Encrypted DNS - Revision history

DHCP: improve formatting

2026-05-20T23:27:59Z

improve formatting

← Older revision		Revision as of 23:27, 20 May 2026
Line 81:		Line 81:
	=== Blocklist ===		=== Blocklist ===

	Fetch a blocklist file (e.g. oisd) as a flake input:~~<syntaxhighlight lang="nix">~~		Fetch a blocklist file (e.g. oisd) as a flake input:
	# flake.nix		{{file\|flake.nix\|nix\|3=

	{		{
	inputs = {		inputs = {
Line 100:		Line 99:
	};		};
	}		}
	~~</syntaxhighlight>~~<syntaxhighlight lang="nixos">		}}
			<syntaxhighlight lang="nixos">
	{ config, lib, pkgs, inputs, ... }:		{ config, lib, pkgs, inputs, ... }:
	let		let
Line 228:		Line 228:

	To update digests get the TLS certificate that signs the responses and calculate the digest:		To update digests get the TLS certificate that signs the responses and calculate the digest:
	<syntaxhighlight lang="~~bash~~">		<syntaxhighlight lang="console">
	echo \| openssl s_client -connect '1.1.1.1:853' 2>/dev/null \| openssl x509 -pubkey -noout \| openssl pkey -pubin -outform der \| openssl dgst -sha256 -binary \| openssl enc -base64		$ echo \| openssl s_client -connect '1.1.1.1:853' 2>/dev/null \| openssl x509 -pubkey -noout \| openssl pkey -pubin -outform der \| openssl dgst -sha256 -binary \| openssl enc -base64
	</syntaxhighlight>		</syntaxhighlight>
	Or using <code>kdig</code> from <code>knot-dns</code>		Or using <code>kdig</code> from <code>knot-dns</code>
	<syntaxhighlight lang="~~bash~~">		<syntaxhighlight lang="console">
	kdig -d @1.1.1.1 +tls-ca +tls-host=one.one.one.one example.com		$ kdig -d @1.1.1.1 +tls-ca +tls-host=one.one.one.one example.com
	</syntaxhighlight>		</syntaxhighlight>

	[[Category:Networking]]		[[Category:Networking]]
	[[Category:DNS]]		[[Category:DNS]]

5mz9n1g1: from `services.dnscrypt-proxy2` to `services.dnscrypt-proxy` https://search.nixos.org/options?channel=unstable&show=services.dnscrypt-proxy.configFile&query=dnscrypt-proxy

2025-09-28T21:04:15Z

from `services.dnscrypt-proxy2` to `services.dnscrypt-proxy` https://search.nixos.org/options?channel=unstable&show=services.dnscrypt-proxy.configFile&query=dnscrypt-proxy

← Older revision		Revision as of 21:04, 28 September 2025
Line 3:		Line 3:
	'''Encrypted DNS''' protocols aim to address this hole by encrypting queries and responses in transit between DNS resolvers and clients; the most widely deployed ones are [[wikipedia:DNS over HTTPS\|DNS over HTTPS]] (DoH), [[wikipedia:DNS over TLS\|DNS over TLS]] (DoT), and [https://dnscrypt.info/ DNSCrypt].		'''Encrypted DNS''' protocols aim to address this hole by encrypting queries and responses in transit between DNS resolvers and clients; the most widely deployed ones are [[wikipedia:DNS over HTTPS\|DNS over HTTPS]] (DoH), [[wikipedia:DNS over TLS\|DNS over TLS]] (DoT), and [https://dnscrypt.info/ DNSCrypt].

	NixOS has modules for multiple encrypted DNS proxies, including [https://github.com/DNSCrypt/dnscrypt-proxy dnscrypt-proxy 2], [https://github.com/AdguardTeam/dnsproxy dnsproxy] and [https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Daemon+-+Stubby Stubby]. <code>services.dnscrypt-~~proxy2~~</code> is generally recommended, as it has the widest protocol and feature support, and is written in a memory-safe language. For DNS over TLS (DoT) support, <code>services.dnsproxy</code> can be used. Detailed comparison of DNS proxies can be found on [https://wiki.archlinux.org/title/Domain_name_resolution#DNS_servers ArchLinux Wiki].		NixOS has modules for multiple encrypted DNS proxies, including [https://github.com/DNSCrypt/dnscrypt-proxy dnscrypt-proxy 2], [https://github.com/AdguardTeam/dnsproxy dnsproxy] and [https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Daemon+-+Stubby Stubby]. <code>services.dnscrypt-proxy</code> is generally recommended, as it has the widest protocol and feature support, and is written in a memory-safe language. For DNS over TLS (DoT) support, <code>services.dnsproxy</code> can be used. Detailed comparison of DNS proxies can be found on [https://wiki.archlinux.org/title/Domain_name_resolution#DNS_servers ArchLinux Wiki].

	== Setting nameservers ==		== Setting nameservers ==
Line 73:		Line 73:
	};		};

	systemd.services.dnscrypt-~~proxy2~~.serviceConfig.StateDirectory = StateDirectory;		systemd.services.dnscrypt-proxy.serviceConfig.StateDirectory = StateDirectory;
	}		}
	</syntaxhighlight>		</syntaxhighlight>
Line 111:		Line 111:
	in		in
	{		{
	services.dnscrypt-~~proxy2~~.settings.blocked_names.blocked_names_file = blocklist_txt;		services.dnscrypt-proxy.settings.blocked_names.blocked_names_file = blocklist_txt;
	}		}

Line 121:		Line 121:
	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
	{		{
	services.dnscrypt-~~proxy2~~ = {		services.dnscrypt-proxy = {
	enable = true;		enable = true;
	settings = {		settings = {
Line 142:		Line 142:
	networking.nameservers = [ "::1" ];		networking.nameservers = [ "::1" ];

	services.dnscrypt-~~proxy2~~ = {		services.dnscrypt-proxy = {
	enable = true;		enable = true;
	settings = {		settings = {

5mz9n1g1: /* Basic configuration */

2025-09-28T20:53:32Z

Basic configuration

← Older revision		Revision as of 20:53, 28 September 2025
Line 44:		Line 44:
	{		{
	# See https://wiki.nixos.org/wiki/Encrypted_DNS		# See https://wiki.nixos.org/wiki/Encrypted_DNS
	services.dnscrypt-~~proxy2~~ = {		services.dnscrypt-proxy = {
	enable = true;		enable = true;
	# See https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml		# See https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml

Tie-ling: Secure DNS and Captive Portal

2025-09-21T21:32:40Z

Secure DNS and Captive Portal

← Older revision		Revision as of 21:32, 21 September 2025
Line 24:		Line 24:

	If you'd prefer to keep using resolvconf then you can set <code>networking.resolvconf.useLocalResolver</code> instead. Note that it uses the IPv4 loopback address only.		If you'd prefer to keep using resolvconf then you can set <code>networking.resolvconf.useLocalResolver</code> instead. Note that it uses the IPv4 loopback address only.


			== Secure DNS and Captive Portal ==
			Secure DNS will break most captive portals like those of public or hotel wifi access points, resulting in inability to gain internet access through such access points.

			In that case, use <code>networkctl status ${wlan interface}</code> to show the default DNS provided by the network, and temporarily change nameserver inside <code>/etc/resolv.conf</code> from <code>127.0.0.53</code> to the provided one.

			Alternatively, if you have Chromium installed, you can use the <code>programs.captive-browser.enable</code> Chromium wrapper, which is "Dedicated Chrome instance to log into captive portals without messing with DNS settings".


	== dnscrypt-proxy2 ==		== dnscrypt-proxy2 ==

Pigs: /* Basic configuration */ Don't link to old wiki

2025-05-13T17:13:12Z

Basic configuration: Don't link to old wiki

← Older revision		Revision as of 17:13, 13 May 2025
Line 34:		Line 34:
	in		in
	{		{
	# See https://nixos.~~wiki~~/wiki/Encrypted_DNS		# See https://wiki.nixos.org/wiki/Encrypted_DNS
	services.dnscrypt-proxy2 = {		services.dnscrypt-proxy2 = {
	enable = true;		enable = true;

Klinger: Category:DNS added

2025-03-20T16:29:20Z

Category:DNS added

← Older revision		Revision as of 16:29, 20 March 2025
Line 227:		Line 227:
	</syntaxhighlight>		</syntaxhighlight>

	[[Category: Networking]]		[[Category:Networking]]
			[[Category:DNS]]

Golbinex: Add dnsproxy

2025-02-27T09:40:05Z

Add dnsproxy

@@ Line 3: / Line 3: @@
 '''Encrypted DNS''' protocols aim to address this hole by encrypting queries and responses in transit between DNS resolvers and clients; the most widely deployed ones are [[wikipedia:DNS over HTTPS|DNS over HTTPS]] (DoH), [[wikipedia:DNS over TLS|DNS over TLS]] (DoT), and [https://dnscrypt.info/ DNSCrypt].
-NixOS has modules for multiple encrypted DNS proxies, including [https://github.com/DNSCrypt/dnscrypt-proxy dnscrypt-proxy 2] and [https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Daemon+-+Stubby Stubby]. <code>services.dnscrypt-proxy2</code> is generally recommended, as it has the widest protocol and feature support, and is written in a memory-safe language.
+NixOS has modules for multiple encrypted DNS proxies, including [https://github.com/DNSCrypt/dnscrypt-proxy dnscrypt-proxy 2], [https://github.com/AdguardTeam/dnsproxy dnsproxy] and [https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Daemon+-+Stubby Stubby]. <code>services.dnscrypt-proxy2</code> is generally recommended, as it has the widest protocol and feature support, and is written in a memory-safe language. For DNS over TLS (DoT) support, <code>services.dnsproxy</code> can be used. Detailed comparison of DNS proxies can be found on [https://wiki.archlinux.org/title/Domain_name_resolution#DNS_servers ArchLinux Wiki].
 == Setting nameservers ==
@@ Line 154: / Line 154: @@
 Note that you can still access the other DNS server locally through the non-loopback interface (e.g. by using your server's external IP).
 == Stubby ==

Slackline: hasIPv6Internet isn't a config option, it's just a variable

2025-01-01T22:19:30Z

hasIPv6Internet isn't a config option, it's just a variable

← Older revision		Revision as of 22:19, 1 January 2025
Line 49:		Line 49:

	# Use servers reachable over IPv6 -- Do not enable if you don't have IPv6 connectivity		# Use servers reachable over IPv6 -- Do not enable if you don't have IPv6 connectivity
	ipv6_servers = ~~config.custom.~~hasIPv6Internet;		ipv6_servers = hasIPv6Internet;
	block_ipv6 = ! (~~config.custom.~~hasIPv6Internet);		block_ipv6 = ! (hasIPv6Internet);

	require_dnssec = true;		require_dnssec = true;

Vuhoanghuynh02 at 01:49, 18 December 2024

2024-12-18T01:49:33Z

← Older revision		Revision as of 01:49, 18 December 2024
Line 72:		Line 72:
	=== Blocklist ===		=== Blocklist ===

	~~Add~~ a blocklist ~~repo~~ (e.g. oisd) as a flake input:<syntaxhighlight lang="nix">		Fetch a blocklist file (e.g. oisd) as a flake input:<syntaxhighlight lang="nix">
	# flake.nix		# flake.nix

Line 78:		Line 78:
	inputs = {		inputs = {
	oisd = {		oisd = {
	url = "~~github~~:~~sjhgvr~~/oisd";		url = "https://big.oisd.nl/domainswild";
	flake = false;		flake = false;
	};		};
Line 94:		Line 94:
	{ config, lib, pkgs, inputs, ... }:		{ config, lib, pkgs, inputs, ... }:
	let		let
	blocklist_base = builtins.readFile ~~"${~~inputs.oisd~~}/domainswild_big.txt"~~;		blocklist_base = builtins.readFile inputs.oisd;
	extraBlocklist = '''';		extraBlocklist = '''';
	blocklist_txt = pkgs.writeText "blocklist.txt" ''		blocklist_txt = pkgs.writeText "blocklist.txt" ''

Vuhoanghuynh02: Typo

2024-11-29T17:36:08Z

Typo

← Older revision		Revision as of 17:36, 29 November 2024
Line 70:		Line 70:
	See [https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml the upstream example configuration file] for more configuration options.		See [https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml the upstream example configuration file] for more configuration options.

	~~BlocklistAdd~~ a blocklist repo (e.g. oisd) as a flake input:<syntaxhighlight lang="nix">		=== Blocklist ===

			Add a blocklist repo (e.g. oisd) as a flake input:<syntaxhighlight lang="nix">
	# flake.nix		# flake.nix