Lately I’ve been thinking about some concerns about domain name privacy:
• My ISP can spoof DNS responses.
• My ISP can sniff DNS requests.
• My ISP can sniff SNI.
• My ISP can look up reverse DNS on the IPs I visit.
DNS over TLS is nice—I just set up Unbound on my router to use 1.1.1.1@853 and 1.0.0.1@853 as forwarding zones. That eliminates the first bullet, at the cost of allowing CloudFlare to track my DNS requests.
I wonder how easy it is to route DNS‐over‐TLS over Tor?
• My ISP can spoof DNS responses.
• My ISP can sniff DNS requests.
• My ISP can sniff SNI.
• My ISP can look up reverse DNS on the IPs I visit.
DNS over TLS is nice—I just set up Unbound on my router to use 1.1.1.1@853 and 1.0.0.1@853 as forwarding zones. That eliminates the first bullet, at the cost of allowing CloudFlare to track my DNS requests.
I wonder how easy it is to route DNS‐over‐TLS over Tor?