remarkably easy! Well, hope you learned something. I sure did!

share|improve this answer
    
can i check quries are been sent yo which encrypted dns server ? –  One Zero Feb 18 '12 at 16:39
1  
I don't really understand what you mean, it's only going to be sent to a maximum of two possibilities in most home networking circumstances. Most likely you set those in your router or your /etc/resolv.conf file. So every time your computer asks for something, your router will ask those two DNS servers. No others because it doesn't know any others. If you really want to know you could put a machine with two NICs and Wireshark between your computer and router. Then you can read the packets that go across the computer. But, of course you have to know what you're looking for. –  Githlar Feb 18 '12 at 16:57
    
ty , good one , you should include this detail in your answer –  One Zero Feb 18 '12 at 17:14
    
Poke! Did you see my updated answer? –  Githlar Feb 18 '12 at 18:09
    
yes i did , its 127.0.0.2 if u r using upstart script as i m , see w8 help , already checked open dns welcome same on encrypted & on un-encrypted –  One Zero Feb 18 '12 at 18:13
show 1 more comment

dnscrypt-proxy accepts DNS requests, encrypts and signs them using  * dnscrypt *  and forwards them to a remote dnscrypt-enabled resolver

Replies from the resolver are expected also to be encrypted and signed.

The proxy verifies the signature of replies, decrypts them, and trans‐parently forwards them to the local stub resolver.

dnscrypt-proxy listens to 127.0.0.1 / port 53 by default.

share|improve this answer
add comment

If you are using OpenDNS as the dnscrypt supporting DNS server, a way to check if it's working is to use one of these commands:

drill txt debug.opendns.com

dig txt debug.opendns.com

The answer text should contain a line where it says "dnscrypt enabled":

;; ANSWER SECTION:
debug.opendns.com.  0   IN  TXT "server 11"
debug.opendns.com.  0   IN  TXT "flags 22 2 222 2"
debug.opendns.com.  0   IN  TXT "id 6666666"
debug.opendns.com.  0   IN  TXT "source 209.6.69.160:44444"
debug.opendns.com.  0   IN  TXT "dnscrypt enabled (...)"
share|improve this answer
add comment

You go to OpenDNS Welcome page and you should see something like "Welcome to OpenDNS! Your Internet is safer, faster, and smarter because you're using OpenDNS." This means you're using OpenDNS as your DNS provider and if you haven't configured OpenDNS without dnscrypt your DNS requests should be encrypted.

Another way would be to snoop the DNS traffic using wireshark, tcpdump, etc and see if it's indeed encrypted but that's more convoluted and requires some in-depth knowledge.

share|improve this answer
    
opendns.com/welcome > ya i been there before its about open-dns dns , let me verified on my laptop the one without encryption –  One Zero Feb 18 '12 at 16:34
    
same as it shows here –  One Zero Feb 18 '12 at 16:37
    
OpenDNS is not the only DNScrypt enabled provider. sudo dnscrypt-proxy --daemon -a 127.0.0.2 --resolver-address=23.226.227.93:443 --provider-name=2.dnscrypt-cert.okturtles.com --provider-key=1D85:3953:E34F:AFD0:05F9:4C6F:D1CC:E635:D411:9904:0D48:D19A:5D35:‌​0B6A:7C81:73CB is one of many that do not use OpenDNS. –  mchid Apr 28 at 5:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.