<story><title>DNSCrypt – A protocol to improve DNS security</title><url>https://dnscrypt.org</url></story><parent_chain></parent_chain><comment><author>gwu78</author><text>I prefer &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;curvedns.on2it.net&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;curvedns.on2it.net&lt;/a&gt;&lt;p&gt;This was the original.&lt;p&gt;Other than having to modify their ksh script, it is painless to set up.&lt;p&gt;In my opinion, authoritative nameservers, and therefore DNSCurve forwarders like CurveDNS, are more important than recursive resolvers&amp;#x2F;caches such as OpenDNS and DNSCrypt.&lt;p&gt;A recursive resolver should be authoritative for nothing.  They are middlemen.  Companies that offered this &amp;quot;service&amp;quot;, such as OpenDNS, had to pander to advertisers, or were run by advertising companies themselves, e.g., Google.&lt;p&gt;The &amp;quot;rules&amp;quot; of DNS are easily broken.  This applies to caches.  One does not need to look very far to find resolvers that someone has designated as &amp;quot;authoritative&amp;quot;.  dnsq: &amp;quot;weird ra&amp;quot;.  This often means an open resolver IME.&lt;p&gt;A while back some companies including the ones named above if I am not mistaken were pushing for extensions in DNS to put at least part of user IP addresses into DNS packets so cache operators could track them.  The reason?  Advertising.  (Although maybe they would cite other reasons.)  Not sure what ever happened with that.  BIND had started to implement it.  Thankfully djbdns will never support this garbage.&lt;p&gt;This kind of nonsense is why I cannot get excited about the latest extensions to internet protocols anymore.&lt;p&gt;Too often they are for the benefit of web companies and advertisers, not users.&lt;p&gt;The &amp;quot;encrypted DNS revolution&amp;quot;, if it ever comes, is not going to be initiated by companies running recursive resolvers.  (Unless they also run authoritative nameservers.)&lt;p&gt;Note: When the user runs their own cache on localhost there is no need to determine nearest POP.</text></comment>
<story><title>DNSCrypt – A protocol to improve DNS security</title><url>https://dnscrypt.org</url></story><parent_chain></parent_chain><comment><author>arkadiyt</author><text>For all the attention that https gets, I&amp;#x27;m amazed how little (relatively speaking) attention plaintext dns gets.&lt;p&gt;If a site is https then even if an attacker is MITM-ing DNS to their own site they presumably won&amp;#x27;t have a valid cert for the site they&amp;#x27;re intercepting, although it has happened many times before, and 50% of the internet is still unencrypted. But even assuming that doesn&amp;#x27;t happen it&amp;#x27;s still a huge privacy&amp;#x2F;data leak.</text></comment>