dnscrypt-proxy

Using DNSCrypt with anonymized DNS could be an option: https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-D...

For anyone that has a capable router, an rpi or any kind of home server, I can highly recommend https://github.com/DNSCrypt/dnscrypt-proxy It lets you send encrypted DNS queries out onto the Internet to any service that supports it (there are many, and you can configure it to use multiple for redundancy), while serving "normal" DNS in your internal network. It's also trivial to import a blocklist of domains with cron, from hagezi/dns-blocklists for example. If you have no interest in setting something like this up, at least ensure that you have manually configured or are pushing _multiple_ DNS servers via DHCP. It sucks that 1.1.1.1 went down but it shouldn't matter, there's a reason every operating system supports configuring multiple DNS servers. For anyone in the EU I can recommend https://www.dns0.eu/ or Mullvad, but at the very least

That can be done at DNS level in dnscrypt-proxy: https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Filters#time... At DNS level, not just websites will be blocked, but also apps.

Openvpn / Wireguard service is preferable, but for free: https://github.com/DNSCrypt/dnscrypt-proxy sudo apt install dnscrypt-proxy sudo systemctl enable dnscrypt-proxy (or system service dnscrypt-proxy start|enable) sudo mv /etc/resolv.conf ~/resolv.conf.bak sudo rm /etc/resolv.conf sudo nano /etc/resolv.conf nameserver 127.0.0.1 #back up to dns over plaintext not recomennded if your dnscrypt-proxy service stops for whatever reason (enable in systemd, too lazy to write here) #nameserver 1.1.1.1 sudo chattr +i /etc/resolv.conf Always use DoH / DoT (DNS over HTTPS / TLS) in firefox, settings -> DNS in search select Max protection choose NexDNS, make a NexDNS account for further privacy/setting up your local DNS restrictions like ad/tracker blocks or use cloudflare. Cheap VPS proxy: on a VPS, do said dnscrypt-proxy ssh -D 8080 -i ~/.ssh/ssh

Another option is dnscrypt-proxy[0]. It will easily let you load-balance your DNS queries against a large set of resolvers, ensuring that no resolver gets the full picture. And enforces encryption of course. [0] https://github.com/DNSCrypt/dnscrypt-proxy

This is awesome, thanks -- going to look into that now. I found SmartDNS interesting and thought I would share it, it's pretty simple to setup. I can see why it's Chinese focused, they have "interesting" internet access over there :-). I have been looking into DNS quite a bit lately (Unbound, etc), as DNS lookup performance has been pretty subpar lately. I'm in Perth, Australia, and we're pretty remote so our latency is meh at best, and Cloudflare performance has been all over the shop lately, I think they're having issues in WA). DNS can also cause really routing issues here sometimes as we get better latency to Singapore than Sydney, so we might get shunted off to SG. I've also been using dnscrypt-proxy2 (https://github.com/DNSCrypt/dnscrypt-proxy) for a while, but the above issues with Cloudflares DNS is what triggered me to look into

I use dnscrypt-proxy[0] which round-robins to a bunch of upstream servers, plus encryption. [0] https://github.com/DNSCrypt/dnscrypt-proxy

In that case maybe something like DNSCrypt[0] and a 3rd party provider makes sense. On top of the encrypted connection, DNSCrypt has the option to proxy queries to improve privacy. This only helps if they're not doing any advanced blocking though. If I remember correctly, when Russia blocked Telegram, they were blocking their IPs, not just DNS queries. If the rumours of a "RuNet" are true, then they probably need something more advanced (eg: a VPN with traffic obfuscation, Tor, etc). --- [0] https://github.com/DNSCrypt/dnscrypt-proxy

DoH does not depend on a browser! Try this out with cURL curl --http2 -H 'accept: application/dns-json' "https://1.1.1.1/dns-query?name=cloudflare.com" --next --http2 -H 'accept: application/dns-json' "https://1.1.1.1/dns-query?name=example.com" There are DoH resolvers[0] that you can use that act as a "middleman" between your browser (configured to use a standard DNS server) and DoH (which is more secure and private) [0] https://github.com/DNSCrypt/dnscrypt-proxy

https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Configuratio... >minisign_key is a public key, used to verify that the content is legitimate. Lists can thus be served from any location, even from an untrusted ISP: dnscrypt-proxy will immediately detect and reject something that has been tampered with. >https://dnscrypt.info/stamps-specifications/ >https://dnscrypt.info/faq An ISP will not be able to spoof the sources or these stamps. They wouldn't put the effort in. Even if they did, it is factored and thought about. More harmful would be a malicious DoH relay but I trust the devs.That I think is fixed by mandating the use of DNSSec too for my relays.

It's not Cloudflare's fault. In any case in order to maintain privacy I use https://dnscrypt.info it has an anonymized DNS option https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-D... I then just use unbound and forward that to DNSCrypt on my router. https://wiki.archlinux.org/title/DNSCrypt#Unbound

Use DNSCrypt with anonymized relays: https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-D... Or, wait until ODoH goes mainstream: https://datatracker.ietf.org/doc/html/draft-pauly-dprive-obl...

I run it on my pihole with Dnscryptproxy. https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Local-DoH It isn't too hard.