14

I have installed DNSCrypt , its OpenDNS encrypted DNS patch for Ubuntu & other Linux users & it's working fine.

How do I know if my DNS is encrypted? I have googled but didn't find anything.

Status

one@onezero:~$ status dnscrypt 
dnscrypt start/running, process 1013
one@onezero:~$ sudo netstat -atnlp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.2:53            0.0.0.0:*               LISTEN      1013/dnscrypt-proxy

Updated

Wireshark

@Alvar

enter image description here

enter image description here

enter image description here

enter image description here

without DNSCrypt

enter image description here

6 Answers 6

5
+50

You could check it with Wireshark by listening to your network card, just follow these steps:

  1. sudo apt-get install wireshark (paste it into a terminal)
  2. start it from a terminal with sudo wireshark (you need to be sudo to be able to listen to your network card.)
  3. then start listening and filter out everything but your own ip.

Now just check if the dns protocols are encrypted.

  1. use the filter to only show dns
  2. Stop the scan.
  3. click on a list item that says dns and comes from your ip.
  4. Now click on the transmission protocol to see if it's encrypted.
1
  • @OneZero click on the red highlighted area that says dns, look in there, you should find out if it's encrypted in there.
    – Alvar
    Feb 22, 2012 at 19:40
3

If you are using OpenDNS as the dnscrypt supporting DNS server, a way to check if it's working is to use one of these commands:

drill txt debug.opendns.com

dig txt debug.opendns.com

The answer text should contain a line where it says "dnscrypt enabled":

;; ANSWER SECTION:
debug.opendns.com.  0   IN  TXT "server 11"
debug.opendns.com.  0   IN  TXT "flags 22 2 222 2"
debug.opendns.com.  0   IN  TXT "id 6666666"
debug.opendns.com.  0   IN  TXT "source 209.6.69.160:44444"
debug.opendns.com.  0   IN  TXT "dnscrypt enabled (...)"
1
  • drill requires package ldnsutils, although dig works, and nslookup -type=txt debug.opendns.com also works.
    – Asclepius
    Jun 27, 2018 at 15:20
1

I installed dnscrypt 1.1 on Ubuntu 12.10.

I edited /etc/NetworkManager/NetworkManager.conf to comment out

dns=dnsmasq

Then add /etc/init/dnscrypt.conf and include in it the following:

 description "dnscrypt startup script"

 start on (local-filesystems and started dbus and stopped udevtrigger)
 stop on runlevel [016]

 script
         exec /usr/sbin/dnscrypt-proxy -a 127.0.0.1 -d
 end script

Next I changed my network settings to to use 127.0.0.1 for DNS:

Then I rebooted and made sure dnscrypt was running and that dnsmasq was not:

 ps aux | grep dns
 root      6581  0.0  0.0  16116   720 ?        Ss   04:47   0:00 /usr/sbin/dnscrypt-proxy -a 127.0.0.1 -d

Then I opened wireshark to verify that DNS was encrypted:

It appears it isn't.

Visiting http://www.opendns.com/welcome/ verifies I am using opendns.

]

0

You go to OpenDNS Welcome page and you should see something like "Welcome to OpenDNS! Your Internet is safer, faster, and smarter because you're using OpenDNS." This means you're using OpenDNS as your DNS provider and if you haven't configured OpenDNS without dnscrypt your DNS requests should be encrypted.

Another way would be to snoop the DNS traffic using wireshark, tcpdump, etc and see if it's indeed encrypted but that's more convoluted and requires some in-depth knowledge.

3
  • opendns.com/welcome > ya i been there before its about open-dns dns , let me verified on my laptop the one without encryption
    – One Zero
    Feb 18, 2012 at 16:34
  • same as it shows here
    – One Zero
    Feb 18, 2012 at 16:37
  • OpenDNS is not the only DNScrypt enabled provider. sudo dnscrypt-proxy --daemon -a 127.0.0.2 --resolver-address=23.226.227.93:443 --provider-name=2.dnscrypt-cert.okturtles.com --provider-key=1D85:3953:E34F:AFD0:05F9:4C6F:D1CC:E635:D411:9904:0D48:D19A:5D35:0B6A:7C81:73CB is one of many that do not use OpenDNS.
    – mchid
    Apr 28, 2014 at 5:16
0

OK, I've got it!

Run dnscrypt-proxy --deamonize (it should already be running)

  1. Go to the Network icon at the top and go down to Network Settings.
  2. Go to your current connection and click Configure...
  3. Go to IPv4 Settings tab.
  4. Under DNS Servers and Search Domains fields enter: 127.0.0.1
  5. Head to http://opendns.com/welcome

If you get redirected to http://opendns.com/welcome/oops then it's not setup properly.

Sorry about that. I didn't want to go to the pain to set it all up, but it was remarkably easy! Well, hope you learned something. I sure did!

7
  • can i check quries are been sent yo which encrypted dns server ?
    – One Zero
    Feb 18, 2012 at 16:39
  • 1
    I don't really understand what you mean, it's only going to be sent to a maximum of two possibilities in most home networking circumstances. Most likely you set those in your router or your /etc/resolv.conf file. So every time your computer asks for something, your router will ask those two DNS servers. No others because it doesn't know any others. If you really want to know you could put a machine with two NICs and Wireshark between your computer and router. Then you can read the packets that go across the computer. But, of course you have to know what you're looking for.
    – Chuck R
    Feb 18, 2012 at 16:57
  • ty , good one , you should include this detail in your answer
    – One Zero
    Feb 18, 2012 at 17:14
  • Poke! Did you see my updated answer?
    – Chuck R
    Feb 18, 2012 at 18:09
  • yes i did , its 127.0.0.2 if u r using upstart script as i m , see w8 help , already checked open dns welcome same on encrypted & on un-encrypted
    – One Zero
    Feb 18, 2012 at 18:13
0

dnscrypt-proxy accepts DNS requests, encrypts and signs them using  * dnscrypt *  and forwards them to a remote dnscrypt-enabled resolver

Replies from the resolver are expected also to be encrypted and signed.

The proxy verifies the signature of replies, decrypts them, and trans‐parently forwards them to the local stub resolver.

dnscrypt-proxy listens to 127.0.0.1 / port 53 by default.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.