diff --git a/i18n/ar/advanced/dns-overview.md b/i18n/ar/advanced/dns-overview.md index 2ffb67b2..e637f27b 100644 --- a/i18n/ar/advanced/dns-overview.md +++ b/i18n/ar/advanced/dns-overview.md @@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies). +### Native Operating System Support + +#### Android + +يدعم أندرويد ٩ وما بعده أنظمة أسماء النطاقات عبر أمن طبقة النقل (DNS over TLS). تجد هذا الإعداد في: **الإعدادات** ← ** الشبكة والإنترنت ** ← **نظام أسماء نطاقات خاص**. + +#### Apple Devices + +تدعم آخر إصدارات آي‌أو‌إس و آيباد‌أو‌إس و تي‌في‌أو‌إس و ماك‌أو‌إس أنظمة DoT و DoH. يوجد دعم أصيل لهذه الموافيق باستخدام [ملفَّات تعريف الضبط](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) أو باستخدام [واجهة برمجة إعدادات نظام تسمية النطاقات](https://developer.apple.com/documentation/networkextension/dns_settings). + +لك اختيار ضبط نظام تسمية النطاقات بعد تثبيت ملفِّ تعريف ضبط أو تثبيت تطبيق يستخدم واجهة برمجة إعدادات نظام تسمية النطاقات. إن كانت شبكة خاصَّة افتراضية (VPN) مفعَّلةً فسوف تُحلَّل الاتصالات داخلها باستخدام نظام تسمية نطاقاتها وليس باستخدام إعدادات نظامك. + +لا تتيح أبل واجهةً أصيلةً لإنشاء ملفَّات تعريف معمَّاة. [مُنشئ ملفَّات تعريف نظام تسمية النطاقات الآمن](https://dns.notjakob.com/tool.html) هو أداة غير رسمية تتيح لك إنشاء ملفَّات تعريف نظام تسمية النطاقات معمَّاة، ولكن ضع في حسبانك أنها لن توقَّع. تفضَّل ملفَّات التعريف الموقَّعة على غيرها، وذلك ﻷن التوقيع يؤكِّد أصلها وصحَّتها. تعلَّم ملفَّات التعريف الموقَّعة بعلامة «مؤكَّد» خضراء. لتستزيد علمًا عن توقيع الرموز عليك مطالعة [عن توقيع الرموز](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## What can an outside party see? In this example we will record what happens when we make a DoH request: @@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps. -This feature does come at a privacy cost, as it tells the DNS server some information about the client's location. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/ar/dns.md b/i18n/ar/dns.md index 17567a74..9ab6cb82 100644 --- a/i18n/ar/dns.md +++ b/i18n/ar/dns.md @@ -15,50 +15,126 @@ global: ## موفِّرو الخدمة الموصى بهم -| الموفِّر | سياسة الخصوصية | الموافيق | تسجيل الأنشطة | ECS | التصفية | -| ------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | -------------------------------------------------------------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**آدجارد**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | بعض منه ١ | Yes | Based on personal configuration. لك العثور على قائمة التصفيات المستخدمة هنا. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**كلاودفلير**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH/3
DoT | بعض منه ٢ | لا يوجد | Based on personal configuration. | -| [**كنترول دي**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH/3
DoT
DoQ | اختياري٣ | لا يوجد | Based on personal configuration. | -| [**ملفاد**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | لا يوجد٤ | لا يوجد | Based on personal configuration. لك العثور على قائمة التصفيات المستخدمة هنا. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**نكست‌دي‌إن‌إس**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH/3
DoT
DoQ | اختياري٥ | اختياري | Based on personal configuration. | -| [**كواد٩**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext
DoH
DoT
DNSCrypt | بعض منه٦ | اختياري | Based on personal configuration, Malware blocking by default. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Criteria +| الموفِّر | سياسة الخصوصية | الموافيق | تسجيل الأنشطة | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | التصفية | Signed Apple Profile | +| ------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | -------------------------------------------------------------------------- | -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | بعض منه ١ | Anonymized | Based on server choice. لك العثور على قائمة التصفيات المستخدمة هنا. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**كلاودفلير**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | بعض منه ٢ | لا يوجد | Based on server choice. | [لا يوجد](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | اختياري٣ | لا يوجد | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | لا يوجد | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**ملفاد**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | لا يوجد٤ | لا يوجد | Based on server choice. لك العثور على قائمة التصفيات المستخدمة هنا. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**كواد٩**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | اختياري | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**عليك التنبُّه لأننا لسنا ذوي صلة بأيٍّ من المشاريع التي نوصي بها**، وزيادةً على [معاييرنا القياسية](about/criteria.md) فقد طوَّرنا مجموعة متطلَّبات تتيح لنا توصية توصيات موضوعية. ينبغي لك الاطِّلاع على هذه القائمة قبل الاختيار منها، وابحث بنفسك لتتيقَّن من أن ما اخترت يناسبك. +## Self-Hosted DNS Filtering -- يجب أن يدعم [إضافات الأمان لأنظمة أسماء النطاقات](advanced/dns-overview.md#what-is-dnssec). -- [تدنية الأسماء المؤهَّلة](advanced/dns-overview.md#what-is-qname-minimization). -- يسمح بتعطيل [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs). -- يفضِّل دعم [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) أو دعم geo-steering. +تتيح الاستضافة الذاتية لنظام تسمية نطاقات التصفية في المنصَّات المتحكَّم بها، مثل أجهزة التلفاز الذكية وغيرها من أجهزة إنترنت الأشياء، وذلك لأن جهة العميل لا تحتاج لأي برمجيات. -## Native Operating System Support +### Pi-hole -### Android +
-يدعم أندرويد ٩ وما بعده أنظمة أسماء النطاقات عبر أمن طبقة النقل (DNS over TLS). تجد هذا الإعداد في: **الإعدادات** ← ** الشبكة والإنترنت ** ← **نظام أسماء نطاقات خاص**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple Devices +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -تدعم آخر إصدارات آي‌أو‌إس و آيباد‌أو‌إس و تي‌في‌أو‌إس و ماك‌أو‌إس أنظمة DoT و DoH. يوجد دعم أصيل لهذه الموافيق باستخدام [ملفَّات تعريف الضبط](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) أو باستخدام [واجهة برمجة إعدادات نظام تسمية النطاقات](https://developer.apple.com/documentation/networkextension/dns_settings). +صُمِّم باي-هول ليستضاف في جهاز راسبيري باي، ولكنَّه ليس محدودًا به. لهذه البرمجية واجهة وِب سهلة الاستخدام ترى فيها المعلومات وتدير ما حُظر. -لك اختيار ضبط نظام تسمية النطاقات بعد تثبيت ملفِّ تعريف ضبط أو تثبيت تطبيق يستخدم واجهة برمجة إعدادات نظام تسمية النطاقات. إن كانت شبكة خاصَّة افتراضية (VPN) مفعَّلةً فسوف تُحلَّل الاتصالات داخلها باستخدام نظام تسمية نطاقاتها وليس باستخدام إعدادات نظامك. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### ملفَّات التعريف الموقَّعة - -لا تتيح أبل واجهةً أصيلةً لإنشاء ملفَّات تعريف معمَّاة. [مُنشئ ملفَّات تعريف نظام تسمية النطاقات الآمن](https://dns.notjakob.com/tool.html) هو أداة غير رسمية تتيح لك إنشاء ملفَّات تعريف نظام تسمية النطاقات معمَّاة، ولكن ضع في حسبانك أنها لن توقَّع. تفضَّل ملفَّات التعريف الموقَّعة على غيرها، وذلك ﻷن التوقيع يؤكِّد أصلها وصحَّتها. تعلَّم ملفَّات التعريف الموقَّعة بعلامة «مؤكَّد» خضراء. لتستزيد علمًا عن توقيع الرموز عليك مطالعة [عن توقيع الرموز](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -[لا يدعم](https://github.com/systemd/systemd/issues/8639) ‹systemd-resolved› ميفاق DoH بعد، وهو ما تستخدمه الكثير من توزيعات لينكس لتبحث في أنظمة تسمية النطاقات. إن أردت استخدام DoH فعليك تثبيت وسيط مثل [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) [وضبطه](https://wiki.archlinux.org/title/Dnscrypt-proxy) ليستلم كلَّ استعلامات أنظمة تسمية النطاقات من محلِّل نظامك ويوجِّههم عبر HTTPS. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +لدى آدجارد هوم واجهة وِب متقنة الصنع ترى فيها المعلومات وتدير ما حُظر. + +[:octicons-home-16: الصفحة الرئيسة](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="سياسة الخصوصية" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=التوثيق} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="رمز المصدر" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### كنترول دي + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### نكست‌دي‌إن‌إس + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Encrypted DNS Proxies -توفِّر برمجيات التوسُّط بين أنظمة تسمية النطاقات وسيطًا محليًّا [لمحلِّل نظام التسمية غير المعمَّى](advanced/dns-overview.md#unencrypted-dns) لتوجِّه الطلبات له. ويشيع استخدامه في المنصَّات التي لا تدعم [أنظمة تسمية النطاقات المعمَّاة](advanced/dns-overview.md#what-is-encrypted-dns) أصلًا. +توفِّر برمجيات التوسُّط بين أنظمة تسمية النطاقات وسيطًا محليًّا [لمحلِّل نظام التسمية غير المعمَّى](advanced/dns-overview.md#unencrypted-dns) لتوجِّه الطلبات له. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ global:
-## Self-hosted Solutions +## Criteria -تتيح الاستضافة الذاتية لنظام تسمية نطاقات التصفية في المنصَّات المتحكَّم بها، مثل أجهزة التلفاز الذكية وغيرها من أجهزة إنترنت الأشياء، وذلك لأن جهة العميل لا تحتاج لأي برمجيات. +**عليك التنبُّه لأننا لسنا ذوي صلة بأيٍّ من المشاريع التي نوصي بها**، وزيادةً على [معاييرنا القياسية](about/criteria.md) فقد طوَّرنا مجموعة متطلَّبات تتيح لنا توصية توصيات موضوعية. ينبغي لك الاطِّلاع على هذه القائمة قبل الاختيار منها، وابحث بنفسك لتتيقَّن من أن ما اخترت يناسبك. -### AdGuard Home +### Minimum Requirements -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -لدى آدجارد هوم واجهة وِب متقنة الصنع ترى فيها المعلومات وتدير ما حُظر. - -[:octicons-home-16: الصفحة الرئيسة](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="سياسة الخصوصية" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=التوثيق} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="رمز المصدر" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -صُمِّم باي-هول ليستضاف في جهاز راسبيري باي، ولكنَّه ليس محدودًا به. لهذه البرمجية واجهة وِب سهلة الاستخدام ترى فيها المعلومات وتدير ما حُظر. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [تدنية الأسماء المؤهَّلة](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- يفضِّل دعم [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) أو دعم geo-steering. [^1]: تخزِّن آدجارد قياسات الأداء المجمَّعة من خوادم أنظمة تسمية نطاقاتهم، وتتضمَّن عدد الطلبات المكتملة لكلِّ خادم، وعدد الطلبات المحظورة، وسرعة معالجة الطلبات. وتخزِّن أيضًا قاعدة بيانات بها النطاقات المطلوبة خلال آخر ٢٤ ساعة. «نحتاج هذه المعلومات لنتحرَّى ونحظر المتتبِّعات والمخاطر الجديدة.» «وكذلك نسجِّل عدد المرات التي تُحظر فيها المتتبِّعات. نحتاج هذه المعلومات لنزيل القواعد القديمة من تصفياتنا.» [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: تجمِّع وتخزِّن كلاودفلير عددًا قليلًا من استعلامات أنظمة تسمية النطاقات المرسلة للمحلِّل ١٫١٫١٫١. لا تسجِّل خدمة المحلِّل ١٫١٫١٫١ بيانات شخصيةً، وغالب ما تسِّجل من بيانات لا تعرِّف الأشخاص تخزَّن مدَّة ٢٥ ساعةً لا أكثر. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: تسجِّل كنترول دي البيانات من المحلِّلات المدفوعة التي لها ملفَّات تعريف مخصَّصة فقط. المحلِّلات المجَّانية لا تسجِّل بيانات. [https://controld.com/privacy](https://controld.com/privacy) [^4]: خدمة أنظمة تسمية النطاقات من ملفاد متاحة للمشتركين في خدمة الشبكة الخاصة الافتراضية ولغير المشتركين كذلك. تزعم سياسة خصوصيتهم صريحًا أنهم لا يسجِّلون طلبات أنظمة تسمية النطاقات أبدًا. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: تجمع كواد٩ بعض البيانات لمراقبة المخاطر والاستجابات. ويمكن لتلك البيانات أن تُخلط وتُشارك، وغرض ذلك قد يكون لأبحاث الأمن. لا تجمع كواد٩ ولا تسجِّل عناوين IP أو أيَّ بيانات تصنِّفها معرِّفةً شخصيًّا. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: تجمع كواد٩ بعض البيانات لمراقبة المخاطر والاستجابات. ويمكن لتلك البيانات أن تُخلط وتُشارك، وغرض ذلك قد يكون لأبحاث الأمن. لا تجمع كواد٩ ولا تسجِّل عناوين IP أو أيَّ بيانات تصنِّفها معرِّفةً شخصيًّا. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/bn-IN/advanced/dns-overview.md b/i18n/bn-IN/advanced/dns-overview.md index 2ffb67b2..a8f8682a 100644 --- a/i18n/bn-IN/advanced/dns-overview.md +++ b/i18n/bn-IN/advanced/dns-overview.md @@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies). +### Native Operating System Support + +#### অ্যান্ড্রয়েড + +Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**. + +#### Apple Devices + +The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). + +After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. + +Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## What can an outside party see? In this example we will record what happens when we make a DoH request: @@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps. -This feature does come at a privacy cost, as it tells the DNS server some information about the client's location. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/bn-IN/dns.md b/i18n/bn-IN/dns.md index 8f917f04..ccdf2013 100644 --- a/i18n/bn-IN/dns.md +++ b/i18n/bn-IN/dns.md @@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [ ## Recommended Providers -| DNS Provider | Privacy Policy | Protocols | Logging | ECS | Filtering | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Some[^1] | Yes | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH/3
DoT | Some[^2] | No | Based on personal configuration. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH/3
DoT
DoQ | Optional[^3] | No | Based on personal configuration. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | No[^4] | No | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH/3
DoT
DoQ | Optional[^5] | Optional | Based on personal configuration. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext
DoH
DoT
DNSCrypt | Some[^6] | Optional | Based on personal configuration, Malware blocking by default. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Criteria +| DNS Provider | Privacy Policy | Protocols | Logging | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | No | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. +## Self-Hosted DNS Filtering -- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec). -- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). -- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled. -- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. +A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. -## Native Operating System Support +### Pi-hole -### অ্যান্ড্রয়েড +
-Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple Devices +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). +Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. -After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### Signed Profiles - -Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home features a polished web interface to view insights and manage blocked content. + +[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Encrypted DNS Proxies -Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). +Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
-## Self-hosted Solutions +## Criteria -A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. +**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. -### AdGuard Home +### Minimum Requirements -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home features a polished web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy) [^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/bn/advanced/dns-overview.md b/i18n/bn/advanced/dns-overview.md index 2ffb67b2..f4090aa0 100644 --- a/i18n/bn/advanced/dns-overview.md +++ b/i18n/bn/advanced/dns-overview.md @@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies). +### Native Operating System Support + +#### Android + +Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**. + +#### Apple Devices + +The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). + +After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. + +Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## What can an outside party see? In this example we will record what happens when we make a DoH request: @@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps. -This feature does come at a privacy cost, as it tells the DNS server some information about the client's location. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/bn/dns.md b/i18n/bn/dns.md index 01705a81..ccdf2013 100644 --- a/i18n/bn/dns.md +++ b/i18n/bn/dns.md @@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [ ## Recommended Providers -| DNS Provider | Privacy Policy | Protocols | Logging | ECS | Filtering | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Some[^1] | Yes | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH/3
DoT | Some[^2] | No | Based on personal configuration. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH/3
DoT
DoQ | Optional[^3] | No | Based on personal configuration. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | No[^4] | No | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH/3
DoT
DoQ | Optional[^5] | Optional | Based on personal configuration. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext
DoH
DoT
DNSCrypt | Some[^6] | Optional | Based on personal configuration, Malware blocking by default. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Criteria +| DNS Provider | Privacy Policy | Protocols | Logging | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | No | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. +## Self-Hosted DNS Filtering -- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec). -- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). -- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled. -- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. +A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. -## Native Operating System Support +### Pi-hole -### Android +
-Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple Devices +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). +Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. -After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### Signed Profiles - -Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home features a polished web interface to view insights and manage blocked content. + +[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Encrypted DNS Proxies -Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). +Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
-## Self-hosted Solutions +## Criteria -A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. +**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. -### AdGuard Home +### Minimum Requirements -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home features a polished web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy) [^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/cs/advanced/dns-overview.md b/i18n/cs/advanced/dns-overview.md index 2ffb67b2..f4090aa0 100644 --- a/i18n/cs/advanced/dns-overview.md +++ b/i18n/cs/advanced/dns-overview.md @@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies). +### Native Operating System Support + +#### Android + +Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**. + +#### Apple Devices + +The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). + +After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. + +Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## What can an outside party see? In this example we will record what happens when we make a DoH request: @@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps. -This feature does come at a privacy cost, as it tells the DNS server some information about the client's location. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/cs/dns.md b/i18n/cs/dns.md index 67e52e02..57dba31d 100644 --- a/i18n/cs/dns.md +++ b/i18n/cs/dns.md @@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [ ## Recommended Providers -| DNS Provider | Privacy Policy | Protocols | Logging | ECS | Filtering | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Some[^1] | Yes | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH/3
DoT | Some[^2] | Ne | Based on personal configuration. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH/3
DoT
DoQ | Optional[^3] | Ne | Based on personal configuration. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | No[^4] | Ne | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH/3
DoT
DoQ | Optional[^5] | Optional | Based on personal configuration. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext
DoH
DoT
DNSCrypt | Some[^6] | Optional | Based on personal configuration, Malware blocking by default. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Criteria +| DNS Provider | Privacy Policy | Protocols | Logging | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | Ne | Based on server choice. | [Ne](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | Ne | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Ne | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | Ne | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. +## Self-Hosted DNS Filtering -- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec). -- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). -- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled. -- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. +A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. -## Native Operating System Support +### Pi-hole -### Android +
-Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple Devices +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). +Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. -After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### Signed Profiles - -Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home features a polished web interface to view insights and manage blocked content. + +[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Encrypted DNS Proxies -Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). +Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
-## Self-hosted Solutions +## Criteria -A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. +**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. -### AdGuard Home +### Minimum Requirements -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home features a polished web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy) [^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/de/advanced/dns-overview.md b/i18n/de/advanced/dns-overview.md index 8d68693b..05451623 100644 --- a/i18n/de/advanced/dns-overview.md +++ b/i18n/de/advanced/dns-overview.md @@ -82,6 +82,24 @@ Verschlüsseltes DNS kann sich auf eine Reihe von Protokollen beziehen, von dene Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies). +### Native Betriebssystemunterstützung + +#### Android + +Android 9 und höher unterstützen DNS über TLS. Die Einstellungen sind zu finden unter: **Einstellungen** → **Netzwerk & Internet** → **Privates DNS**. + +#### Apple-Geräte + +Die neuesten Versionen von iOS, iPadOS, tvOS und macOS unterstützen sowohl DoT als auch DoH. Beide Protokolle werden nativ über [Konfigurationsprofile](https://support.apple.com/de-de/guide/security/secf6fb9f053/web) oder über die [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings)unterstützt. + +Nach der Installation eines Konfigurationsprofils oder einer Anwendung, die die DNS-Einstellungs-API verwendet, kann die DNS-Konfiguration ausgewählt werden. Wenn ein VPN aktiv ist, verwendet die DNS Auflösung innerhalb des VPN-Tunnels die DNS-Einstellungen des VPN und nicht deine systemweiten Einstellungen. + +Apple bietet keine native Schnittstelle zur Erstellung von Profilen mit verschlüsseltem DNS. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) ist ein inoffizielles Tool zur Erstellung eigener Profile mit verschlüsseltem DNS, diese sind jedoch nicht signiert. Signierte Profile sind zu bevorzugen; das Signieren bestätigt die Herkunft eines Profils und trägt dazu bei, die Integrität der Profile zu gewährleisten. Signierte Konfigurationsprofile erhalten ein grünes "Verifiziert"-Label. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## What can an outside party see? In this example we will record what happens when we make a DoH request: @@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps. -This feature does come at a privacy cost, as it tells the DNS server some information about the client's location. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/de/dns.md b/i18n/de/dns.md index f1b5df11..18f2165e 100644 --- a/i18n/de/dns.md +++ b/i18n/de/dns.md @@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [ ## Empfohlene DNS-Anbieter -| DNS-Anbieter | Datenschutzerklärung | Protokolle | Protokollierung | ECS | Filter | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | --------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Some[^1] | Yes | Based on personal configuration. Die verwendete Filterliste findest du hier. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Klartext
DoH/3
DoT | Some[^2] | Nein | Based on personal configuration. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Klartext
DoH/3
DoT
DoQ | Optional[^3] | Nein | Based on personal configuration. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | Nein[^4] | Nein | Based on personal configuration. Die verwendete Filterliste findest du hier. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Klartext
DoH/3
DoT
DoQ | Optional[^5] | Optional | Based on personal configuration. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Klartext
DoH
DoT
DNSCrypt | Some[^6] | Optional | Based on personal configuration, Malware blocking by default. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Kriterien +| DNS-Anbieter | Datenschutzerklärung | Protokolle | Protokollierung | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filter | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | --------------- | -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Die verwendete Filterliste findest du hier. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | Nein | Based on server choice. | [Nein](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | Nein | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Nein | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | Nein[^4] | Nein | Based on server choice. Die verwendete Filterliste findest du hier. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Bitte beachte, dass wir mit keinem der Projekte, die wir empfehlen, verbunden sind.** Zusätzlich zu unseren [Standardkriterien](about/criteria.md) haben wir eine Reihe klarer Anforderungen entwickelt, die es uns ermöglichen, objektive Empfehlungen zu geben. Wir empfehlen, sich mit dieser Liste vertraut zu machen, bevor sich für ein Projekt entschieden wird und eigenen Nachforschungen anzustellen, um sicherzustellen, dass es die richtige Wahl ist. +## Self-Hosted DNS Filtering -- Muss [DNSSEC](advanced/dns-overview.md#what-is-dnssec) unterstützen. -- [QNAME Minimierung](advanced/dns-overview.md#what-is-qname-minimization). -- Erlaubt es [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) zu deaktivieren. -- Bevorzugt [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) Unterstützung oder Geo-Steering-Unterstützung. +Eine selbst gehostete DNS-Lösung ist nützlich für die Filterung auf kontrollierten Plattformen wie Smart-TVs und anderen IoT-Geräten, da keine clientseitige Software erforderlich ist. -## Native Betriebssystemunterstützung +### Pi-hole -### Android +
-Android 9 und höher unterstützen DNS über TLS. Die Einstellungen sind zu finden unter: **Einstellungen** → **Netzwerk & Internet** → **Privates DNS**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple-Geräte +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -Die neuesten Versionen von iOS, iPadOS, tvOS und macOS unterstützen sowohl DoT als auch DoH. Beide Protokolle werden nativ über [Konfigurationsprofile](https://support.apple.com/de-de/guide/security/secf6fb9f053/web) oder über die [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings)unterstützt. +Pi-hole ist für den Betrieb auf einem Raspberry Pi konzipiert, ist aber nicht auf diese Hardware beschränkt. The software features a friendly web interface to view insights and manage blocked content. -Nach der Installation eines Konfigurationsprofils oder einer Anwendung, die die DNS-Einstellungs-API verwendet, kann die DNS-Konfiguration ausgewählt werden. Wenn ein VPN aktiv ist, verwendet die DNS Auflösung innerhalb des VPN-Tunnels die DNS-Einstellungen des VPN und nicht deine systemweiten Einstellungen. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### Signierte Profile - -Apple bietet keine native Schnittstelle zur Erstellung von Profilen mit verschlüsseltem DNS. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) ist ein inoffizielles Tool zur Erstellung eigener Profile mit verschlüsseltem DNS, diese sind jedoch nicht signiert. Signierte Profile sind zu bevorzugen; das Signieren bestätigt die Herkunft eines Profils und trägt dazu bei, die Integrität der Profile zu gewährleisten. Signierte Konfigurationsprofile erhalten ein grünes "Verifiziert"-Label. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -`systemd-resolved`, das viele Linux-Distributionen für ihre DNS Abfragen verwenden, unterstützt noch nicht [DoH](https://github.com/systemd/systemd/issues/8639). Wenn trotzdem DoH verwendent werden soll, muss ein Proxy wie [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) installiert und [konfiguriert](https://wiki.archlinux.org/title/Dnscrypt-proxy) werden, um alle DNS-Anfragen vom System-Resolver entgegenzunehmen und sie über HTTPS weiterzuleiten. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home bietet eine ausgefeilte Weboberfläche, über die Einblicke erhalten und blockierte Inhalte verwalten werden können. + +[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Verschlüsselte DNS-Proxies -Verschlüsselte DNS-Proxy-Software stellt einen lokalen Proxy für den [unverschlüsselten DNS-](advanced/dns-overview.md#unencrypted-dns) Resolver zur Verfügung. Normalerweise wird es auf Plattformen verwendet, die [verschlüsseltes DNS](advanced/dns-overview.md#what-is-encrypted-dns) nicht unterstützen. +Verschlüsselte DNS-Proxy-Software stellt einen lokalen Proxy für den [unverschlüsselten DNS-](advanced/dns-overview.md#unencrypted-dns) Resolver zur Verfügung. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Verschlüsselte DNS-Proxy-Software stellt einen lokalen Proxy für den [unversch
-## Selbstgehostete Lösungen +## Kriterien -Eine selbst gehostete DNS-Lösung ist nützlich für die Filterung auf kontrollierten Plattformen wie Smart-TVs und anderen IoT-Geräten, da keine clientseitige Software erforderlich ist. +**Bitte beachte, dass wir mit keinem der Projekte, die wir empfehlen, verbunden sind.** Zusätzlich zu unseren [Standardkriterien](about/criteria.md) haben wir eine Reihe klarer Anforderungen entwickelt, die es uns ermöglichen, objektive Empfehlungen zu geben. Wir empfehlen, sich mit dieser Liste vertraut zu machen, bevor sich für ein Projekt entschieden wird und eigenen Nachforschungen anzustellen, um sicherzustellen, dass es die richtige Wahl ist. -### AdGuard Home +### Minimum Requirements -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home bietet eine ausgefeilte Weboberfläche, über die Einblicke erhalten und blockierte Inhalte verwalten werden können. - -[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole ist für den Betrieb auf einem Raspberry Pi konzipiert, ist aber nicht auf diese Hardware beschränkt. The software features a friendly web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [QNAME Minimierung](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Bevorzugt [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) Unterstützung oder Geo-Steering-Unterstützung. [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy) [^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/el/advanced/dns-overview.md b/i18n/el/advanced/dns-overview.md index 2ffb67b2..f4090aa0 100644 --- a/i18n/el/advanced/dns-overview.md +++ b/i18n/el/advanced/dns-overview.md @@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies). +### Native Operating System Support + +#### Android + +Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**. + +#### Apple Devices + +The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). + +After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. + +Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## What can an outside party see? In this example we will record what happens when we make a DoH request: @@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps. -This feature does come at a privacy cost, as it tells the DNS server some information about the client's location. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/el/dns.md b/i18n/el/dns.md index 01705a81..ccdf2013 100644 --- a/i18n/el/dns.md +++ b/i18n/el/dns.md @@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [ ## Recommended Providers -| DNS Provider | Privacy Policy | Protocols | Logging | ECS | Filtering | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Some[^1] | Yes | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH/3
DoT | Some[^2] | No | Based on personal configuration. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH/3
DoT
DoQ | Optional[^3] | No | Based on personal configuration. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | No[^4] | No | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH/3
DoT
DoQ | Optional[^5] | Optional | Based on personal configuration. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext
DoH
DoT
DNSCrypt | Some[^6] | Optional | Based on personal configuration, Malware blocking by default. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Criteria +| DNS Provider | Privacy Policy | Protocols | Logging | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | No | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. +## Self-Hosted DNS Filtering -- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec). -- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). -- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled. -- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. +A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. -## Native Operating System Support +### Pi-hole -### Android +
-Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple Devices +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). +Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. -After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### Signed Profiles - -Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home features a polished web interface to view insights and manage blocked content. + +[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Encrypted DNS Proxies -Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). +Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
-## Self-hosted Solutions +## Criteria -A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. +**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. -### AdGuard Home +### Minimum Requirements -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home features a polished web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy) [^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/eo/advanced/dns-overview.md b/i18n/eo/advanced/dns-overview.md index 2ffb67b2..f4090aa0 100644 --- a/i18n/eo/advanced/dns-overview.md +++ b/i18n/eo/advanced/dns-overview.md @@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies). +### Native Operating System Support + +#### Android + +Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**. + +#### Apple Devices + +The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). + +After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. + +Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## What can an outside party see? In this example we will record what happens when we make a DoH request: @@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps. -This feature does come at a privacy cost, as it tells the DNS server some information about the client's location. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/eo/dns.md b/i18n/eo/dns.md index 01705a81..ccdf2013 100644 --- a/i18n/eo/dns.md +++ b/i18n/eo/dns.md @@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [ ## Recommended Providers -| DNS Provider | Privacy Policy | Protocols | Logging | ECS | Filtering | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Some[^1] | Yes | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH/3
DoT | Some[^2] | No | Based on personal configuration. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH/3
DoT
DoQ | Optional[^3] | No | Based on personal configuration. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | No[^4] | No | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH/3
DoT
DoQ | Optional[^5] | Optional | Based on personal configuration. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext
DoH
DoT
DNSCrypt | Some[^6] | Optional | Based on personal configuration, Malware blocking by default. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Criteria +| DNS Provider | Privacy Policy | Protocols | Logging | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | No | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. +## Self-Hosted DNS Filtering -- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec). -- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). -- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled. -- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. +A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. -## Native Operating System Support +### Pi-hole -### Android +
-Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple Devices +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). +Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. -After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### Signed Profiles - -Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home features a polished web interface to view insights and manage blocked content. + +[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Encrypted DNS Proxies -Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). +Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
-## Self-hosted Solutions +## Criteria -A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. +**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. -### AdGuard Home +### Minimum Requirements -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home features a polished web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy) [^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/es/advanced/dns-overview.md b/i18n/es/advanced/dns-overview.md index db61538e..4eb630c4 100644 --- a/i18n/es/advanced/dns-overview.md +++ b/i18n/es/advanced/dns-overview.md @@ -82,6 +82,24 @@ DNS encriptado puede referirse a uno de un número de protocolos, los más comun La implementación nativa de DoH apareció en iOS 14, macOS 11, Microsoft Windows y Android 13 (sin embargo, no estará habilitada [por defecto](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). El soporte general de los escritorios de Linux está a la espera de la [implementación](https://github.com/systemd/systemd/issues/8639) de systemd por lo que [la instalación de software de terceros sigue siendo necesaria](../dns.md#linux). +### Compatibilidad con Sistemas Operativos Nativos + +#### Android + +Android 9 y superiores soportan DNS sobre TLS. Los ajustes se pueden encontrar en: **Configuración** → **Red & Internet** → **DNS privado**. + +#### Dispositivos Apple + +Las últimas versiones de iOS, iPadOS, tvOS y macOS, soportan tanto DoT como DoH. Ambos protocolos son soportados nativamente a través de [configuración de perfiles ](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) o a través de la [API de configuración DNS](https://developer.apple.com/documentation/networkextension/dns_settings). + +Tras la instalación de un perfil de configuración o de una aplicación que utilice la API de configuración de DNS, se puede seleccionar la configuración de DNS. Si una VPN está activa, la resolución dentro del túnel VPN utilizará la configuración DNS de la VPN y no la configuración de todo el sistema. + +Apple no proporciona una interfaz nativa para crear perfiles DNS encriptados. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) es una herramienta no oficial para crear tus propios perfiles DNS encriptados, aunque no estarán firmados. Son preferibles los perfiles firmados; la firma valida el origen de un perfil y ayuda a garantizar su integridad. Los perfiles de configuración firmados reciben la etiqueta verde de "Verificado". Para más información sobre la firma de código, consulte [Acerca de la firma de código](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## ¿Qué puede ver un tercero? En este ejemplo registraremos lo que sucede cuando hacemos una solicitud de DoH: @@ -318,4 +336,27 @@ La [Subred de Cliente EDNS](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) es Su objetivo es "acelerar" la entrega de datos dando al cliente una respuesta que pertenece a un servidor que está cerca de él, como una [red de distribución de contenidos](https://es.wikipedia.org/wiki/Red_de_distribuci%C3%B3n_de_contenidos), que se utilizan a menudo en la transmisión de vídeo y el servicio de aplicaciones web de JavaScript. -Esta característica tiene un coste de privacidad, ya que indica al servidor DNS cierta información sobre la ubicación del cliente. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/es/dns.md b/i18n/es/dns.md index 59883723..406f7945 100644 --- a/i18n/es/dns.md +++ b/i18n/es/dns.md @@ -15,50 +15,126 @@ Un DNS encriptado con servidores de terceros solo debe utilizarse para evitar el ## Proveedores Recomendados -| Proveedor de DNS | Política de Privacidad | Protocolos | Registro | ECS | Filtrado | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Algún[^1] | Sí | Basado en la configuración personal. La lista de filtros siendo utilizada se puede encontrar aquí. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH/3
DoT | Algún[^2] | No | Basado en la configuración personal. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH/3
DoT
DoQ | Opcional[^3] | No | Basado en la configuración personal. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | No[^4] | No | Basado en la configuración personal. La lista de filtro que se está utilizando se puede encontrar aquí. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH/3
DoT
DoQ | Opcional [^5] | Opcional | Basado en la configuración personal. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Texto claro
DoH
DoT
DNSCrypt | Algún[^6] | Opcional | Basado en la configuración personal, bloqueo de malware por defecto. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Criterios +| Proveedor de DNS | Política de Privacidad | Protocolos | Registro | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtrado | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Algún[^1] | Anonymized | Based on server choice. La lista de filtros siendo utilizada se puede encontrar aquí. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Sí](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Algún[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Opcional[^3] | No | Based on server choice. | [Sí](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Sí](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. La lista de filtro que se está utilizando se puede encontrar aquí. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Sí](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Opcional | Based on server choice, malware blocking by default. | [Sí](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Ten en cuenta que no estamos afiliados con ninguno de los proyectos que recomendamos.** Además de [nuestros criterios estándar](about/criteria.md), hemos desarrollado un conjunto claro de requisitos que nos permiten proporcionar recomendaciones objetivas. Te sugerimos que te familiarices con esta lista antes de elegir usar un proyecto, y que lleves a cabo tu propia investigación para asegurarte de que es la elección correcta para ti. +## Self-Hosted DNS Filtering -- Debe soportar [DNSSEC](advanced/dns-overview.md#what-is-dnssec). -- [Minimización QNAME](advanced/dns-overview.md#what-is-qname-minimization). -- Permitir que [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) sea desactivado. -- Preferir soporte [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) o soporte de dirección geográfica. +Una solución DNS autoalojada es útil para proporcionar filtrado en plataformas controladas, como Smart TV y otros dispositivos IoT, ya que no se necesita software del lado del cliente. -## Compatibilidad con Sistemas Operativos Nativos +### Pi-hole -### Android +
-Android 9 y superiores soportan DNS sobre TLS. Los ajustes se pueden encontrar en: **Configuración** → **Red & Internet** → **DNS privado**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Dispositivos Apple +**Pi-hole** es un [DNS-sinkhole](https://es.wikipedia.org/wiki/DNS_sinkhole) de código abierto que utiliza [filtrado DNS](https://cloudflare.com/learning/access-management/what-is-dns-filtering) para bloquear contenidos web no deseados, como la publicidad. -Las últimas versiones de iOS, iPadOS, tvOS y macOS, soportan tanto DoT como DoH. Ambos protocolos son soportados nativamente a través de [configuración de perfiles ](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) o a través de la [API de configuración DNS](https://developer.apple.com/documentation/networkextension/dns_settings). +Pi-hole está diseñado para alojarse en una Raspberry Pi, pero no se limita a dicho hardware. El software cuenta con una interfaz web fácil de usar para ver los datos y gestionar los contenidos bloqueados. -Tras la instalación de un perfil de configuración o de una aplicación que utilice la API de configuración de DNS, se puede seleccionar la configuración de DNS. Si una VPN está activa, la resolución dentro del túnel VPN utilizará la configuración DNS de la VPN y no la configuración de todo el sistema. +[:octicons-home-16: Página Principal](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Política de Privacidad" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentación} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Código Fuente" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribuir } -#### Perfiles Firmados - -Apple no proporciona una interfaz nativa para crear perfiles DNS encriptados. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) es una herramienta no oficial para crear tus propios perfiles DNS encriptados, aunque no estarán firmados. Son preferibles los perfiles firmados; la firma valida el origen de un perfil y ayuda a garantizar su integridad. Los perfiles de configuración firmados reciben la etiqueta verde de "Verificado". Para más información sobre la firma de código, consulte [Acerca de la firma de código](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Perfiles firmados** son ofrecidos por [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io) y [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Detalles

- -`systemd-resolved`, que muchas distribuciones Linux utilizan para realizar sus búsquedas DNS, todavía no [soporta DoH](https://github.com/systemd/systemd/issues/8639). Si quieres usar DoH, necesitarás instalar un proxy como [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) y [configurarlo](https://wiki. rchlinux.org/title/Dnscrypt-proxy) para obtener todas las consultas DNS de la resolución del sistema y reenviarlas sobre HTTPS. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** es un [DNS-sinkhole](https://es.wikipedia.org/wiki/DNS_sinkhole) de código abierto que utiliza [filtrado DNS](https://cloudflare.com/learning/access-management/what-is-dns-filtering) para bloquear contenidos web no deseados, como la publicidad. + +AdGuard Home cuenta con una interfaz web pulida para ver información y gestionar el contenido bloqueado. + +[:octicons-home-16: Página de Inicio](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Politica de privacidad" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentación} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Código fuente" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +Cuando se utiliza con una cuenta, NextDNS habilitará las funciones de información y registro de forma predeterminada (ya que algunas funciones lo requieren). Puedes elegir los tiempos de retención y las ubicaciones de almacenamiento de los registros que desees conservar. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Proxies DNS Cifrados -El software de proxy de DNS encriptado proporciona un proxy local para que el resolver DNS [no encriptado](advanced/dns-overview.md#unencrypted-dns) lo reenvíe. Típicamente se utiliza en plataformas que no soportan de forma nativa el [DNS encriptado](advanced/dns-overview.md#what-is-encrypted-dns). +El software de proxy de DNS encriptado proporciona un proxy local para que el resolver DNS [no encriptado](advanced/dns-overview.md#unencrypted-dns) lo reenvíe. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ El software de proxy de DNS encriptado proporciona un proxy local para que el re
-## Soluciones Autoalojadas +## Criterios -Una solución DNS autoalojada es útil para proporcionar filtrado en plataformas controladas, como Smart TV y otros dispositivos IoT, ya que no se necesita software del lado del cliente. +**Ten en cuenta que no estamos afiliados con ninguno de los proyectos que recomendamos.** Además de [nuestros criterios estándar](about/criteria.md), hemos desarrollado un conjunto claro de requisitos que nos permiten proporcionar recomendaciones objetivas. Te sugerimos que te familiarices con esta lista antes de elegir usar un proyecto, y que lleves a cabo tu propia investigación para asegurarte de que es la elección correcta para ti. -### AdGuard Home +### Requisitos Mínimos -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** es un [DNS-sinkhole](https://es.wikipedia.org/wiki/DNS_sinkhole) de código abierto que utiliza [filtrado DNS](https://cloudflare.com/learning/access-management/what-is-dns-filtering) para bloquear contenidos web no deseados, como la publicidad. - -AdGuard Home cuenta con una interfaz web pulida para ver información y gestionar el contenido bloqueado. - -[:octicons-home-16: Página de Inicio](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Politica de privacidad" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentación} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Código fuente" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** es un [DNS-sinkhole](https://es.wikipedia.org/wiki/DNS_sinkhole) de código abierto que utiliza [filtrado DNS](https://cloudflare.com/learning/access-management/what-is-dns-filtering) para bloquear contenidos web no deseados, como la publicidad. - -Pi-hole está diseñado para alojarse en una Raspberry Pi, pero no se limita a dicho hardware. El software cuenta con una interfaz web fácil de usar para ver los datos y gestionar los contenidos bloqueados. - -[:octicons-home-16: Página Principal](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Política de Privacidad" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentación} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Código Fuente" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribuir } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [Minimización QNAME](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Preferir soporte [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) o soporte de dirección geográfica. [^1]: AdGuard almacena métricas de rendimiento agregadas de sus servidores DNS, es decir, el número de solicitudes completas a un servidor en particular, el número de solicitudes bloqueadas, y la velocidad de procesamiento de solicitudes. También guardan y almacenan la base de datos de dominios solicitados dentro de las últimas 24 horas. "Necesitamos esta información para identificar y bloquear nuevos rastreadores y amenazas". "También registramos cuántas veces se ha bloqueado tal o cual rastreador. Necesitamos esta información para eliminar normas obsoletas de nuestros filtros". [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare recopila y almacena únicamente los datos de consulta DNS limitados que se envían al resolver 1.1.1.1. El servicio de resolución 1.1.1.1 no registra datos personales, y el grueso de los limitados datos de consulta no identificables personalmente se almacena solo durante 25 horas. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: El Control D solo registra los resolvers Premium con perfiles DNS personalizados. Los resolvers libres no registran datos. [https://controld.com/privacy](https://controld.com/privacy) [^4]: El servicio DNS de Mullvad está disponible tanto para suscriptores como para no suscriptores de Mullvad VPN. Su política de privacidad afirma explícitamente que no registran solicitudes DNS de ninguna manera. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: Cuando se utiliza con una cuenta, NextDNS habilitará las funciones de información y registro de forma predeterminada (ya que algunas funciones lo requieren). Puedes elegir los tiempos de retención y las ubicaciones de almacenamiento de los registros que desees conservar. Si se utiliza sin una cuenta, no se registra ningún dato. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 recopila algunos datos con fines de monitorización y respuesta ante amenazas. Esos datos pueden remezclarse y compartirse, por ejemplo, con fines de investigación sobre seguridad. Quad9 no colecciona ni registra direcciones IP ni otros datos que consideren personalmente identificables. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 recopila algunos datos con fines de monitorización y respuesta ante amenazas. Esos datos pueden remezclarse y compartirse, por ejemplo, con fines de investigación sobre seguridad. Quad9 no colecciona ni registra direcciones IP ni otros datos que consideren personalmente identificables. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/fa/advanced/dns-overview.md b/i18n/fa/advanced/dns-overview.md index 0463f7fe..b53f0f97 100644 --- a/i18n/fa/advanced/dns-overview.md +++ b/i18n/fa/advanced/dns-overview.md @@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies). +### Native Operating System Support + +#### Android + +Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**. + +#### Apple Devices + +The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). + +After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. + +Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## What can an outside party see? In this example we will record what happens when we make a DoH request: @@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps. -This feature does come at a privacy cost, as it tells the DNS server some information about the client's location. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/fa/dns.md b/i18n/fa/dns.md index 01705a81..ccdf2013 100644 --- a/i18n/fa/dns.md +++ b/i18n/fa/dns.md @@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [ ## Recommended Providers -| DNS Provider | Privacy Policy | Protocols | Logging | ECS | Filtering | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Some[^1] | Yes | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH/3
DoT | Some[^2] | No | Based on personal configuration. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH/3
DoT
DoQ | Optional[^3] | No | Based on personal configuration. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | No[^4] | No | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH/3
DoT
DoQ | Optional[^5] | Optional | Based on personal configuration. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext
DoH
DoT
DNSCrypt | Some[^6] | Optional | Based on personal configuration, Malware blocking by default. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Criteria +| DNS Provider | Privacy Policy | Protocols | Logging | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | No | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. +## Self-Hosted DNS Filtering -- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec). -- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). -- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled. -- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. +A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. -## Native Operating System Support +### Pi-hole -### Android +
-Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple Devices +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). +Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. -After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### Signed Profiles - -Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home features a polished web interface to view insights and manage blocked content. + +[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Encrypted DNS Proxies -Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). +Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
-## Self-hosted Solutions +## Criteria -A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. +**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. -### AdGuard Home +### Minimum Requirements -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home features a polished web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy) [^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/fr/advanced/dns-overview.md b/i18n/fr/advanced/dns-overview.md index 0e87cca9..287d1157 100644 --- a/i18n/fr/advanced/dns-overview.md +++ b/i18n/fr/advanced/dns-overview.md @@ -82,6 +82,24 @@ Un DNS chiffré peut faire référence à un certain nombre de protocoles, les p L'implémentation native de DoH est apparue dans iOS 14, macOS 11, Microsoft Windows et Android 13 (cependant, elle ne sera pas activée [par défaut](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). Sous Linux la prise en charge sera assurée par [l'implémentation](https://github.com/systemd/systemd/issues/8639) dans systemd donc [l'installation de logiciels tiers est encore nécessaire](../dns.md#encrypted-dns-proxies). +### Prise en charge native des systèmes d'exploitation + +#### Android + +Android 9 et supérieur prennent en charge DNS via TLS. Les paramètres peuvent être trouvés dans : **Paramètres** → **Réseau & Internet** → **DNS Privé**. + +#### Appareils Apple + +Les dernières versions d'iOS, iPadOS, tvOS et macOS prennent en charge à la fois DoT et DoH. Les deux protocoles sont pris en charge nativement par l'intermédiaire des [profils de configuration](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) ou par l'intermédiaire de [l'API de Paramètres DNS](https://developer.apple.com/documentation/networkextension/dns_settings). + +Après l'installation d'un profil de configuration ou d'une application qui utilise l'API des Paramètres DNS, la configuration DNS peut être sélectionnée. Si un VPN est actif, la résolution au sein du tunnel VPN utilisera les paramètres DNS du VPN et non les paramètres de votre système. + +Apple ne fournit pas d'interface native pour la création de profils DNS chiffrés. Le [créateur de profil DNS Sécurisé](https://dns.notjakob.com/tool.html) est un outil non officiel permettant de créer vos propres profils DNS chiffrés, mais ils ne seront pas signés. Les profils signés sont préférables ; la signature valide l'origine d'un profil et contribue à garantir l'intégrité des profils. Un label vert "Vérifié" est attribué aux profils de configuration signés. Pour plus d'informations sur la signature de code, voir [A propos de la signature de code](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## Que peut voir un tiers ? Dans cet exemple, nous allons enregistrer ce qui se passe lorsque nous faisons une requête DoH : @@ -318,4 +336,27 @@ Le [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) est un Il est destiné à "accélérer" la transmission des données en donnant au client une réponse qui appartient à un serveur proche de lui, comme un [réseau de diffusion de contenu](https://fr.wikipedia.org/wiki/Réseau_de_diffusion_de_contenu), souvent utilisé pour la diffusion de vidéos en continu et pour servir des applications Web JavaScript. -Cette fonction a un coût en termes de confidentialité, car elle fournit au serveur DNS des informations sur la localisation du client. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/fr/dns.md b/i18n/fr/dns.md index 100bcbb5..56ba48fb 100644 --- a/i18n/fr/dns.md +++ b/i18n/fr/dns.md @@ -15,50 +15,126 @@ Les DNS chiffrés avec des serveurs tiers ne doivent être utilisés que pour co ## Fournisseurs recommandés -| Fournisseur DNS | Politique de confidentialité | Protocoles | Journalisation | ECS | Filtrage | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | --------------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Un peu[^1] | Oui | En fonction de la configuration personnelle. La liste des filtres utilisés peut être consultée ici. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH
DoT | Un peu[^2] | Non | En fonction de la configuration personnelle. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH
DoT
DNSCrypt
DoQ
DoH3 | Optionnelle[^3] | Non | En fonction de la configuration personnelle. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | Aucune[^4] | Non | En fonction de la configuration personnelle. La liste des filtres utilisés peut être consultée ici. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH
DoT
DNSCrypt
DoQ
DoH3 | Optionnelle[^5] | Optionnel | En fonction de la configuration personnelle. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext
DoH
DoT
DNSCrypt | Un peu[^6] | Optionnel | En fonction de la configuration personnelle, blocage des logiciels malveillants par défaut. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Critères +| Fournisseur DNS | Politique de confidentialité | Protocoles | Journalisation | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtrage | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | --------------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Un peu[^1] | Anonymized | Based on server choice. La liste des filtres utilisés peut être consultée ici. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Oui](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Un peu[^2] | Non | Based on server choice. | [Non](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optionnelle[^3] | Non | Based on server choice. | [Oui](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Non | Anonymized | Based on server choice. | [Oui](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | Aucune[^4] | Non | Based on server choice. La liste des filtres utilisés peut être consultée ici. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Oui](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optionnel | Based on server choice, malware blocking by default. | [Oui](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Veuillez noter que nous ne sommes affiliés à aucun des projets que nous recommandons.** En plus de [nos critères de base](about/criteria.md), nous avons développé un ensemble d'exigences claires pour nous permettre de fournir des recommandations objectives. Nous vous suggérons de vous familiariser avec cette liste avant de choisir d'utiliser un projet, et de mener vos propres recherches pour vous assurer que c'est le bon choix pour vous. +## Self-Hosted DNS Filtering -- Doit supporter [DNSSEC](advanced/dns-overview.md#what-is-dnssec). -- [Minimisation QNAME](advanced/dns-overview.md#what-is-qname-minimization). -- Permettre la désactivation de [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) -- Doit préférer la prise en charge [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) ou geo-steering. +Une solution DNS auto-hébergée est utile pour assurer le filtrage sur les plateformes contrôlées, telles que les téléviseurs intelligents et autres appareils IoT, car aucun logiciel côté client n'est nécessaire. -## Prise en charge native des systèmes d'exploitation +### Pi-hole -### Android +
-Android 9 et supérieur prennent en charge DNS via TLS. Les paramètres peuvent être trouvés dans : **Paramètres** → **Réseau & Internet** → **DNS Privé**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Appareils Apple +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -Les dernières versions d'iOS, iPadOS, tvOS et macOS prennent en charge à la fois DoT et DoH. Les deux protocoles sont pris en charge nativement par l'intermédiaire des [profils de configuration](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) ou par l'intermédiaire de [l'API de Paramètres DNS](https://developer.apple.com/documentation/networkextension/dns_settings). +Pi-hole est conçu pour être hébergé sur un Raspberry Pi, mais il n'est pas limité à ce type de matériel. Le logiciel est doté d'une interface web conviviale permettant de visualiser et de gérer les contenus bloqués. -Après l'installation d'un profil de configuration ou d'une application qui utilise l'API des Paramètres DNS, la configuration DNS peut être sélectionnée. Si un VPN est actif, la résolution au sein du tunnel VPN utilisera les paramètres DNS du VPN et non les paramètres de votre système. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### Profils signés - -Apple ne fournit pas d'interface native pour la création de profils DNS chiffrés. Le [créateur de profil DNS Sécurisé](https://dns.notjakob.com/tool.html) est un outil non officiel permettant de créer vos propres profils DNS chiffrés, mais ils ne seront pas signés. Les profils signés sont préférables ; la signature valide l'origine d'un profil et contribue à garantir l'intégrité des profils. Un label vert "Vérifié" est attribué aux profils de configuration signés. Pour plus d'informations sur la signature de code, voir [A propos de la signature de code](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -`systemd-resolved`, que de nombreuses distributions Linux utilisent pour effectuer leurs recherches DNS, ne [supporte pas encore DoH](https://github.com/systemd/systemd/issues/8639). Si vous voulez utiliser DoH, vous devez installer un proxy comme [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) et [le configurer](https://wiki.archlinux.org/title/Dnscrypt-proxy) pour prendre toutes les requêtes DNS du résolveur de votre système et les transmettre via HTTPS. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home est doté d'une interface web conviviale qui permet de visualiser et de gérer le contenu bloqué. + +[:octicons-home-16: Page d'accueil](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Politique de confidentialité" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Code source" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Proxys DNS chiffrés -Un logiciel de proxy DNS chiffré fourni un proxy local vers lequel le résolveur [DNS non chiffré](advanced/dns-overview.md#unencrypted-dns) doit rediriger. Il est généralement utilisé sur les plates-formes qui ne supportent pas nativement les [DNS chiffrés](advanced/dns-overview.md#what-is-encrypted-dns). +Un logiciel de proxy DNS chiffré fourni un proxy local vers lequel le résolveur [DNS non chiffré](advanced/dns-overview.md#unencrypted-dns) doit rediriger. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Un logiciel de proxy DNS chiffré fourni un proxy local vers lequel le résolveu
-## Solutions auto-hébergées +## Critères -Une solution DNS auto-hébergée est utile pour assurer le filtrage sur les plateformes contrôlées, telles que les téléviseurs intelligents et autres appareils IoT, car aucun logiciel côté client n'est nécessaire. +**Veuillez noter que nous ne sommes affiliés à aucun des projets que nous recommandons.** En plus de [nos critères de base](about/criteria.md), nous avons développé un ensemble d'exigences claires pour nous permettre de fournir des recommandations objectives. Nous vous suggérons de vous familiariser avec cette liste avant de choisir d'utiliser un projet, et de mener vos propres recherches pour vous assurer que c'est le bon choix pour vous. -### AdGuard Home +### Exigences minimales -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home est doté d'une interface web conviviale qui permet de visualiser et de gérer le contenu bloqué. - -[:octicons-home-16: Page d'accueil](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Politique de confidentialité" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Code source" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole est conçu pour être hébergé sur un Raspberry Pi, mais il n'est pas limité à ce type de matériel. Le logiciel est doté d'une interface web conviviale permettant de visualiser et de gérer les contenus bloqués. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [Minimisation QNAME](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Doit préférer la prise en charge [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) ou geo-steering. [^1]: AdGuard stocke des mesures de performance agrégées de ses serveurs DNS, à savoir le nombre de demandes complètes adressées à un serveur particulier, le nombre de demandes bloquées et la vitesse de traitement des demandes. Ils conservent et stockent également la base de données des domaines demandés dans les dernières 24 heures. "Nous avons besoin de ces informations pour identifier et bloquer les nouveaux traqueurs et menaces." "Nous enregistrons également le nombre de fois où tel ou tel traqueur a été bloqué. Nous avons besoin de ces informations pour supprimer les règles obsolètes de nos filtres." [https://adguard.com/fr/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare ne collecte et ne stocke que les données limitées des requêtes DNS qui sont envoyées au résolveur 1.1.1.1. Le service de résolution 1.1.1.1 n'enregistre pas de données personnelles, et la majeure partie des données de requête limitées et non personnellement identifiables n'est stockée que pendant 25 heures. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D n'enregistre que les résolveurs Premium avec des profils DNS personnalisés. Les résolveurs libres n'enregistrent pas de données. [https://controld.com/privacy](https://controld.com/privacy) [^4]: Le service DNS de Mullvad est disponible à la fois pour les abonnés et les non-abonnés de Mullvad VPN. Leur politique de confidentialité affirme explicitement qu'ils n'enregistrent pas les requêtes DNS de quelque manière que ce soit. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 recueille certaines données à des fins de surveillance et de réponse aux menaces. Ces données peuvent ensuite être remélangées et partagées, par exemple à des fins de recherche sur la sécurité. Quad9 ne collecte ni n'enregistre les adresses IP ou d'autres données qu'elle juge personnellement identifiables. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 recueille certaines données à des fins de surveillance et de réponse aux menaces. Ces données peuvent ensuite être remélangées et partagées, par exemple à des fins de recherche sur la sécurité. Quad9 ne collecte ni n'enregistre les adresses IP ou d'autres données qu'elle juge personnellement identifiables. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/he/advanced/dns-overview.md b/i18n/he/advanced/dns-overview.md index 87efac09..1572c680 100644 --- a/i18n/he/advanced/dns-overview.md +++ b/i18n/he/advanced/dns-overview.md @@ -82,6 +82,24 @@ DNS מוצפן יכול להתייחס לאחד ממספר פרוטוקולים, יישום מקורי של DoH הופיע ב-iOS 14, macOS 11, Microsoft Windows ו-אנדרואיד 13 (עם זאת, הוא לא יופעל [>כברירת מחדל](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). תמיכת שולחן העבודה הכללית של לינוקס ממתינה ל[יישום](https://github.com/systemd/systemd/issues/8639) של systemd כך ש[עדיין נדרשת התקנת תוכנת צד שלישי](../dns.md#encrypted-dns-proxies). +### תמיכה במערכת הפעלה מקומית + +#### אנדרואיד + +אנדרואיד 9 ומעלה תומכת ב-DNS דרך TLS. ניתן למצוא את ההגדרות ב: **הגדרות** → **רשת & אינטרנט** → **פרטי DNS**. + +#### מוצרי Apple + +הגרסאות האחרונות של iOS, iPadOS, tvOS ו-macOS, תומכות הן ב-DoT והן ב-DoH. שני הפרוטוקולים נתמכים באופן מקורי באמצעות [פרופילי תצורה](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) או דרך [ממשק API להגדרות DNS](https://developer.apple.com/documentation/networkextension/dns_settings). + +לאחר התקנה של פרופיל תצורה או אפליקציה המשתמשת ב-API של הגדרות DNS, ניתן לבחור את תצורת ה-DNS. אם VPN פעיל, הרזולוציה בתוך מנהרת ה-VPN תשתמש בהגדרות ה-DNS של ה-VPN ולא בהגדרות כלל המערכת שלך. + +Apple אינה מספקת ממשק מקורי ליצירת פרופילי DNS מוצפנים. [יוצר פרופיל DNS מאובטח](https://dns.notjakob.com/tool.html) הוא כלי לא רשמי ליצירת פרופילי DNS מוצפנים משלך, אולם הם לא ייחתמו. פרופילים חתומים מועדפים; החתימה מאמתת את מקור הפרופיל ומסייעת להבטיח את שלמות הפרופילים. תווית "מאומת" ירוקה ניתנת לפרופילי תצורה חתומים. לקבלת מידע נוסף על חתימת קוד, ראה [אודות חתימת קוד](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### לינוקס + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## מה יכול גורם חיצוני לראות? בדוגמה זו נתעד מה קורה כאשר אנו מבקשים בקשת DoH: @@ -308,7 +326,7 @@ With "QNAME minimization," your DNS resolver now only asks for just enough infor | Root server | What's the nameserver for .net? | *Provides .net's server* | | .net's server | What's the nameserver for privacyguides.net? | *Provides Privacy Guides' server* | | Privacy Guides' server | What's the nameserver for discuss.privacyguides.net? | השרת הזה! | -| השרת של Privacy Guides | מה ה-IP של discuss.privacyguides.net? | 5.161.195.190 | +| Privacy Guides' server | What's the IP of discuss.privacyguides.net? | 5.161.195.190 | While this process can be slightly more inefficient, in this example neither the central root nameservers nor the TLD's nameservers ever receive information about your *full* query, thus reducing the amount of information being transmitted about your browsing habits. תיאור טכני נוסף מוגדר ב [RFC 7816](https://datatracker.ietf.org/doc/html/rfc7816). @@ -318,4 +336,27 @@ While this process can be slightly more inefficient, in this example neither the זה נועד "לזרז" את מסירת הנתונים על ידי מתן תשובה ללקוח השייך לשרת הקרוב אליו כגון [תוכן רשת מסירה](https://en.wikipedia.org/wiki/Content_delivery_network), המשמשות לעתים קרובות בהזרמת וידאו והגשת יישומי אינטרנט של JavaScript. -תכונה זו כרוכה בעלות פרטיות, מכיוון שהיא מספרת לשרת ה-DNS מידע על מיקומו של הלקוח. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/he/dns.md b/i18n/he/dns.md index 2133843b..ffaefb40 100644 --- a/i18n/he/dns.md +++ b/i18n/he/dns.md @@ -15,50 +15,126 @@ global: ## ספקים מומלצים -| ספקי DNS | מדיניות פרטיות | פרוטוקולים | תיעוד בקשות | ECS | סינון | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | -------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | חלקי[^1] | Yes | מבוסס על תצורה אישית. רשימת סינון בשימוש ניתן למצוא כאן. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH
DoT | חלקי[^2] | לא | מבוסס על תצורה אישית. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH
DoT
DNSCrypt
DoQ
DoH3 | אופציונאלי[^3] | לא | מבוסס על תצורה אישית. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | לא[^4] | לא | מבוסס על תצורה אישית. רשימת סינון בשימוש ניתן למצוא כאן. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH
DoT
DNSCrypt
DoQ
DoH3 | אופציונאלי[^5] | אופציונאלי | מבוסס על תצורה אישית. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext
DoH
DoT
DNSCrypt | חלק[^6] | אופציונאלי | בהתבסס על תצורה אישית, חוסם תוכנות זדוניות כברירת מחדל. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### קריטריונים +| ספקי DNS | מדיניות פרטיות | פרוטוקולים | תיעוד בקשות | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | סינון | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | -------------- | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | חלקי[^1] | Anonymized | Based on server choice. רשימת סינון בשימוש ניתן למצוא כאן. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | חלקי[^2] | לא | Based on server choice. | [לא](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | אופציונאלי[^3] | לא | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | לא | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | לא[^4] | לא | Based on server choice. רשימת סינון בשימוש ניתן למצוא כאן. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | אופציונאלי | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**שים לב שאיננו קשורים לאף אחד מהפרויקטים שאנו ממליצים עליהם.** בנוסף ל [הקריטריונים הסטנדרטיים שלנו](about/criteria.md), פיתחנו סט ברור של דרישות כדי לאפשר לנו לספק המלצות אובייקטיביות. אנו מציעים לך להכיר את הרשימה הזו לפני שתבחר להשתמש בְּספק, ולערוך מחקר משלך כדי להבטיח שזו הבחירה הנכונה עבורך. +## Self-Hosted DNS Filtering -- חייב לתמוך ב [DNSSEC](advanced/dns-overview.md#what-is-dnssec). -- [מזעור QNAME](advanced/dns-overview.md#what-is-qname-minimization). -- אפשר ל - [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) להיות מנוטרל -- תעדוף תמיכה ב[Anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) או תמיכה ב"היגוי גיאוגרפי". +פתרון DNS שמתארח בעצמו שימושי לאספקת סינון בפלטפורמות מבוקרות, כגון טלוויזיות חכמות והתקני IoT אחרים, מכיוון שאין צורך בתוכנה בצד הלקוח. -## תמיכה במערכת הפעלה מקומית +### Pi-hole -### אנדרואיד +
-אנדרואיד 9 ומעלה תומכת ב-DNS דרך TLS. ניתן למצוא את ההגדרות ב: **הגדרות** → **רשת & אינטרנט** → **פרטי DNS**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### מוצרי Apple +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -הגרסאות האחרונות של iOS, iPadOS, tvOS ו-macOS, תומכות הן ב-DoT והן ב-DoH. שני הפרוטוקולים נתמכים באופן מקורי באמצעות [פרופילי תצורה](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) או דרך [ממשק API להגדרות DNS](https://developer.apple.com/documentation/networkextension/dns_settings). +Pi-hole מיועד להתארח ב-Raspberry Pi, אך הוא אינו מוגבל לחומרה כזו. התוכנה כוללת ממשק אינטרנט ידידותי כדי להציג תובנות ולנהל תוכן חסום. -לאחר התקנה של פרופיל תצורה או אפליקציה המשתמשת ב-API של הגדרות DNS, ניתן לבחור את תצורת ה-DNS. אם VPN פעיל, הרזולוציה בתוך מנהרת ה-VPN תשתמש בהגדרות ה-DNS של ה-VPN ולא בהגדרות כלל המערכת שלך. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### פרופילים חתומים - -Apple אינה מספקת ממשק מקורי ליצירת פרופילי DNS מוצפנים. [יוצר פרופיל DNS מאובטח](https://dns.notjakob.com/tool.html) הוא כלי לא רשמי ליצירת פרופילי DNS מוצפנים משלך, אולם הם לא ייחתמו. פרופילים חתומים מועדפים; החתימה מאמתת את מקור הפרופיל ומסייעת להבטיח את שלמות הפרופילים. תווית "מאומת" ירוקה ניתנת לפרופילי תצורה חתומים. לקבלת מידע נוסף על חתימת קוד, ראה [אודות חתימת קוד](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -`systemd-resolved`, שהפצות לינוקס רבות משתמשות בו כדי לבצע את חיפושי ה-DNS שלהם, עדיין לא [תומך ב-DoH](https://github.com/systemd/systemd/issues/8639). אם אתה רוצה להשתמש ב-DoH, תצטרך להתקין פרוקסי כמו [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) ו[להגדיר אותו](https://wiki.archlinux.org/title/Dnscrypt-proxy) כדי לקחת את כל שאילתות ה-DNS מפותר המערכת ולהעביר אותן באמצעות HTTPS. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home כולל ממשק אינטרנט משופשף כדי להציג תובנות ולנהל תוכן חסום. + +[:octicons-home-16: דף הבית](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="מדיניות פרטיות" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=תיעוד} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="קוד מקור" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## פרוקסי DNS מוצפנים -תוכנת פרוקסי DNS מוצפנת מספקת פרוקסי מקומי שאליו ניתן להעביר את פותר [ה-DNS הלא מוצפן](advanced/dns-overview.md#unencrypted-dns). בדרך כלל הוא משמש בפלטפורמות שאינן תומכות באופן מקורי [ב-DNS מוצפן](advanced/dns-overview.md#what-is-encrypted-dns). +תוכנת פרוקסי DNS מוצפנת מספקת פרוקסי מקומי שאליו ניתן להעביר את פותר [ה-DNS הלא מוצפן](advanced/dns-overview.md#unencrypted-dns). Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Apple אינה מספקת ממשק מקורי ליצירת פרופילי DNS מ
-## פתרונות אירוח עצמי +## קריטריונים -פתרון DNS שמתארח בעצמו שימושי לאספקת סינון בפלטפורמות מבוקרות, כגון טלוויזיות חכמות והתקני IoT אחרים, מכיוון שאין צורך בתוכנה בצד הלקוח. +**שים לב שאיננו קשורים לאף אחד מהפרויקטים שאנו ממליצים עליהם.** בנוסף ל [הקריטריונים הסטנדרטיים שלנו](about/criteria.md), פיתחנו סט ברור של דרישות כדי לאפשר לנו לספק המלצות אובייקטיביות. אנו מציעים לך להכיר את הרשימה הזו לפני שתבחר להשתמש בְּספק, ולערוך מחקר משלך כדי להבטיח שזו הבחירה הנכונה עבורך. -### AdGuard Home +### דרישות מינימליות -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home כולל ממשק אינטרנט משופשף כדי להציג תובנות ולנהל תוכן חסום. - -[:octicons-home-16: דף הבית](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="מדיניות פרטיות" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=תיעוד} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="קוד מקור" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole מיועד להתארח ב-Raspberry Pi, אך הוא אינו מוגבל לחומרה כזו. התוכנה כוללת ממשק אינטרנט ידידותי כדי להציג תובנות ולנהל תוכן חסום. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [מזעור QNAME](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- תעדוף תמיכה ב[Anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) או תמיכה ב"היגוי גיאוגרפי". [^1]: AdGuard מאחסן מדדי ביצועים מצטברים של שרתי ה-DNS שלהם, כלומר מספר הבקשות המלאות לשרת מסוים, מספר הבקשות החסומות ומהירות עיבוד הבקשות. הם גם שומרים ומאחסנים את מסד הנתונים של הדומיינים שהתבקשו ב-24 השעות האחרונות. "אנחנו צריכים את המידע הזה כדי לזהות ולחסום עוקבים ואיומים חדשים." "אנחנו גם מתעדים כמה פעמים גשש זה או אחר נחסם. אנחנו צריכים את המידע הזה כדי להסיר את הכללים המיושנים מהמסננים שלנו." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare אוספת ומאחסנת רק את נתוני שאילתת ה-DNS המוגבלים שנשלחים לפותר 1.1.1.1. שירות הפותר 1.1.1.1 אינו רושם נתונים אישיים, וחלק הארי של נתוני השאילתות המוגבלים שאינם ניתנים לזיהוי אישי מאוחסן למשך 25 שעות בלבד. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D רק מתעדים עבור פותרי Premium עם פרופילי DNS מותאמים אישית. פותרים חינמיים אינם רושמים נתונים. [https://controld.com/privacy](https://controld.com/privacy) [^4]: שירות ה-DNS של Mullvad זמין הן למנויים והן ללא מנויים של Mullvad VPN. מדיניות הפרטיות שלהם טוענת במפורש שהם לא רושמים בקשות DNS בשום צורה. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 אוספת חלק מהנתונים למטרות ניטור ותגובה של איומים. לאחר מכן ניתן לערבב מחדש את הנתונים הללו ולשתף אותם, למשל לצורך מחקר אבטחה. Quad9 אינה אוספת או מתעדת כתובות IP או נתונים אחרים שלדעתם ניתנים לזיהוי אישי. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 אוספת חלק מהנתונים למטרות ניטור ותגובה של איומים. לאחר מכן ניתן לערבב מחדש את הנתונים הללו ולשתף אותם, למשל לצורך מחקר אבטחה. Quad9 אינה אוספת או מתעדת כתובות IP או נתונים אחרים שלדעתם ניתנים לזיהוי אישי. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/hi/advanced/dns-overview.md b/i18n/hi/advanced/dns-overview.md index 2ffb67b2..f4090aa0 100644 --- a/i18n/hi/advanced/dns-overview.md +++ b/i18n/hi/advanced/dns-overview.md @@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies). +### Native Operating System Support + +#### Android + +Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**. + +#### Apple Devices + +The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). + +After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. + +Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## What can an outside party see? In this example we will record what happens when we make a DoH request: @@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps. -This feature does come at a privacy cost, as it tells the DNS server some information about the client's location. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/hi/dns.md b/i18n/hi/dns.md index 01705a81..ccdf2013 100644 --- a/i18n/hi/dns.md +++ b/i18n/hi/dns.md @@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [ ## Recommended Providers -| DNS Provider | Privacy Policy | Protocols | Logging | ECS | Filtering | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Some[^1] | Yes | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH/3
DoT | Some[^2] | No | Based on personal configuration. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH/3
DoT
DoQ | Optional[^3] | No | Based on personal configuration. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | No[^4] | No | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH/3
DoT
DoQ | Optional[^5] | Optional | Based on personal configuration. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext
DoH
DoT
DNSCrypt | Some[^6] | Optional | Based on personal configuration, Malware blocking by default. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Criteria +| DNS Provider | Privacy Policy | Protocols | Logging | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | No | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. +## Self-Hosted DNS Filtering -- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec). -- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). -- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled. -- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. +A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. -## Native Operating System Support +### Pi-hole -### Android +
-Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple Devices +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). +Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. -After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### Signed Profiles - -Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home features a polished web interface to view insights and manage blocked content. + +[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Encrypted DNS Proxies -Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). +Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
-## Self-hosted Solutions +## Criteria -A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. +**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. -### AdGuard Home +### Minimum Requirements -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home features a polished web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy) [^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/hu/advanced/dns-overview.md b/i18n/hu/advanced/dns-overview.md index 2ffb67b2..3db432f7 100644 --- a/i18n/hu/advanced/dns-overview.md +++ b/i18n/hu/advanced/dns-overview.md @@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies). +### Native Operating System Support + +#### Android + +Az Android 9 és újabb verziói támogatják a DNS-t TLS-en keresztül. A beállítások megtalálhatók itt: **Beállítások** → **Hálózat és Internet** → **Privát DNS**. + +#### Apple Devices + +Az iOS, iPadOS, tvOS és macOS legújabb verziói támogatják a DoT és a DoH funkciót is. Mindkét protokoll alapból támogatva van a [konfigurációs profilok](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) vagy a [DNS-beállítás API](https://developer.apple.com/documentation/networkextension/dns_settings)-n keresztül. + +Egy konfigurációs profilt vagy egy DNS-beállítások API-t használó alkalmazás telepítése után kiválasztható a DNS-konfiguráció. Ha egy VPN aktív, a VPN-alagúton belüli elosztás a VPN DNS-beállításait fogja használni, nem pedig a rendszerbeállításokat. + +Az Apple nem biztosít natív felületet titkosított DNS-profilok létrehozásához. A [Secure DNS profile creator](https://dns.notjakob.com/tool.html) egy nem hivatalos eszköz saját titkosított DNS-profilok létrehozására, azonban ezek a profilok nem lesznek aláírva. Az aláírt profilok előnyben részesítendők; az aláírás igazolja a profil eredetét, és segít biztosítani a profilok integritását. Az aláírt konfigurációs profilok zöld "Ellenőrzött" címkét kapnak. A kódaláírással kapcsolatos további információkért lásd: [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## What can an outside party see? In this example we will record what happens when we make a DoH request: @@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps. -This feature does come at a privacy cost, as it tells the DNS server some information about the client's location. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/hu/dns.md b/i18n/hu/dns.md index c9c0fcc1..456929e6 100644 --- a/i18n/hu/dns.md +++ b/i18n/hu/dns.md @@ -15,50 +15,126 @@ Titkosított DNS-t harmadik féltől származó szerverekkel csak alapvető [DNS ## Ajánlott Szolgáltatók -| DNS Szolgáltatók | Adatvédelmi Tájékoztató | Protokollok | Naplózás | ECS | Szűrés | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | --------------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Némi[^1] | Yes | Based on personal configuration. A használt szűrőlista itt található. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Nyílt szöveg
DoH/3
DoT | Némi[^2] | Nem | Based on personal configuration. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Nyílt szöveg
DoH/3
DoT
DoQ | Választható[^3] | Nem | Based on personal configuration. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | Nem[^4] | Nem | Based on personal configuration. A használt szűrőlista itt található. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Nyílt szöveg
DoH/3
DoT
DoQ | Választható[^5] | Választható | Based on personal configuration. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Nyílt szöveg
DoH
DoT
DNSCrypt | Némi[^6] | Választható | Based on personal configuration, Malware blocking by default. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Követelmények +| DNS Szolgáltatók | Adatvédelmi Tájékoztató | Protokollok | Naplózás | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Szűrés | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | --------------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Némi[^1] | Anonymized | Based on server choice. A használt szűrőlista itt található. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Némi[^2] | Nem | Based on server choice. | [Nem](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Választható[^3] | Nem | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Nem | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | Nem[^4] | Nem | Based on server choice. A használt szűrőlista itt található. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Választható | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Tartsd figyelemben, hogy nem állunk kapcsolatban az általunk ajánlott projektek egyikével sem.** Az [alap kritériumaink mellett](about/criteria.md), egyértelmű követelményrendszert dolgoztunk ki, hogy objektív ajánlásokat tudjunk tenni. Javasoljuk, hogy ismerkedj meg ezzel a listával, mielőtt kiválasztanál egy projektet, és végezz saját kutatásokat, hogy megbizonyosodj arról, hogy ez a megfelelő választás számodra. +## Self-Hosted DNS Filtering -- Támogatnia kell a [DNSSEC](advanced/dns-overview.md#what-is-dnssec)-et. -- [QNAME Minimalizáció](advanced/dns-overview.md#what-is-qname-minimization). -- Lehetővé teszi az [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) letiltását. -- Előnyben részesíti az [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods), vagy a geo-steering támogatását. +Egy saját üzemeltetésű DNS-megoldás hasznos ellenőrzött platformokon, például Smart TV-ken és más IoT-eszközökön történő szűrés biztosításához, mivel nincs szükség kliensoldali szoftverre. -## Native Operating System Support +### Pi-hole -### Android +
-Az Android 9 és újabb verziói támogatják a DNS-t TLS-en keresztül. A beállítások megtalálhatók itt: **Beállítások** → **Hálózat és Internet** → **Privát DNS**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple Devices +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -Az iOS, iPadOS, tvOS és macOS legújabb verziói támogatják a DoT és a DoH funkciót is. Mindkét protokoll alapból támogatva van a [konfigurációs profilok](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) vagy a [DNS-beállítás API](https://developer.apple.com/documentation/networkextension/dns_settings)-n keresztül. +A Pi-hole-t úgy tervezték, hogy egy Raspberry Pi-n lehessen üzemeltetni, de az nem korlátozott erre a hardverre. Az szoftver egy kifinomult webes felületet kínál az betekintések megtekintéséhez és blokkolt tartalmak kezeléséhez. -Egy konfigurációs profilt vagy egy DNS-beállítások API-t használó alkalmazás telepítése után kiválasztható a DNS-konfiguráció. Ha egy VPN aktív, a VPN-alagúton belüli elosztás a VPN DNS-beállításait fogja használni, nem pedig a rendszerbeállításokat. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### Aláírt Profilok - -Az Apple nem biztosít natív felületet titkosított DNS-profilok létrehozásához. A [Secure DNS profile creator](https://dns.notjakob.com/tool.html) egy nem hivatalos eszköz saját titkosított DNS-profilok létrehozására, azonban ezek a profilok nem lesznek aláírva. Az aláírt profilok előnyben részesítendők; az aláírás igazolja a profil eredetét, és segít biztosítani a profilok integritását. Az aláírt konfigurációs profilok zöld "Ellenőrzött" címkét kapnak. A kódaláírással kapcsolatos további információkért lásd: [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -A `systemd-resolved`, amelyet sok Linux disztribúció használ a DNS-lekérdezéseikhez, még nem [támogatja a DoH-t](https://github.com/systemd/systemd/issues/8639). Ha a DoH-t szeretnéd használni, telepítened kell egy proxyt, mint például a [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) és [konfigurálnod kell azt](https://wiki.archlinux.org/title/Dnscrypt-proxy), hogy az átvegye az összes DNS-lekérdezést a rendszer resolverjétől, és azokat HTTPS-en keresztül továbbítsa. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +Az AdGuard Home egy kifinomult webes felületet kínál az betekintések megtekintéséhez és blokkolt tartalmak kezeléséhez. + +[:octicons-home-16: Honlap](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Adatvédelmi Tájékoztató" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Dokumentáció} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Forráskód" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Titkosított DNS proxyk -Egy titkosított DNS proxy szoftver helyi proxy-t biztosít a [titkosítatlan DNS](advanced/dns-overview.md#unencrypted-dns) resolver számára, amelyhez majd továbbít. Általában olyan platformokon használatos, amelyek nem támogatják natívan a [titkosított DNS-t](advanced/dns-overview.md#what-is-encrypted-dns). +Egy titkosított DNS proxy szoftver helyi proxy-t biztosít a [titkosítatlan DNS](advanced/dns-overview.md#unencrypted-dns) resolver számára, amelyhez majd továbbít. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ A **dnscrypt-proxy** egy DNS-proxy, amely támogatja a [DNSCrypt](advanced/dns-o
-## Saját Üzemeltetésű Megoldások +## Követelmények -Egy saját üzemeltetésű DNS-megoldás hasznos ellenőrzött platformokon, például Smart TV-ken és más IoT-eszközökön történő szűrés biztosításához, mivel nincs szükség kliensoldali szoftverre. +**Tartsd figyelemben, hogy nem állunk kapcsolatban az általunk ajánlott projektek egyikével sem.** Az [alap kritériumaink mellett](about/criteria.md), egyértelmű követelményrendszert dolgoztunk ki, hogy objektív ajánlásokat tudjunk tenni. Javasoljuk, hogy ismerkedj meg ezzel a listával, mielőtt kiválasztanál egy projektet, és végezz saját kutatásokat, hogy megbizonyosodj arról, hogy ez a megfelelő választás számodra. -### AdGuard Home +### Alap elvárások -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Az AdGuard Home egy kifinomult webes felületet kínál az betekintések megtekintéséhez és blokkolt tartalmak kezeléséhez. - -[:octicons-home-16: Honlap](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Adatvédelmi Tájékoztató" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Dokumentáció} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Forráskód" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -A Pi-hole-t úgy tervezték, hogy egy Raspberry Pi-n lehessen üzemeltetni, de az nem korlátozott erre a hardverre. Az szoftver egy kifinomult webes felületet kínál az betekintések megtekintéséhez és blokkolt tartalmak kezeléséhez. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [QNAME Minimalizáció](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Előnyben részesíti az [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods), vagy a geo-steering támogatását. [^1]: Az AdGuard tárolja a DNS szervereik összesített teljesítményméréseit, nevezetesen az adott szerverhez érkező teljes kérések számát, a blokkolt kérések számát és a kérések feldolgozásának sebességét. Az elmúlt 24 órában igényelt domainek adatbázisát is eltárolják. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/hu/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: A Cloudflare csak azokat a korlátozott DNS-lekérdezési adatokat gyűjti és tárolja ami az 1.1.1.1 resolverhez érkezik. Az 1.1.1.1 resolver szolgáltatás nem naplóz személyes adatokat, és a korlátozott, személyazonosításra nem alkalmas lekérdezési adatok nagy részét csak 25 órán keresztül tárolja. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: A Control D csak az egyedi DNS-profilokkal rendelkező Premium resolverek esetében naplóz. Az ingyenes resolverek nem naplóznak adatokat. [https://controld.com/privacy](https://controld.com/privacy) [^4]: A Mullvad DNS szolgáltatása a Mullvad VPN előfizetői és nem előfizetői számára egyaránt elérhető. Az adatvédelmi irányelvük kifejezetten azt állítja, hogy semmilyen módon nem naplóznak DNS-kéréseket. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: A Quad9 bizonyos adatokat a fenyegetések megfigyelése és elhárítása céljából gyűjt. Ezek az adatok ezután összekeverhetők és megoszthatók, például biztonsági kutatások céljából. A Quad9 nem gyűjt vagy rögzít IP-címeket vagy más, személyazonosításra alkalmasnak ítélt adatokat. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: A Quad9 bizonyos adatokat a fenyegetések megfigyelése és elhárítása céljából gyűjt. Ezek az adatok ezután összekeverhetők és megoszthatók, például biztonsági kutatások céljából. A Quad9 nem gyűjt vagy rögzít IP-címeket vagy más, személyazonosításra alkalmasnak ítélt adatokat. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/id/advanced/dns-overview.md b/i18n/id/advanced/dns-overview.md index 4190524e..2f519ff1 100644 --- a/i18n/id/advanced/dns-overview.md +++ b/i18n/id/advanced/dns-overview.md @@ -82,6 +82,24 @@ DNS terenkripsi dapat merujuk pada salah satu dari sejumlah protokol, yang palin Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies). +### Dukungan Sistem Operasi + +#### Android + +Android 9 ke atas mendukung DNS melalui TLS. Pengaturan dapat ditemukan di: **Pengaturan** → **Jaringan & Internet** → **DNS Pribadi**. + +#### Perangkat Apple + +Versi terbaru iOS, iPadOS, tvOS, dan macOS, mendukung DoT dan DoH. Kedua protokol didukung secara default melalui [profil konfigurasi](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) atau melalui [API Pengaturan DNS](https://developer.apple.com/documentation/networkextension/dns_settings). + +Setelah pemasangan profil konfigurasi atau aplikasi yang menggunakan API Pengaturan DNS, konfigurasi DNS dapat dipilih. Jika VPN aktif, pengaturan DNS dalam VPN akan digunakan untuk menentukan resolusi, bukan pengaturan DNS sistem Anda secara keseluruhan. + +Apple tidak menyediakan antarmuka asli untuk membuat profil DNS terenkripsi. [Pembuat profil DNS aman](https://dns.notjakob.com/tool.html) adalah alat tidak resmi untuk membuat profil DNS terenkripsi Anda sendiri, namun profil tersebut tidak akan ditandatangani. Profil yang ditandatangani lebih disukai; penandatanganan memvalidasi asal profil dan membantu memastikan integritas profil. Label "Terverifikasi" berwarna hijau diberikan pada profil konfigurasi yang telah ditandatangani. Untuk informasi lebih lanjut tentang penandatanganan kode, lihat [Tentang Penandatanganan Kode](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## What can an outside party see? In this example we will record what happens when we make a DoH request: @@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps. -This feature does come at a privacy cost, as it tells the DNS server some information about the client's location. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/id/dns.md b/i18n/id/dns.md index fdba1342..7ef2a5f0 100644 --- a/i18n/id/dns.md +++ b/i18n/id/dns.md @@ -15,50 +15,126 @@ DNS terenkripsi dengan server pihak ketiga sebaiknya hanya digunakan untuk menga ## Penyedia yang Direkomendasikan -| Penyedia DNS | Kebijakan Privasi | Protokol | Pencatatan Log | ECS | Pemfilteran | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | -------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Beberapa[^1] | Yes | Berdasarkan konfigurasi pribadi. Daftar filter yang digunakan dapat ditemukan di sini. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Teks biasa
DoH/3
DoT | Beberapa[^2] | Tidak | Berdasarkan konfigurasi pribadi. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Teks biasa
DoH/3
DoT
DoQ | Opsional[^3] | Tidak | Berdasarkan konfigurasi pribadi. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | Tidak[^4] | Tidak | Berdasarkan konfigurasi pribadi. Daftar filter yang digunakan dapat ditemukan di sini. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Teks biasa
DoH/3
DoT
DoQ | Opsional[^5] | Opsional | Berdasarkan konfigurasi pribadi. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Teks biasa
DoH
DoT
DNSCrypt | Beberapa[^6] | Opsional | Berdasarkan konfigurasi personal, Malware terblokir secara default. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Kriteria +| Penyedia DNS | Kebijakan Privasi | Protokol | Pencatatan Log | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Pemfilteran | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | -------------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------ | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Beberapa[^1] | Anonymized | Based on server choice. Daftar filter yang digunakan dapat ditemukan di sini. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Beberapa[^2] | Tidak | Based on server choice. | [Tidak](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Opsional[^3] | Tidak | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Tidak | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | Tidak[^4] | Tidak | Based on server choice. Daftar filter yang digunakan dapat ditemukan di sini. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Opsional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Harap dicatat bahwa kami tidak berafiliasi dengan proyek-proyek yang kami rekomendasikan.** Selain [kriteria standar kami](about/criteria.md), kami telah mengembangkan serangkaian persyaratan yang jelas untuk memungkinkan kami memberikan rekomendasi yang objektif. Kami menyarankan agar Anda mengenal lebih lanjut daftar di bawah ini sebelum memutuskan untuk menggunakan project tertentu. Selalu lakukan riset sendiri untuk memastikan bahwa project tersebut adalah pilihan yang tepat untuk Anda. +## Self-Hosted DNS Filtering -- Harus mendukung [DNSSEC](advanced/dns-overview.md#what-is-dnssec). -- [Minimalisasi QNAME](advanced/dns-overview.md#what-is-qname-minimization). -- Mengizinkan [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) untuk dinonaktifkan. -- Dukungan [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) atau geo-steering lebih disukai. +Solusi DNS yang dihosting sendiri berguna untuk menyediakan penyaringan pada platform terkontrol, seperti Smart TV dan perangkat IoT lainnya, karena tidak ada perangkat lunak di sisi klien yang diperlukan. -## Dukungan Sistem Operasi +### Pi-hole -### Android +
-Android 9 ke atas mendukung DNS melalui TLS. Pengaturan dapat ditemukan di: **Pengaturan** → **Jaringan & Internet** → **DNS Pribadi**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Perangkat Apple +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -Versi terbaru iOS, iPadOS, tvOS, dan macOS, mendukung DoT dan DoH. Kedua protokol didukung secara default melalui [profil konfigurasi](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) atau melalui [API Pengaturan DNS](https://developer.apple.com/documentation/networkextension/dns_settings). +Pi-hole dirancang untuk dihosting di Raspberry Pi, tetapi tidak terbatas pada perangkat keras tersebut. Perangkat lunak ini memiliki antarmuka web yang ramah untuk melihat analisis dan mengelola konten yang diblokir. -Setelah pemasangan profil konfigurasi atau aplikasi yang menggunakan API Pengaturan DNS, konfigurasi DNS dapat dipilih. Jika VPN aktif, pengaturan DNS dalam VPN akan digunakan untuk menentukan resolusi, bukan pengaturan DNS sistem Anda secara keseluruhan. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### Profil yang Ditandatangani - -Apple tidak menyediakan antarmuka asli untuk membuat profil DNS terenkripsi. [Pembuat profil DNS aman](https://dns.notjakob.com/tool.html) adalah alat tidak resmi untuk membuat profil DNS terenkripsi Anda sendiri, namun profil tersebut tidak akan ditandatangani. Profil yang ditandatangani lebih disukai; penandatanganan memvalidasi asal profil dan membantu memastikan integritas profil. Label "Terverifikasi" berwarna hijau diberikan pada profil konfigurasi yang telah ditandatangani. Untuk informasi lebih lanjut tentang penandatanganan kode, lihat [Tentang Penandatanganan Kode](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -`systemd-resolved`, yang digunakan banyak distribusi Linux untuk melakukan pencarian DNS, belum [mendukung DoH](https://github.com/systemd/systemd/issues/8639). Jika Anda ingin menggunakan DoH, Anda perlu menginstal proxy seperti [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) dan [konfigurasikan] (https://wiki.archlinux.org/title/Dnscrypt-proxy) untuk mengambil semua permintaan DNS dari resolver sistem Anda dan meneruskannya melalui HTTPS. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home memiliki antarmuka web yang dipoles untuk melihat wawasan dan mengelola konten yang diblokir. + +[:octicons-home-16: Beranda](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Kebijakan Privasi" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Dokumentasi} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Kode Sumber" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## DNS Proxy yang Terenkripsi -Perangkat lunak proxy DNS terenkripsi menyediakan proxy lokal untuk [DNS tidak terenkripsi](advanced/dns-overview.md#unencrypted-dns) resolver untuk diteruskan. Biasanya digunakan pada platform yang tidak mendukung [DNS terenkripsi](advanced/dns-overview.md#what-is-encrypted-dns). +Perangkat lunak proxy DNS terenkripsi menyediakan proxy lokal untuk [DNS tidak terenkripsi](advanced/dns-overview.md#unencrypted-dns) resolver untuk diteruskan. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Perangkat lunak proxy DNS terenkripsi menyediakan proxy lokal untuk [DNS tidak t
-## Solusi Self-hosting +## Kriteria -Solusi DNS yang dihosting sendiri berguna untuk menyediakan penyaringan pada platform terkontrol, seperti Smart TV dan perangkat IoT lainnya, karena tidak ada perangkat lunak di sisi klien yang diperlukan. +**Harap dicatat bahwa kami tidak berafiliasi dengan proyek-proyek yang kami rekomendasikan.** Selain [kriteria standar kami](about/criteria.md), kami telah mengembangkan serangkaian persyaratan yang jelas untuk memungkinkan kami memberikan rekomendasi yang objektif. Kami menyarankan agar Anda mengenal lebih lanjut daftar di bawah ini sebelum memutuskan untuk menggunakan project tertentu. Selalu lakukan riset sendiri untuk memastikan bahwa project tersebut adalah pilihan yang tepat untuk Anda. -### AdGuard Home +### Persyaratan Minimum -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home memiliki antarmuka web yang dipoles untuk melihat wawasan dan mengelola konten yang diblokir. - -[:octicons-home-16: Beranda](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Kebijakan Privasi" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Dokumentasi} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Kode Sumber" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole dirancang untuk dihosting di Raspberry Pi, tetapi tidak terbatas pada perangkat keras tersebut. Perangkat lunak ini memiliki antarmuka web yang ramah untuk melihat analisis dan mengelola konten yang diblokir. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [Minimalisasi QNAME](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Dukungan [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) atau geo-steering lebih disukai. [^1]: AdGuard menyimpan informasi kinerja dari server DNS mereka, seperti informasi request kepada server tertentu, jumlah request yang terblokir dan informasi mengenai kecepatan request ketika sedang diproses. Mereka juga menyimpan database domain yang diminta dalam waktu 24 jam terakhir. "Kami membutuhkan informasi ini untuk mengidentifikasi dan memblokir pelacak dan ancaman baru." "Kami juga mencatat berapa kali pelacak telah diblokir. Kami membutuhkan informasi ini untuk menghapus aturan lama dari filter kami." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare hanya mengumpulkan dan menyimpan data permintaan DNS terbatas yang dikirim ke resolver 1.1.1.1. Layanan resolver 1.1.1.1 tidak mencatat data pribadi, dan sebagian besar data yang tidak dapat diidentifikasi secara pribadi hanya disimpan selama 25 jam. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D hanya mencatat untuk resolver Premium dengan profil DNS khusus. Resolver gratis tidak mencatat data. [https://controld.com/privacy](https://controld.com/privacy) [^4]: Layanan DNS Mullvad tersedia untuk pelanggan dan non-pelanggan Mullvad VPN. Kebijakan privasi mereka secara eksplisit mengklaim bahwa mereka tidak mencatat permintaan DNS dengan cara apa pun. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 mengumpulkan beberapa data untuk tujuan pemantauan dan tanggapan ancaman. Data nantinya diacak dan dibagikan untuk tujuan penelitian keamanan. Quad9 tidak mengumpulkan atau mencatat alamat IP atau data lain yang mereka anggap dapat diidentifikasi secara pribadi. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 mengumpulkan beberapa data untuk tujuan pemantauan dan tanggapan ancaman. Data nantinya diacak dan dibagikan untuk tujuan penelitian keamanan. Quad9 tidak mengumpulkan atau mencatat alamat IP atau data lain yang mereka anggap dapat diidentifikasi secara pribadi. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/it/advanced/dns-overview.md b/i18n/it/advanced/dns-overview.md index 5a26e55e..fd4c6f45 100644 --- a/i18n/it/advanced/dns-overview.md +++ b/i18n/it/advanced/dns-overview.md @@ -82,6 +82,24 @@ Il DNS crittografato può riferirsi a uno dei numerosi protocolli, i più comuni L'implementazione nativa di DoH è arrivata su iOS 14, macOS 11, Microsoft Windows e Android 13 (tuttavia, non sarà abilitata [di default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). Il supporto generale per i desktop Linux è in attesa dell'[implementazione](https://github.com/systemd/systemd/issues/8639) di systemd, quindi [è necessario installare un software di terze parti](../dns.md#encrypted-dns-proxies). +### Supporto Nativo del Sistema Operativo + +#### Android + +Android 9 e successive supportano il 'DNS over TLS'. Le impostazioni si possono trovare in: **Impostazioni** → **Rete e Internet** → **DNS Privato**. + +#### Dispositivi Apple + +Le versioni più recenti di iOS, iPadOS, tvOS e macOS, supportano sia DoT che DoH. Entrambi i protocolli sono supportati nativamente tramite i [profili di configurazione](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) o tramite l'[API delle Impostazioni DNS](https://developer.apple.com/documentation/networkextension/dns_settings). + +Dopo l'installazione di un profilo di configurazione o di un'app che utilizza l'API delle Impostazioni DNS, è possibile selezionare la configurazione DNS. Se una VPN è attiva, la risoluzione nel tunnel VPN utilizzerà le impostazioni DNS della VPN e non le impostazioni di sistema. + +Apple non fornisce un'interfaccia nativa per la creazione di profili DNS crittografati. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) è uno strumento non ufficiale per creare i propri profili DNS crittografati, tuttavia, non saranno firmati. I profili firmati sono da preferire; la firma convalida l'origine di un profilo e contribuisce a garantire l'integrità. Un'etichetta verde "Verificato" è data ai profili di configurazione firmati. Per ulteriori informazioni sulla firma del codice, consulta [Informazioni sulla firma del codice](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## Cosa può vedere una parte esterna? In questo esempio registreremo cosa si verifica quando effettuiamo una richiesta DoH: @@ -318,4 +336,27 @@ La [Sottorete del Client EDNS](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) Esiste per "velocizzare" la consegna dei dati, dando al client una risposta appartenente a un server nei suoi pressi, come una [rete di consegna dei contenuti](https://en.wikipedia.org/wiki/Content_delivery_network), spesso utilizzate nello streaming di video e per servire app web in JavaScript. -Questa funzionalità non ha un costo in termini di privacy, poiché comunica al server DNS alcune informazioni sulla posizione del client. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/it/dns.md b/i18n/it/dns.md index cbf94b55..649eaf98 100644 --- a/i18n/it/dns.md +++ b/i18n/it/dns.md @@ -15,50 +15,126 @@ I DNS crittografati con server di terze parti dovrebbero essere utilizzati solta ## Fornitori consigliati -| Fornitore DNS | Politica sulla Privacy | Protocolli | Registrazione | ECS | Filtraggio | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | --------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Parziale[^1] | Sì | Secondo la configurazione personale. L'elenco dei filtri utilizzati è disponibile qui. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH/3
DoT | Parziale[^2] | No | Secondo la configurazione personale. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH/3
DoT
DoQ | Facoltativa[^3] | No | Secondo la configurazione personale. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | No[^4] | No | Secondo la configurazione personale. L'elenco dei filtri utilizzati è disponibile qui. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH/3
DoT
DoQ | Facoltativa[^5] | Facoltativa | Secondo la configurazione personale. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext
DoH
DoT
DNSCrypt | Parziale[^6] | Facoltativa | Secondo la configurazione personale, blocco dei malware predefinito. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Criteri +| Fornitore DNS | Politica sulla Privacy | Protocolli | Registrazione | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtraggio | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | --------------- | -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Parziale[^1] | Anonymized | Based on server choice. L'elenco dei filtri utilizzati è disponibile qui. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Sì](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Parziale[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Facoltativa[^3] | No | Based on server choice. | [Sì](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Sì](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. L'elenco dei filtri utilizzati è disponibile qui. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Sì](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Facoltativa | Based on server choice, malware blocking by default. | [Sì](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Ti preghiamo di notare che non siamo affiliati con alcun progetto consigliato.** Oltre ai [nostri criteri standard](about/criteria.md), abbiamo sviluppato una serie chiara di requisiti per consentirci di fornire consigli oggettivi. Ti suggeriamo di familiarizzare con questo elenco prima di scegliere di utilizzare un progetto e di condurre le tue ricerche per assicurarti che si tratti della scelta adatta a te. +## Self-Hosted DNS Filtering -- Deve supportare le [DNSSEC](advanced/dns-overview.md#what-is-dnssec) -- [Minimizzazione QNAME](advanced/dns-overview.md#what-is-qname-minimization). -- Consente di disabilitare la [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) -- Preferire il supporto di [anycast](https://it.wikipedia.org/wiki/Anycast) o il supporto di geo-steering +Una soluzione DNS self-hosted è utile per fornire il filtraggio su piattaforme controllate, come Smart TV e altri dispositivi IoT, poiché non è necessario alcun software lato client. -## Supporto Nativo del Sistema Operativo +### Pi-hole -### Android +
-Android 9 e successive supportano il 'DNS over TLS'. Le impostazioni si possono trovare in: **Impostazioni** → **Rete e Internet** → **DNS Privato**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Dispositivi Apple +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -Le versioni più recenti di iOS, iPadOS, tvOS e macOS, supportano sia DoT che DoH. Entrambi i protocolli sono supportati nativamente tramite i [profili di configurazione](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) o tramite l'[API delle Impostazioni DNS](https://developer.apple.com/documentation/networkextension/dns_settings). +Pi-hole è stato progettato per essere ospitato su un Raspberry Pi, ma non si limita a tale hardware. Il software dispone di un'interfaccia web intuitiva per visualizzare i dettagli e gestire i contenuti bloccati. -Dopo l'installazione di un profilo di configurazione o di un'app che utilizza l'API delle Impostazioni DNS, è possibile selezionare la configurazione DNS. Se una VPN è attiva, la risoluzione nel tunnel VPN utilizzerà le impostazioni DNS della VPN e non le impostazioni di sistema. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### Profili firmati - -Apple non fornisce un'interfaccia nativa per la creazione di profili DNS crittografati. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) è uno strumento non ufficiale per creare i propri profili DNS crittografati, tuttavia, non saranno firmati. I profili firmati sono da preferire; la firma convalida l'origine di un profilo e contribuisce a garantire l'integrità. Un'etichetta verde "Verificato" è data ai profili di configurazione firmati. Per ulteriori informazioni sulla firma del codice, consulta [Informazioni sulla firma del codice](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -`systemd-resolved`, utilizzato da molte distribuzioni Linux per effettuare le ricerche DNS, non supporta ancora [DoH](https://github.com/systemd/systemd/issues/8639). Se vuoi usare DoH, è necessario installare un proxy come [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) e [configurarlo] (https://wiki.archlinux.org/title/Dnscrypt-proxy) per prendere tutte le query DNS dal resolver di sistema e inoltrarle tramite HTTPS. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home dispone di un'interfaccia web raffinata per visualizzare i dettagli e gestire i contenuti bloccati. + +[:octicons-home-16: Home](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Politica sulla Privacy" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentazione} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Codice Sorgente" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Proxy DNS Crittografati -I software proxy per il DNS crittografato forniscono un proxy locale a cui inoltrare le richieste [DNS non crittografate](advanced/dns-overview.md#unencrypted-dns). Tipicamente, è utilizzato sulle piattaforme che non supportano nativamente il [DNS crittografato](advanced/dns-overview.md#what-is-encrypted-dns). +I software proxy per il DNS crittografato forniscono un proxy locale a cui inoltrare le richieste [DNS non crittografate](advanced/dns-overview.md#unencrypted-dns). Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ I software proxy per il DNS crittografato forniscono un proxy locale a cui inolt
-## Soluzioni ospitate autonomamente +## Criteri -Una soluzione DNS self-hosted è utile per fornire il filtraggio su piattaforme controllate, come Smart TV e altri dispositivi IoT, poiché non è necessario alcun software lato client. +**Ti preghiamo di notare che non siamo affiliati con alcun progetto consigliato.** Oltre ai [nostri criteri standard](about/criteria.md), abbiamo sviluppato una serie chiara di requisiti per consentirci di fornire consigli oggettivi. Ti suggeriamo di familiarizzare con questo elenco prima di scegliere di utilizzare un progetto e di condurre le tue ricerche per assicurarti che si tratti della scelta adatta a te. -### AdGuard Home +### Requisiti minimi -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home dispone di un'interfaccia web raffinata per visualizzare i dettagli e gestire i contenuti bloccati. - -[:octicons-home-16: Home](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Politica sulla Privacy" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentazione} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Codice Sorgente" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole è stato progettato per essere ospitato su un Raspberry Pi, ma non si limita a tale hardware. Il software dispone di un'interfaccia web intuitiva per visualizzare i dettagli e gestire i contenuti bloccati. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [Minimizzazione QNAME](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Preferire il supporto di [anycast](https://it.wikipedia.org/wiki/Anycast) o il supporto di geo-steering [^1]: AdGuard memorizza le statistiche aggregate sulle prestazioni dei propri server DNS, ossia il numero di richieste complete a un server in particolare, il numero di richieste bloccate e la velocità d'elaborazione delle richieste. Inoltre, conserva e memorizza il database dei domini richiesti nelle ultime 24 ore. "Necessitiamo di queste informazioni per identificare e bloccare i nuovi tracciatori e minacce." "Inoltre, registriamo quante volte un tracciatore è stato bloccato. Necessitiamo di queste informazioni per rimuovere le regole obsolete dai nostri filtri." [https://adguard.com/it/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare raccoglie e memorizza soltanto i dati limitati delle richieste DNS inviate al risolutore 1.1.1.1. Il servizio del risolutore 1.1.1.1 non registra i dati personali e, gran parte dei dati delle richieste limitate e non personalmente identificabili, sono memorizzati soltanto per 25 ore. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D registra soltanto i risolutori Premium con profili DNS personalizzati. I risolutori gratuiti non registrano dati. [https://controld.com/privacy](https://controld.com/privacy) [^4]: Il servizio DNS di Mullvad è disponibile per tutti, abbonati a Mullvad VPN e non. La loro politica sulla privacy dichiara esplicitamente che non registrano in alcun modo le richieste DNS. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 raccoglie alcuni dati per monitorare e rispondere a eventuali minacce. Tali dati potrebbero essere poi rimescolati e condivisi, ad esempio ai fini della ricerca sulla sicurezza. Quad9 non raccoglie o registra gli indirizzi IP o qualsiasi altro dato ritenuto personalmente identificabile. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 raccoglie alcuni dati per monitorare e rispondere a eventuali minacce. Tali dati potrebbero essere poi rimescolati e condivisi, ad esempio ai fini della ricerca sulla sicurezza. Quad9 non raccoglie o registra gli indirizzi IP o qualsiasi altro dato ritenuto personalmente identificabile. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/ja/advanced/dns-overview.md b/i18n/ja/advanced/dns-overview.md index 0425c851..d314ec04 100644 --- a/i18n/ja/advanced/dns-overview.md +++ b/i18n/ja/advanced/dns-overview.md @@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies). +### OSでのネイティブサポート + +#### Android + +Android 9以降ではDNS over TLSをサポートしています。 設定は以下にて確認できます： **設定** → **ネットワーク & インターネット** → **プライベートDNS**. + +#### Appleデバイス + +The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). + +After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. + +Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## What can an outside party see? In this example we will record what happens when we make a DoH request: @@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps. -This feature does come at a privacy cost, as it tells the DNS server some information about the client's location. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/ja/dns.md b/i18n/ja/dns.md index bf7343d0..686ffdee 100644 --- a/i18n/ja/dns.md +++ b/i18n/ja/dns.md @@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [ ## 推奨するサービスプロバイダー -| DNSプロバイダー | プライバシーポリシー | プロトコル | ログ設定 | ECS | フィルタリング | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | --- | --------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Some[^1] | Yes | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH/3
DoT | Some[^2] | いいえ | Based on personal configuration. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH/3
DoT
DoQ | Optional[^3] | いいえ | Based on personal configuration. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | いいえ[^4] | いいえ | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH/3
DoT
DoQ | Optional[^5] | 任意 | Based on personal configuration. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext
DoH
DoT
DNSCrypt | Some[^6] | 任意 | Based on personal configuration, Malware blocking by default. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### 規準 +| DNSプロバイダー | プライバシーポリシー | プロトコル | ログ設定 | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | フィルタリング | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | いいえ | Based on server choice. | [いいえ](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | いいえ | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | いいえ | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | いいえ[^4] | いいえ | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | 任意 | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**私たちは、推薦するどのプロジェクトとも提携していません。**客観的に推薦できるよう、[標準となる規準](about/criteria.md)に加えて、一連の明確な要件を定めています。 プロジェクトを利用する前に、このリストをよく理解し、ご自身で調査を行って、そのプロジェクトがあなたにとって適切な選択かどうかをご確認ください。 +## Self-Hosted DNS Filtering -- [DNSSEC](advanced/dns-overview.md#what-is-dnssec)のサポートを必須とする。 -- [QNAMEの最小化](advanced/dns-overview.md#what-is-qname-minimization)。 -- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled. -- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. +A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. -## OSでのネイティブサポート +### Pi-hole -### Android +
-Android 9以降ではDNS over TLSをサポートしています。 設定は以下にて確認できます： **設定** → **ネットワーク & インターネット** → **プライベートDNS**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Appleデバイス +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). +Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. -After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### 署名済みプロファイル - -Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

詳細

- -`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home features a polished web interface to view insights and manage blocked content. + +[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## 暗号化DNSプロキシ -Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). +Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
-## セルフホストソリューション +## 規準 -A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. +**私たちは、推薦するどのプロジェクトとも提携していません。**客観的に推薦できるよう、[標準となる規準](about/criteria.md)に加えて、一連の明確な要件を定めています。 プロジェクトを利用する前に、このリストをよく理解し、ご自身で調査を行って、そのプロジェクトがあなたにとって適切な選択かどうかをご確認ください。 -### AdGuard Home +### 最低要件 -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home features a polished web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [QNAMEの最小化](advanced/dns-overview.md#what-is-qname-minimization)。 +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy) [^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/ko/advanced/dns-overview.md b/i18n/ko/advanced/dns-overview.md index 39d6b189..adaaaa24 100644 --- a/i18n/ko/advanced/dns-overview.md +++ b/i18n/ko/advanced/dns-overview.md @@ -70,9 +70,7 @@ DNS는 [인터넷의 초창기](https://ko.wikipedia.org/wiki/%EB%8F%84%EB%A9%94 ### DNSCrypt -[**DNSCrypt**](https://en.wikipedia.org/wiki/DNSCrypt)는 DNS 쿼리를 암호화하는 최초의 방법 중 하나였습니다. DNSCrypt는 443 포트에서 작동하며, TCP/UDP 전송 프로토콜 모두에서 작동합니다. DNSCrypt는 [국제 인터넷 표준화 기구(IETF)](https://ko.wikipedia.org/wiki/%EA%B5%AD%EC%A0%9C_%EC%9D%B8%ED%84%B0%EB%84%B7_%ED%91%9C%EC%A4%80%ED%99%94_%EA%B8%B0%EA%B5%AC)에 제출되지 않았고 - -RFC 절차를 거치지 않았기 때문에, [일부 구현체](https://dnscrypt.info/implementations)를 제외하고는 널리 사용되지 않았습니다. 결과적으로, 보다 널리 사용되는 [DNS over HTTPS](#dns-over-https-doh)로 대체되었습니다.

+[**DNSCrypt**](https://en.wikipedia.org/wiki/DNSCrypt)는 DNS 쿼리를 암호화하는 최초의 방법 중 하나였습니다. DNSCrypt는 443 포트에서 작동하며, TCP/UDP 전송 프로토콜 모두에서 작동합니다. DNSCrypt는 [국제 인터넷 표준화 기구(IETF)](https://ko.wikipedia.org/wiki/%EA%B5%AD%EC%A0%9C_%EC%9D%B8%ED%84%B0%EB%84%B7_%ED%91%9C%EC%A4%80%ED%99%94_%EA%B8%B0%EA%B5%AC)에 제출되지 않았고RFC 절차를 거치지 않았기 때문에, [일부 구현체](https://dnscrypt.info/implementations)를 제외하고는 널리 사용되지 않았습니다. 결과적으로, 보다 널리 사용되는 [DNS over HTTPS](#dns-over-https-doh)로 대체되었습니다.

@@ -90,6 +88,32 @@ DoH 네이티브 구현은 iOS 14, macOS 11, Microsoft Windows, Android 13(단, +### 운영 체제 기본 지원 + + + +#### Android + +Android 9 이상 버전은 DNS over TLS를 지원합니다. 해당 설정은 **설정** → **네트워크 및 인터넷** → **비공개 DNS**에서 확인할 수 있습니다. + + + +#### Apple 기기 + +iOS, iPadOS, tvOS, macOS 최신 버전은 DoT, DoH를 모두 지원합니다. 두 프로토콜 모두 [구성 프로필](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web)이나 [DNS 설정 API](https://developer.apple.com/documentation/networkextension/dns_settings)를 통해 운영 체제에서 기본으로 지원합니다. + +구성 프로필이나, DNS 설정 API를 사용하는 앱을 설치하고 나면 DNS 구성에서 선택 가능합니다. VPN이 활성화되어 있는 경우, VPN 연결 내 DNS 요청은 시스템 전체 설정이 아닌 VPN의 DNS 설정을 사용합니다. + +Apple은 암호화 DNS 프로필 생성을 위한 기본 인터페이스를 제공하지 않습니다. [보안 DNS 프로필 생성기(Secure DNS profile creator)](https://dns.notjakob.com/tool.html)는 자신만의 암호화 DNS 프로필을 생성할 수 있는 비공식 툴이지만, 프로필 서명은 불가능합니다. 프로필 서명은 프로필 출처 확인 및 무결성 보장에 도움이 되므로, 서명된 프로필이 선호됩니다. 서명된 구성 프로필에는 '확인 완료' 표시가 나타납니다. 코드 서명에 대한 자세한 내용은 [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html)을 참고하세요. + + + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + + + ## 외부 주체는 무엇을 볼 수 있나요? 다음 예시에서는 DoH 요청 시 실제로 어떤 일이 일어나는지 기록해보겠습니다. @@ -401,4 +425,35 @@ While this process can be slightly more inefficient, in this example neither the ECS는 동영상 스트리밍이나 JavaScript 웹 앱 서비스에 때 자주 쓰이는 [콘텐츠 전송 네트워크(CDN)](https://ko.wikipedia.org/wiki/%EC%BD%98%ED%85%90%EC%B8%A0_%EC%A0%84%EC%86%A1_%EB%84%A4%ED%8A%B8%EC%9B%8C%ED%81%AC)처럼 클라이언트와 가까운 서버의 응답을 제공하여 데이터 전송 속도를 높이는 기술입니다. -단, ECS는 DNS 서버에 클라이언트의 위치에 관한 일부 정보를 알려주기 때문에 프라이버시 면에서 불이익이 존재합니다. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + + + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + + + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + + + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/ko/dns.md b/i18n/ko/dns.md index a41d0764..264140a5 100644 --- a/i18n/ko/dns.md +++ b/i18n/ko/dns.md @@ -15,50 +15,126 @@ global: ## 권장 제공 업체 -| DNS 제공 업체 | 프라이버시 정책 | 프로토콜 | 로그 보관 | ECS | 필터링 | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------- | ----- | ----------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | 일부[^1] | Yes | 개인 설정에 따라 달라집니다. 필터 목록은 여기에서 확인할 수 있습니다. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | 평문
DoH/3
DoT | 일부[^2] | 비활성화 | 개인 설정에 따라 달라집니다. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | 평문
DoH/3
DoT
DoQ | 선택적[^3] | 비활성화 | 개인 설정에 따라 달라집니다. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | 없음[^4] | 비활성화 | 개인 설정에 따라 달라집니다. 필터 목록은 여기에서 확인할 수 있습니다. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | 평문
DoH/3
DoT
DoQ | 선택적[^5] | 선택 사항 | 개인 설정에 따라 달라집니다. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | 평문
DoH
DoT
DNSCrypt | 일부[^6] | 선택 사항 | 개인 설정에 따라 달라지지만, 멀웨어는 기본적으로 차단됩니다. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### 평가 기준 +| DNS 제공 업체 | 프라이버시 정책 | 프로토콜 | 로그 보관 | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | 필터링 | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | -------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | 일부[^1] | Anonymized | Based on server choice. 필터 목록은 여기에서 확인할 수 있습니다. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | 일부[^2] | 비활성화 | Based on server choice. | [비활성화](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | 선택적[^3] | 비활성화 | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | 비활성화 | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | 없음[^4] | 비활성화 | Based on server choice. 필터 목록은 여기에서 확인할 수 있습니다. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | 선택 사항 | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Privacy Guides는 권장 목록의 어떠한 프로젝트와도 제휴를 맺지 않았습니다.** 객관적인 권장 목록을 제공하기 위해, [일반적인 평가 기준](about/criteria.md)에 더해 명확한 요구 사항을 정립하였습니다. 어떠한 프로젝트를 선택해 사용하기 전에, 이러한 요구 사항들을 숙지하고 여러분 스스로 조사하는 과정을 거쳐 적절한 선택을 하시기 바랍니다. +## Self-Hosted DNS Filtering -- [DNSSEC](advanced/dns-overview.md#what-is-dnssec)를 지원해야 합니다. -- [QNAME 최소화](advanced/dns-overview.md#what-is-qname-minimization)를 지원해야 합니다. -- [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) 비활성화를 지원해야 합니다. -- [Anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) 혹은 Geo steering을 적극 지원해야 합니다. +자체 호스팅 DNS 솔루션은 클라이언트 측 소프트웨어가 필요하지 않기 때문에, 스마트 TV 및 기타 IoT 기기처럼 통제된 플랫폼에서 필터링을 적용하기에 유용합니다. -## 운영 체제 기본 지원 +### Pi-hole -### Android +
-Android 9 이상 버전은 DNS over TLS를 지원합니다. 해당 설정은 **설정** → **네트워크 및 인터넷** → **비공개 DNS**에서 확인할 수 있습니다. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple 기기 +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -iOS, iPadOS, tvOS, macOS 최신 버전은 DoT, DoH를 모두 지원합니다. 두 프로토콜 모두 [구성 프로필](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web)이나 [DNS 설정 API](https://developer.apple.com/documentation/networkextension/dns_settings)를 통해 운영 체제에서 기본으로 지원합니다. +Pi-hole은 라즈베리 파이에서 호스팅되도록 설계되었지만, 그 외 하드웨어에서도 사용할 수 있습니다. 친절한 웹 인터페이스를 통해 쉽고 빠른 분석 및 차단 콘텐츠 관리가 가능합니다. -구성 프로필이나, DNS 설정 API를 사용하는 앱을 설치하고 나면 DNS 구성에서 선택 가능합니다. VPN이 활성화되어 있는 경우, VPN 연결 내 DNS 요청은 시스템 전체 설정이 아닌 VPN의 DNS 설정을 사용합니다. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### 서명된 프로필 - -Apple은 암호화 DNS 프로필 생성을 위한 기본 인터페이스를 제공하지 않습니다. [보안 DNS 프로필 생성기(Secure DNS profile creator)](https://dns.notjakob.com/tool.html)는 자신만의 암호화 DNS 프로필을 생성할 수 있는 비공식 툴이지만, 프로필 서명은 불가능합니다. 프로필 서명은 프로필 출처 확인 및 무결성 보장에 도움이 되므로, 서명된 프로필이 선호됩니다. 서명된 구성 프로필에는 '확인 완료' 표시가 나타납니다. 코드 서명에 대한 자세한 내용은 [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html)을 참고하세요. **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -많은 Linux 배포판에서 DNS 조회에 사용하는 `systemd-resolved`는 아직 [DoH를 지원하지 않습니다](https://github.com/systemd/systemd/issues/8639). DoH를 사용하려는 경우, [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) 등의 프록시를 설치 및 [설정하여](https://wiki.archlinux.org/title/Dnscrypt-proxy), 시스템 리졸버에서 모든 DNS 요청을 가져와 HTTPS로 전달하도록 해야 합니다. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +세련된 웹 인터페이스를 통해 쉽고 빠른 분석 및 차단 콘텐츠 관리가 가능합니다. + +[:octicons-home-16: 홈페이지](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="프라이버시 정책" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=문서} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="소스 코드" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## 암호화 DNS 프록시 -암호화 DNS 프록시 소프트웨어는 [비암호화 DNS](advanced/dns-overview.md#unencrypted-dns) 리졸버로부터 요청을 전달 받는 로컬 프록시를 제공합니다. 보통 [암호화 DNS](advanced/dns-overview.md#what-is-encrypted-dns)를 기본적으로 지원하지 않는 플랫폼에서 사용됩니다. +암호화 DNS 프록시 소프트웨어는 [비암호화 DNS](advanced/dns-overview.md#unencrypted-dns) 리졸버로부터 요청을 전달 받는 로컬 프록시를 제공합니다. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Apple은 암호화 DNS 프로필 생성을 위한 기본 인터페이스를 제
-## 자체 호스팅 솔루션 +## 평가 기준 -자체 호스팅 DNS 솔루션은 클라이언트 측 소프트웨어가 필요하지 않기 때문에, 스마트 TV 및 기타 IoT 기기처럼 통제된 플랫폼에서 필터링을 적용하기에 유용합니다. +**Privacy Guides는 권장 목록의 어떠한 프로젝트와도 제휴를 맺지 않았습니다.** 객관적인 권장 목록을 제공하기 위해, [일반적인 평가 기준](about/criteria.md)에 더해 명확한 요구 사항을 정립하였습니다. 어떠한 프로젝트를 선택해 사용하기 전에, 이러한 요구 사항들을 숙지하고 여러분 스스로 조사하는 과정을 거쳐 적절한 선택을 하시기 바랍니다. -### AdGuard Home +### 최소 요구 사항 -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -세련된 웹 인터페이스를 통해 쉽고 빠른 분석 및 차단 콘텐츠 관리가 가능합니다. - -[:octicons-home-16: 홈페이지](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="프라이버시 정책" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=문서} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="소스 코드" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole은 라즈베리 파이에서 호스팅되도록 설계되었지만, 그 외 하드웨어에서도 사용할 수 있습니다. 친절한 웹 인터페이스를 통해 쉽고 빠른 분석 및 차단 콘텐츠 관리가 가능합니다. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [QNAME 최소화](advanced/dns-overview.md#what-is-qname-minimization)를 지원해야 합니다. +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- [Anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) 혹은 Geo steering을 적극 지원해야 합니다. [^1]: AdGuard는 특정 서버의 완료된 요청 수, 차단된 요청 수, 요청 처리 속도 등 DNS 서버의 집계 성능 지표를 저장합니다. 또한, 지난 24시간 이내의 도메인 요청 데이터베이스를 보관 및 저장합니다. "해당 정보는 새로운 추적기 및 위협을 식별하고 차단하기 위해 필요합니다." "각 추적기가 차단된 횟수 또한 기록합니다. 이는 오래되어 불필요한 규칙을 필터에서 제거하기 위해 필요합니다." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare는 1.1.1.1 리졸버로 전송되는 DNS 쿼리의 제한된 데이터만 수집 및 저장합니다. 1.1.1.1 리졸버는 개인 데이터를 기록하지 않으며, 개인 식별이 불가능하도록 제한된 쿼리 데이터는 대부분 25시간 동안만 저장됩니다. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D는 사용자 정의 프로필이 있는 프리미엄 리졸버에 대해서만 로그를 기록합니다. 무료 리졸버는 데이터를 기록하지 않습니다. [https://controld.com/privacy](https://controld.com/privacy) [^4]: Mullvad DNS 서비스는 Mullvad VPN 가입자/비가입자 모두 이용 가능합니다. 프라이버시 정책 상, 어떤 방식으로든 DNS 요청을 기록하지 않는다고 명시되어 있습니다. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9은 위협 모니터링 및 대응 목적으로 일부 데이터를 수집합니다. 해당 데이터는 보안 연구 등의 목적으로 변형 후 공유될 수 있습니다. Quad9은 개인 식별 용도로 쓰일 수 있다고 판단되는 IP 주소 및 기타 데이터를 수집하거나 기록하지 않습니다. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9은 위협 모니터링 및 대응 목적으로 일부 데이터를 수집합니다. 해당 데이터는 보안 연구 등의 목적으로 변형 후 공유될 수 있습니다. Quad9은 개인 식별 용도로 쓰일 수 있다고 판단되는 IP 주소 및 기타 데이터를 수집하거나 기록하지 않습니다. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/ku-IQ/advanced/dns-overview.md b/i18n/ku-IQ/advanced/dns-overview.md index 2ffb67b2..c2f01afd 100644 --- a/i18n/ku-IQ/advanced/dns-overview.md +++ b/i18n/ku-IQ/advanced/dns-overview.md @@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies). +### Native Operating System Support + +#### Android + +ئەندرۆید 9 و سەرووتر پشتگیری DNS دەکەن لە ڕێگەی TLS. ڕێکخستنەکان دەتوانرێ بدۆزرێتەوە لە: **Settings**→**Network & Internet**→**Private DNS**. + +#### Apple Devices + +کۆتا وەشەنەکان لە tvOS، iPadOS، iOS لەگەڵ macOS هەموویان پشتگیری لە DoT و DoH دەکەن. هەردوو پرۆتۆکۆلەکە بە شێوەیەکی ڕەسەن پشتگیری دەکرێن لە ڕێگەی [شێوەپێدانی پڕؤفایلەکان](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) یان لە ڕێگەی [ڕێکخستنەکانیDNS API](https://developer.apple.com/documentation/networkextension/dns_settings). + +دوای دامەزراندنی شێوەپێدانێکی پڕۆفایل یان کاربەرنامەیەک کە ڕێکخستنەکانی DNS API بەکاردێنێ، دەتوانیت شێوەپێدانی DNS دیاریبکەیت. ئەگەر VPN چالاک بێت، چارەسەری ناو تونێلی VPNـەکە ڕێکخستەنەکانی DNSـی VPNـەکە بەکاردێنیت. نەک ڕێکخستەنە فراوانەکەی سیستەمەکەت. + +Apple ڕووکارێکی بنەچەیی دابین ناکات بۆ دروستکردنی پرۆفایلی DNSـی شفرەکراو. [ دروستکەری پرۆفایلی DNSـی پارێزراو](https://dns.notjakob.com/tool.html) ئامرازێکی نافەرمییە بۆ دروستکردنی پرۆفایلی DNSـی شفرەکراوی تایبەت بەخۆت، بەڵام هەرچۆنێک بێت ئەوان واژۆ ناکرێن. پرۆڤایلی واژۆکراو پەسندن؛ واژۆکە سەرچاوەی پرۆفایلەکە ڕوون دەکاتەوە و یارمەتیدەرە بۆ دڵنیابوون لە ڕاستی پرۆفایلەکان. نیشانەیەکی "پشتڕاستکراو" بە ڕەنگی سەوز دراوە بە پرۆفایلی شێوەپێدانی واژۆکراو. بۆ زانیاری زیاتر لەسەر هێمای واژۆکان، [ دەربارەی هێمای واژۆکان](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html) ببینە. + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## What can an outside party see? In this example we will record what happens when we make a DoH request: @@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps. -This feature does come at a privacy cost, as it tells the DNS server some information about the client's location. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/ku-IQ/dns.md b/i18n/ku-IQ/dns.md index 8ad1db4b..ab97590d 100644 --- a/i18n/ku-IQ/dns.md +++ b/i18n/ku-IQ/dns.md @@ -15,50 +15,126 @@ DNSـی شفرکراو تەنها دەبێت بەکار بهێنرێت لەگە ## دابینکەرانی پێشنیارکراو -| دابینکەری DNS | سیاسەتی تایبەتێتـی | پڕۆتۆکۆڵەکان | هەڵگرتنی تۆمار | ECS | پاڵاوتن | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------------ | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | هەندێک[^1] | Yes | Based on personal configuration. لیستی پاڵاوتنی بەکارهێنراو لێرە دەدۆزرێتەوە. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH
DoT | هەندێک[^2] | نەخێر | Based on personal configuration. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH/3
DoT
DoQ | ئارەزوومەندانە[^3] | نەخێر | Based on personal configuration. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | نەخێر[^4] | نەخێر | Based on personal configuration. لیستی پاڵاوتنی بەکارهێنراو لێرە دەدۆزرێتەوە. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH/3
DoT
DoQ | ئارەزوومەندانە[^5] | ئارەزوومەندانە | Based on personal configuration. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext
DoH
DoT
DNSCrypt | هەندێک[^6] | ئارەزوومەندانە | Based on personal configuration, Malware blocking by default. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Criteria +| دابینکەری DNS | سیاسەتی تایبەتێتـی | پڕۆتۆکۆڵەکان | هەڵگرتنی تۆمار | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | پاڵاوتن | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------------ | -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | هەندێک[^1] | Anonymized | Based on server choice. لیستی پاڵاوتنی بەکارهێنراو لێرە دەدۆزرێتەوە. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | هەندێک[^2] | نەخێر | Based on server choice. | [نەخێر](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | ئارەزوومەندانە[^3] | نەخێر | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | نەخێر | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | نەخێر[^4] | نەخێر | Based on server choice. لیستی پاڵاوتنی بەکارهێنراو لێرە دەدۆزرێتەوە. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | ئارەزوومەندانە | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**تکایە تێبینی ئەوە بکە کە ئێمە سەر بە هیچ کام لەو پرۆژانە نین کە پێشنیاری دەکەین.** وە جگە لە [ پێوەرە بنچینەییەکانمان](about/criteria.md), ئێمە کۆمەڵێک مەرجی ڕوونمان دامەزراندووە بۆ ئەوەی ڕێگەمان پێبدات پێشنیاری ڕاست بکەین. ئێمە پێشنیاری ئەوە دەکەین کە تۆ خۆت ئاشنا بکەیت لەگەڵ ئەم لیستە پێش هەڵبژاردن و بەکارهێنانی دابینکەرەکە وە لێکۆڵینەوەی خۆت بکەیت بۆ دڵنیابوون لەوەی، کە ئەمە هەڵبژاردنێکی گونجاوە بۆ تۆ. +## Self-Hosted DNS Filtering -- پێویستە بشتگیری [DNSSEC](advanced/dns-overview.md#what-is-dnssec) بکات. -- [بچووکردنەوەی QNAME](advanced/dns-overview.md#what-is-qname-minimization). -- ڕێگە بە ناچالاک کردنی [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) بدات. -- پەسند کردنی [Anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) یان پشتگیری "ئاڕاستەی-جوگرافی". +سەرپەرشتیکردنی-خودی DNS چارەسەرێکی بەسوودە بۆ دابینکردنی پاڵاوتن بۆ ئامێرە سەرپەرشتی کراوەکانی وەک تەلەڤزیۆنی زیرەک و ئامێرە زیرەکەکانی تر، چونکە پێویستی بە هیچ نەرمەواڵەیەکی ڕاژەخواز نیە. -## Native Operating System Support +### Pi-hole -### Android +
-ئەندرۆید 9 و سەرووتر پشتگیری DNS دەکەن لە ڕێگەی TLS. ڕێکخستنەکان دەتوانرێ بدۆزرێتەوە لە: **Settings**→**Network & Internet**→**Private DNS**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple Devices +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -کۆتا وەشەنەکان لە tvOS، iPadOS، iOS لەگەڵ macOS هەموویان پشتگیری لە DoT و DoH دەکەن. هەردوو پرۆتۆکۆلەکە بە شێوەیەکی ڕەسەن پشتگیری دەکرێن لە ڕێگەی [شێوەپێدانی پڕؤفایلەکان](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) یان لە ڕێگەی [ڕێکخستنەکانیDNS API](https://developer.apple.com/documentation/networkextension/dns_settings). +Pi-hole وا دروست کراوە کە لەسەر Rasberry Pi سەرپەرشتی بکرێت ، بەڵام سنووردار نییە بۆ ئەم ڕەقەواڵەیە بە تەنها. نەرمەواڵەکە ڕووکارێکی ڕێک و پێک و ئاسان لە بەکارهێان دەبەخشێت بۆ بینینی تێگەیشتنەکان و بەڕێوەبردنی ناوەڕۆکە قەدەغەکراوەکان. -دوای دامەزراندنی شێوەپێدانێکی پڕۆفایل یان کاربەرنامەیەک کە ڕێکخستنەکانی DNS API بەکاردێنێ، دەتوانیت شێوەپێدانی DNS دیاریبکەیت. ئەگەر VPN چالاک بێت، چارەسەری ناو تونێلی VPNـەکە ڕێکخستەنەکانی DNSـی VPNـەکە بەکاردێنیت. نەک ڕێکخستەنە فراوانەکەی سیستەمەکەت. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### پرۆفایلە واژۆکراوەکان - -Apple ڕووکارێکی بنەچەیی دابین ناکات بۆ دروستکردنی پرۆفایلی DNSـی شفرەکراو. [ دروستکەری پرۆفایلی DNSـی پارێزراو](https://dns.notjakob.com/tool.html) ئامرازێکی نافەرمییە بۆ دروستکردنی پرۆفایلی DNSـی شفرەکراوی تایبەت بەخۆت، بەڵام هەرچۆنێک بێت ئەوان واژۆ ناکرێن. پرۆڤایلی واژۆکراو پەسندن؛ واژۆکە سەرچاوەی پرۆفایلەکە ڕوون دەکاتەوە و یارمەتیدەرە بۆ دڵنیابوون لە ڕاستی پرۆفایلەکان. نیشانەیەکی "پشتڕاستکراو" بە ڕەنگی سەوز دراوە بە پرۆفایلی شێوەپێدانی واژۆکراو. بۆ زانیاری زیاتر لەسەر هێمای واژۆکان، [ دەربارەی هێمای واژۆکان](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html) ببینە. **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -`systemd-resolved`، کە زۆربەی دابەشکراوانی لینوکس بەکاری دێنن بۆ ئەنجامدانی گەرانی DNSـەکەیان. تاوەکو ئێستا [پشتگیری لە DoH ناکات](https://github.com/systemd/systemd/issues/8639). ئەگەر دەتەوێت DoH بەکاربێنی، ئەوا پێویستت بە دابەزاندی چارەسەرکەرێک هەیە وەک [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) هەیە وە [دەستکاری کردنی](https://wiki.archlinux.org/title/Dnscrypt-proxy) بۆ ئەوەی هەموو داواکاریەکانی DNSـەکەت کە لەلایەن سیستەمی چارەسەرکەرەکەت دێت بنێرێدرێت لەڕێگای HTTPSـەوە. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home ڕووکارێکی ڕێک و پێک دەبەخشێتە ماڵپەرەکەی بۆ بینینی تێگەیشتنەکان و بەڕێوەنردنی ناوەڕۆکە قەدەغەکراوەکان. + +[:octicons-home-16: پەڕەی سەرەکی](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="سیاسەتی تایبەتێتی" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=دۆکیمێنتەکان} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="سەرچاوەی کۆد" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Encrypted DNS Proxies -نەرمەواڵەی بریکارانی DNSـی شفرکراو، بریکارێکی ناوخۆیی دابین دەکەن بۆ ئەوەی [چارەسەرکەری DNSـی شفر نەکراو](advanced/dns-overview.md#unencrypted-dns) ڕووی تێ بکات. بەشێوەیەکی گشتی بەکاردەهێنرێت لەسەر ئەو ئامێرانەی، کە لە بنچینەوە پشتگیری لە [DNSـی شفرکراو](advanced/dns-overview.md#what-is-encrypted-dns) ناکەن. +نەرمەواڵەی بریکارانی DNSـی شفرکراو، بریکارێکی ناوخۆیی دابین دەکەن بۆ ئەوەی [چارەسەرکەری DNSـی شفر نەکراو](advanced/dns-overview.md#unencrypted-dns) ڕووی تێ بکات. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Apple ڕووکارێکی بنەچەیی دابین ناکات بۆ دروستک
-## Self-hosted Solutions +## Criteria -سەرپەرشتیکردنی-خودی DNS چارەسەرێکی بەسوودە بۆ دابینکردنی پاڵاوتن بۆ ئامێرە سەرپەرشتی کراوەکانی وەک تەلەڤزیۆنی زیرەک و ئامێرە زیرەکەکانی تر، چونکە پێویستی بە هیچ نەرمەواڵەیەکی ڕاژەخواز نیە. +**تکایە تێبینی ئەوە بکە کە ئێمە سەر بە هیچ کام لەو پرۆژانە نین کە پێشنیاری دەکەین.** وە جگە لە [ پێوەرە بنچینەییەکانمان](about/criteria.md), ئێمە کۆمەڵێک مەرجی ڕوونمان دامەزراندووە بۆ ئەوەی ڕێگەمان پێبدات پێشنیاری ڕاست بکەین. ئێمە پێشنیاری ئەوە دەکەین کە تۆ خۆت ئاشنا بکەیت لەگەڵ ئەم لیستە پێش هەڵبژاردن و بەکارهێنانی دابینکەرەکە وە لێکۆڵینەوەی خۆت بکەیت بۆ دڵنیابوون لەوەی، کە ئەمە هەڵبژاردنێکی گونجاوە بۆ تۆ. -### AdGuard Home +### Minimum Requirements -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home ڕووکارێکی ڕێک و پێک دەبەخشێتە ماڵپەرەکەی بۆ بینینی تێگەیشتنەکان و بەڕێوەنردنی ناوەڕۆکە قەدەغەکراوەکان. - -[:octicons-home-16: پەڕەی سەرەکی](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="سیاسەتی تایبەتێتی" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=دۆکیمێنتەکان} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="سەرچاوەی کۆد" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole وا دروست کراوە کە لەسەر Rasberry Pi سەرپەرشتی بکرێت ، بەڵام سنووردار نییە بۆ ئەم ڕەقەواڵەیە بە تەنها. نەرمەواڵەکە ڕووکارێکی ڕێک و پێک و ئاسان لە بەکارهێان دەبەخشێت بۆ بینینی تێگەیشتنەکان و بەڕێوەبردنی ناوەڕۆکە قەدەغەکراوەکان. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [بچووکردنەوەی QNAME](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- پەسند کردنی [Anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) یان پشتگیری "ئاڕاستەی-جوگرافی". [^1]: AdGuard توانای ئەرک بەجێهێنانی ڕاژەی DNSـەکانیان کۆ دەکەنەوە، بەتایبەتی ژمارەی داواکاریە تەواوەکان بۆ ڕاژەیەکی دیاریکراو، ژمارەی داواکاریە قەدەغەکراوەکان، و خێرایی وەڵامدانەوەی داواکاریەکان. هەروەها ئەوان ئەو بنکە داتایانە هەڵدەگرن و کۆیدەکەنەوە، کە دۆمەینەکانی لێوە داواکراوە لە ماوەی 24 کاتژمێری ڕابردوو. "پێویستمان بەم زانیاریە هەیە بۆ ناسینەوە و ڕاگرتنی شوێنگران و هەڕەشە نوێیەکان" "هەروەها ئێمە تۆماری دەکەین کە چەند جار ئەم یان ئەو شوێنگرە ڕێگری لێکراوە. ئێمە پێویستمان بەم زانیاریە هەیە بۆ سڕینەوەی یاسای بەرسەرچوو لە پاڵاوتنەکانمان." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare تەنها ئەو داتایە سنووردارە کۆدەکاتەوە و هەڵیدەگرێت، کە نێردراون لایەن DNS بۆ چارەسەرکەری 1.1.1.1. خزمەتگوزاری چارەسەرکەری 1.1.1.1 داتای کەسی تۆمار ناکات، وە ئەو بەشە داتایە سنووردارە نا-کەسیە ناسراوانە تەنها بۆ ماوەی 25 کاتژمێر هەڵدەگیرێن دەکرێت. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D تەنها داتای ناسینەوە بۆ ئەو کەسانە تۆمار دەکات کە بەژداربووی چارەسەرکانیانن، وە پرۆفایلی DNSـی تایبەتیان هەیە. چارەسەرکەرە بەخۆڕایەکان داتا تۆمار ناکەن. [https://controld.com/privacy](https://controld.com/privacy) [^4]: خزمەتگوزاری DNSـی Mullvad بەردەستە بۆ هەردووک لە بەکارهێنەری بەرژداربوو و نابەژداربوو. سیاسەتی تایبەتێتی ئەوان بە ڕوونی بانگەشەی ئەوە دەکات، کە بە هیچ شێوازێک داواکاریەکانی DNSـەکانیان تۆمار ناکەن. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 هەندێک داتا کۆ دەکاتەوە بۆ مەبەستی ئاگاداربوون لە هەڕەشە و وەڵامدانەوە. ئەو داتایە لەوانەیە دواتر دووبارە ببەسترێتەوە و هاوبەشی پێ بکرێت، بۆ مەبەستی لێکۆڵینەوەی ئاسایشی. Quad9 ناونیشانی IP یان ئەو داتایانەی تر کۆناکاتەوە و تۆماریان ناکات، کە بە داتای ناسینەوەی کەسی دادەنێرن. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 هەندێک داتا کۆ دەکاتەوە بۆ مەبەستی ئاگاداربوون لە هەڕەشە و وەڵامدانەوە. ئەو داتایە لەوانەیە دواتر دووبارە ببەسترێتەوە و هاوبەشی پێ بکرێت، بۆ مەبەستی لێکۆڵینەوەی ئاسایشی. Quad9 ناونیشانی IP یان ئەو داتایانەی تر کۆناکاتەوە و تۆماریان ناکات، کە بە داتای ناسینەوەی کەسی دادەنێرن. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/nl/advanced/dns-overview.md b/i18n/nl/advanced/dns-overview.md index 61c8bf4e..558b8187 100644 --- a/i18n/nl/advanced/dns-overview.md +++ b/i18n/nl/advanced/dns-overview.md @@ -82,6 +82,24 @@ Versleutelde DNS kan verwijzen naar een van een aantal protocollen, waarvan de m Native implementatie van DoH dook op in iOS 14, macOS 11, Microsoft Windows, en Android 13 (het zal echter niet standaard worden ingeschakeld [](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). Algemene Linux desktop ondersteuning wacht op de systemd [implementatie](https://github.com/systemd/systemd/issues/8639) dus [het installeren van third-party software is nog steeds vereist](../dns.md#linux). +### Ondersteuning voor besturingssystemen + +#### Android + +Android 9 en hoger ondersteunen DNS over TLS. De instellingen kunnen worden gevonden in: **Instellingen** → **Netwerk & internet** → **Privé-DNS**. + +#### Apple apparaten + +De nieuwste versies van iOS, iPadOS, tvOS en macOS ondersteunen zowel DoT als DoH. Beide protocollen worden ondersteund via [configuratieprofielen](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) of via de [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). + +Na installatie van een configuratieprofiel of een app die gebruik maakt van de DNS Settings API, kan de DNS-configuratie worden geselecteerd. Als een VPN actief is, zal de resolutie binnen de VPN-tunnel de DNS-instellingen van het VPN gebruiken en niet je systeembrede instellingen. + +Apple biedt geen native interface voor het maken van versleutelde DNS-profielen. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is een onofficiële tool voor het maken van je eigen versleutelde DNS-profielen, echter worden deze niet ondertekend. Ondertekende profielen hebben de voorkeur; ondertekening valideert de oorsprong van een profiel en helpt de integriteit van de profielen te waarborgen. Een groen "Geverifieerd" label wordt gegeven aan ondertekende configuratieprofielen. Voor meer informatie over het ondertekenen van codes, zie [Over het ondertekenen van codes](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## Wat kan een buitenstaander zien? In dit voorbeeld zullen we vastleggen wat er gebeurt als we een DoH-verzoek doen: @@ -318,4 +336,27 @@ Het [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is ee Het is bedoeld om de levering van gegevens te "versnellen" door de client een antwoord te geven dat toebehoort aan een server die zich dicht bij hem bevindt, zoals een [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), die vaak worden gebruikt bij videostreaming en het serveren van JavaScript-webapps. -Deze functie gaat wel ten koste van de privacy, aangezien de DNS-server informatie krijgt over de locatie van de client. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/nl/dns.md b/i18n/nl/dns.md index f50731e9..8edfb196 100644 --- a/i18n/nl/dns.md +++ b/i18n/nl/dns.md @@ -15,50 +15,126 @@ Versleutelde DNS met servers van derden zou alleen moeten worden gebruikt om sim ## Aanbevolen Providers -| DNS-provider | Privacybeleid | Protocollen | Loggen | ECS | Filteren | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Beetje[^1] | Yes | Op basis van persoonlijke configuratie. De filterlijst die wordt gebruikt, is hier te vinden. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH/3
DoT | Beetje[^2] | Nee | Op basis van persoonlijke configuratie. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH/3
DoT
DoQ | Optioneel[^3] | Nee | Op basis van persoonlijke configuratie. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | Geen[^4] | Nee | Op basis van persoonlijke configuratie. De filterlijst die wordt gebruikt, is hier te vinden. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH/3
DoT
DoQ | Optioneel[^5] | Optioneel | Op basis van persoonlijke configuratie. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext
DoH
DoT
DNSCrypt | Beetje[^6] | Optioneel | Gebaseerd op persoonlijke configuratie, blokkeert Malware. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Criteria +| DNS-provider | Privacybeleid | Protocollen | Loggen | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filteren | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Beetje[^1] | Anonymized | Based on server choice. De filterlijst die wordt gebruikt, is hier te vinden. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Beetje[^2] | Nee | Based on server choice. | [Nee](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optioneel[^3] | Nee | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Nee | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | Geen[^4] | Nee | Based on server choice. De filterlijst die wordt gebruikt, is hier te vinden. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optioneel | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Wij zijn niet verbonden aan de projecten die wij aanbevelen.** Naast [onze standaard criteria](about/criteria.md) hebben wij een duidelijke reeks eisen opgesteld om objectieve aanbevelingen te kunnen doen. We raden je aan deze lijst goed door te lezen voordat je een project kiest en je eigen onderzoek te doen om er zeker van te zijn dat het de juiste keuze voor jou is. +## Self-Hosted DNS Filtering -- Moet [DNSSEC](advanced/dns-overview.md#what-is-dnssec) ondersteunen. -- [QNAME Minimalisatie](advanced/dns-overview.md#what-is-qname-minimization). -- Toestaan dat [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) kan worden uitgeschakeld. -- Voorkeur voor [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) ondersteuning of geo-steering ondersteuning. +Een zelf gehoste DNS-oplossing is handig voor het bieden van filtering op gecontroleerde platforms, zoals Smart TV's en andere IoT-apparaten, omdat er geen client-side software nodig is. -## Ondersteuning voor besturingssystemen +### Pi-hole -### Android +
-Android 9 en hoger ondersteunen DNS over TLS. De instellingen kunnen worden gevonden in: **Instellingen** → **Netwerk & internet** → **Privé-DNS**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple apparaten +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -De nieuwste versies van iOS, iPadOS, tvOS en macOS ondersteunen zowel DoT als DoH. Beide protocollen worden ondersteund via [configuratieprofielen](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) of via de [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). +Pi-hole is ontworpen om te worden gehost op een Raspberry Pi, maar het is niet beperkt tot dergelijke hardware. De software beschikt over een vriendelijke webinterface om inzicht te krijgen en geblokkeerde inhoud te beheren. -Na installatie van een configuratieprofiel of een app die gebruik maakt van de DNS Settings API, kan de DNS-configuratie worden geselecteerd. Als een VPN actief is, zal de resolutie binnen de VPN-tunnel de DNS-instellingen van het VPN gebruiken en niet je systeembrede instellingen. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### Ondertekende Profielen - -Apple biedt geen native interface voor het maken van versleutelde DNS-profielen. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is een onofficiële tool voor het maken van je eigen versleutelde DNS-profielen, echter worden deze niet ondertekend. Ondertekende profielen hebben de voorkeur; ondertekening valideert de oorsprong van een profiel en helpt de integriteit van de profielen te waarborgen. Een groen "Geverifieerd" label wordt gegeven aan ondertekende configuratieprofielen. Voor meer informatie over het ondertekenen van codes, zie [Over het ondertekenen van codes](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -`systemd-resolved`, die veel Linux-distributies gebruiken om hun DNS lookups te doen, [ondersteunt DoH nog niet](https://github.com/systemd/systemd/issues/8639). Als je DoH wilt gebruiken, moet je een proxy installeren zoals [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) en [configureren](https://wiki.archlinux.org/title/Dnscrypt-proxy) om alle DNS-query's van je systeem-resolver te nemen en ze over HTTPS door te sturen. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home beschikt over een vriendelijke webinterface om inzicht te krijgen en geblokkeerde inhoud te beheren. + +[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacybeleid" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentatie} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Broncode" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Versleutelde DNS-proxy -Versleutelde DNS-proxy software biedt een lokale proxy voor de [onversleutelde DNS](advanced/dns-overview.md#unencrypted-dns)-resolver om naar door te sturen. Meestal wordt het gebruikt op platformen die [versleutelde DNS](advanced/dns-overview.md#what-is-encrypted-dns)niet ondersteunen. +Versleutelde DNS-proxy software biedt een lokale proxy voor de [onversleutelde DNS](advanced/dns-overview.md#unencrypted-dns)-resolver om naar door te sturen. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Versleutelde DNS-proxy software biedt een lokale proxy voor de [onversleutelde D
-## Zelf gehoste oplossingen +## Criteria -Een zelf gehoste DNS-oplossing is handig voor het bieden van filtering op gecontroleerde platforms, zoals Smart TV's en andere IoT-apparaten, omdat er geen client-side software nodig is. +**Wij zijn niet verbonden aan de projecten die wij aanbevelen.** Naast [onze standaard criteria](about/criteria.md) hebben wij een duidelijke reeks eisen opgesteld om objectieve aanbevelingen te kunnen doen. We raden je aan deze lijst goed door te lezen voordat je een project kiest en je eigen onderzoek te doen om er zeker van te zijn dat het de juiste keuze voor jou is. -### AdGuard Home +### Minimale vereisten -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home beschikt over een vriendelijke webinterface om inzicht te krijgen en geblokkeerde inhoud te beheren. - -[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacybeleid" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentatie} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Broncode" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole is ontworpen om te worden gehost op een Raspberry Pi, maar het is niet beperkt tot dergelijke hardware. De software beschikt over een vriendelijke webinterface om inzicht te krijgen en geblokkeerde inhoud te beheren. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [QNAME Minimalisatie](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Voorkeur voor [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) ondersteuning of geo-steering ondersteuning. [^1]: AdGuard slaat geaggregeerde prestatiecijfers van hun DNS-servers op, namelijk het aantal volledige verzoeken aan een bepaalde server, het aantal geblokkeerde verzoeken, en de snelheid waarmee verzoeken worden verwerkt. Zij houden ook de database bij van domeinen die in de laatste 24 uur zijn aangevraagd. "We hebben deze informatie nodig om nieuwe trackers en bedreigingen te identificeren en te blokkeren." "We houden ook bij hoe vaak bepaalde trackers geblokkeerd zijn. We hebben deze informatie nodig om verouderde regels uit onze filters te verwijderen." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare verzamelt en bewaart alleen de beperkte DNS-querygegevens die naar de 1.1.1.1 resolver worden gestuurd. De 1.1.1.1 resolver dienst logt geen persoonsgegevens, en het grootste deel van de beperkte niet-persoonlijk identificeerbare query-gegevens wordt slechts 25 uur bewaard. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D logt alleen voor Premium resolvers met aangepaste DNS-profielen. Gratis resolvers loggen geen gegevens. [https://controld.com/privacy](https://controld.com/privacy) [^4]: De DNS-service van Mullvad is beschikbaar voor zowel abonnees als niet-abonnees van Mullvad VPN. Hun privacybeleid beweert expliciet dat zij op geen enkele manier DNS-verzoeken loggen. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 verzamelt sommige gegevens ten behoeve van de monitoring van en reactie op bedreigingen. Die gegevens kunnen vervolgens opnieuw worden gemengd en gedeeld, bijvoorbeeld ten behoeve van veiligheidsonderzoek. Quad9 verzamelt of registreert geen IP-adressen of andere gegevens die zij als persoonlijk identificeerbaar beschouwen. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 verzamelt sommige gegevens ten behoeve van de monitoring van en reactie op bedreigingen. Die gegevens kunnen vervolgens opnieuw worden gemengd en gedeeld, bijvoorbeeld ten behoeve van veiligheidsonderzoek. Quad9 verzamelt of registreert geen IP-adressen of andere gegevens die zij als persoonlijk identificeerbaar beschouwen. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/pl/advanced/dns-overview.md b/i18n/pl/advanced/dns-overview.md index 6159a9a8..90d75f74 100644 --- a/i18n/pl/advanced/dns-overview.md +++ b/i18n/pl/advanced/dns-overview.md @@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies). +### Native Operating System Support + +#### Android + +Najnowsze wersje systemów iOS, iPadOS, tvOS oraz macOS obsługują zarówno DoT oraz DoH. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**. + +#### Apple Devices + +The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). + +After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. + +Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## What can an outside party see? In this example we will record what happens when we make a DoH request: @@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps. -This feature does come at a privacy cost, as it tells the DNS server some information about the client's location. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/pl/dns.md b/i18n/pl/dns.md index 00fd0673..f5858e56 100644 --- a/i18n/pl/dns.md +++ b/i18n/pl/dns.md @@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [ ## Rekomendowani dostawcy -| Dostawca DNS | Polityka prywatności | Protokoły | Rejestrowane dane | ECS | Filtrowanie | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ----------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Niektóre[^1] | Yes | Based on personal configuration. Listę filtrowania możesz znaleźć tutaj: [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH/3
DoT | Niektóre[^2] | Nie | Based on personal configuration. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH/3
DoT
DoQ | Do wyboru[^3] | Nie | Based on personal configuration. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | Żadne[^4] | Nie | Based on personal configuration. Listę filtrowania możesz znaleźć tutaj: [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH/3
DoT
DoQ | Do wyboru[^5] | Do wyboru | Based on personal configuration. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext
DoH
DoT
DNSCrypt | Niektóre[^6] | Do wyboru | Based on personal configuration, Malware blocking by default. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Criteria +| Dostawca DNS | Polityka prywatności | Protokoły | Rejestrowane dane | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtrowanie | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ----------------- | -------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Niektóre[^1] | Anonymized | Based on server choice. Listę filtrowania możesz znaleźć tutaj: [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Niektóre[^2] | Nie | Based on server choice. | [Nie](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Do wyboru[^3] | Nie | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Nie | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | Żadne[^4] | Nie | Based on server choice. Listę filtrowania możesz znaleźć tutaj: [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Do wyboru | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. +## Self-Hosted DNS Filtering -- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec). -- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). -- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled. -- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. +A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. -## Native Operating System Support +### Pi-hole -### Android +
-Najnowsze wersje systemów iOS, iPadOS, tvOS oraz macOS obsługują zarówno DoT oraz DoH. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple Devices +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). +Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. -After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### Signed Profiles - -Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home features a polished web interface to view insights and manage blocked content. + +[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Encrypted DNS Proxies -Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). +Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
-## Self-hosted Solutions +## Criteria -A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. +**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. -### AdGuard Home +### Minimum Requirements -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home features a polished web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy) [^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/pt-BR/advanced/dns-overview.md b/i18n/pt-BR/advanced/dns-overview.md index df6a4f24..7220fe9b 100644 --- a/i18n/pt-BR/advanced/dns-overview.md +++ b/i18n/pt-BR/advanced/dns-overview.md @@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies). +### Native Operating System Support + +#### Android + +Android 9 e superior suportam DNS sobre TLS. As configurações podem ser encontradas em: **Configurações** → **Rede & Internet** → **DNS particular**. + +#### Apple Devices + +As versões mais recentes do iOS, iPadOS, tvOS e macOS, suportam DoT e DoH. Ambos os protocolos são suportados nativamente através dos [perfis de configuração](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) ou através das [configurações de DNS API](https://developer.apple.com/documentation/networkextension/dns_settings). + +Após a instalação de um perfil de configuração ou de um aplicativo que usa a API de configurações de DNS, a configuração de DNS pode ser selecionada. Se uma VPN estiver ativa, a resolução no túnel VPN usará as configurações de DNS da VPN e não suas configurações gerais do sistema. + +A Apple não fornece uma interface nativa para a criação de perfis DNS criptografados. Info Perfis assinados são preferidos; a assinatura valida a origem de um perfil e ajuda a garantir a integridade dos perfis. Uma marca de "Verificado" na cor verde é dada aos perfis de configuração assinados. Para mais informações sobre assinatura de código, ver [Sobre Assinatura de Código](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## What can an outside party see? In this example we will record what happens when we make a DoH request: @@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps. -This feature does come at a privacy cost, as it tells the DNS server some information about the client's location. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/pt-BR/dns.md b/i18n/pt-BR/dns.md index 3892abc3..f6fd896e 100644 --- a/i18n/pt-BR/dns.md +++ b/i18n/pt-BR/dns.md @@ -15,50 +15,126 @@ DNS criptografado com servidores de terceiros só deve ser usado para contornar ## Provedores Recomendados -| Provedor de DNS | Política de Privacidade | Protocolos | Registro | ECS | Filtragem | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Alguns[^1] | Yes | Based on personal configuration. As listas de filtragem usadas podem ser encontradas aqui. [**DNS over HTTPS**](https://en.wikipedia.org/wiki/DNS_over_HTTPS) as defined in [RFC 8484](https://datatracker.ietf.org/doc/html/rfc8484) packages queries in the [HTTP/2](https://en.wikipedia.org/wiki/HTTP/2) protocol and provides security with HTTPS. Support was first added in web browsers such as Firefox 60 and Chrome 83. | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH/3
DoT | Alguns[^2] | Não | Based on personal configuration. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH/3
DoT
DoQ | Opcional[^3] | Não | Based on personal configuration. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | Não[^4] | Não | Based on personal configuration. As listas de filtragem usadas podem ser encontradas aqui. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH/3
DoT
DoQ | Opcional[^5] | Opcional | Based on personal configuration. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext
DoH/
DoT
DNSCrypt | Alguns[^6] | Opcional | Based on personal configuration, Malware blocking by default. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Criteria +| Provedor de DNS | Política de Privacidade | Protocolos | Registro | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtragem | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Alguns[^1] | Anonymized | Based on server choice. As listas de filtragem usadas podem ser encontradas aqui. [**DNS over HTTPS**](https://en.wikipedia.org/wiki/DNS_over_HTTPS) as defined in [RFC 8484](https://datatracker.ietf.org/doc/html/rfc8484) packages queries in the [HTTP/2](https://en.wikipedia.org/wiki/HTTP/2) protocol and provides security with HTTPS. Support was first added in web browsers such as Firefox 60 and Chrome 83. | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Alguns[^2] | Não | Based on server choice. | [Não](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Opcional[^3] | Não | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Não | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | Não[^4] | Não | Based on server choice. As listas de filtragem usadas podem ser encontradas aqui. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Opcional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Por favor, note que não somos parceiros de nenhum dos produtos que recomendamos.** Além de [nossos requisitos básicos](about/criteria.md), desenvolvemos um conjunto claro de requisitos para nos permitir fornecer recomendações objetivas. Recomendamos que você se familiarize com esta lista antes de escolher usar um produto, e que faça sua própria pesquisa para garantir que o produto escolhido é o ideal para você. +## Self-Hosted DNS Filtering -- Deve suportar [DNSSEC](advanced/dns-overview.md#what-is-dnssec). -- [Minimização QNAME](advanced/dns-overview.md#what-is-qname-minimization). -- Permitir que [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) seja desativado. -- Prefira suporte a [Anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) ou suporte a orientação geográfica. +Uma solução de DNS auto-hospedada é útil para fornecer filtragem em plataformas limitadas como Smart TVs e outros dispositivos IoT, já que não é necessário nenhum “software” do lado do cliente. -## Native Operating System Support +### Pi-hole -### Android +
-Android 9 e superior suportam DNS sobre TLS. As configurações podem ser encontradas em: **Configurações** → **Rede & Internet** → **DNS particular**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple Devices +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -As versões mais recentes do iOS, iPadOS, tvOS e macOS, suportam DoT e DoH. Ambos os protocolos são suportados nativamente através dos [perfis de configuração](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) ou através das [configurações de DNS API](https://developer.apple.com/documentation/networkextension/dns_settings). +O Pi-hole foi projetado para ser hospedado em um Raspberry Pi, mas não se limita a esse "hardware". O “software” apresenta uma interface web amigável para visualizar informações e gerenciar conteúdo bloqueado. -Após a instalação de um perfil de configuração ou de um aplicativo que usa a API de configurações de DNS, a configuração de DNS pode ser selecionada. Se uma VPN estiver ativa, a resolução no túnel VPN usará as configurações de DNS da VPN e não suas configurações gerais do sistema. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### Signed Profiles - -A Apple não fornece uma interface nativa para a criação de perfis DNS criptografados. Info Perfis assinados são preferidos; a assinatura valida a origem de um perfil e ajuda a garantir a integridade dos perfis. Uma marca de "Verificado" na cor verde é dada aos perfis de configuração assinados. Para mais informações sobre assinatura de código, ver [Sobre Assinatura de Código](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -`systemd-resolved`, que muitas distribuições Linux usam para fazer suas pesquisas de DNS, ainda não [suporta DoH](https://github.com/systemd/systemd/issues/8639). Se você deseja usar o DoH, você precisará instalar um proxy como [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) e [configurá-lo](https://wiki. rchlinux.org/title/Dnscrypt-proxy) para pegar todas as consultas de DNS do resolvedor do sistema e encaminhá-los por HTTPS. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home apresenta um painel web amigável para ver informações e gerenciar conteúdos bloqueados. + +[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Encrypted DNS Proxies -Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). +Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -111,52 +187,19 @@ obnoxious --> | Yes | encryptedDNS(Use<br> encrypted DNS<br> with
-## Soluções auto-hospedadas +## Criteria -Uma solução de DNS auto-hospedada é útil para fornecer filtragem em plataformas limitadas como Smart TVs e outros dispositivos IoT, já que não é necessário nenhum “software” do lado do cliente. +**Por favor, note que não somos parceiros de nenhum dos produtos que recomendamos.** Além de [nossos requisitos básicos](about/criteria.md), desenvolvemos um conjunto claro de requisitos para nos permitir fornecer recomendações objetivas. Recomendamos que você se familiarize com esta lista antes de escolher usar um produto, e que faça sua própria pesquisa para garantir que o produto escolhido é o ideal para você. -### AdGuard Home +### Minimum Requirements -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home apresenta um painel web amigável para ver informações e gerenciar conteúdos bloqueados. - -[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -O Pi-hole foi projetado para ser hospedado em um Raspberry Pi, mas não se limita a esse "hardware". O “software” apresenta uma interface web amigável para visualizar informações e gerenciar conteúdo bloqueado. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [Minimização QNAME](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Prefira suporte a [Anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) ou suporte a orientação geográfica. [^1]: O AdGuard armazena métricas de desempenho agregadas de seus servidores DNS, ou seja, o número de solicitações completas para um determinado servidor, o número de solicitações bloqueadas, e a velocidade de processamento dos pedidos. Eles também coletam e armazenam a base de dados de domínios solicitados nas últimas 24 horas. "Precisamos desta informação para identificar e bloquear novos rastreadores e ameaças". "Também registramos quantas vezes este ou aquele rastreador foi bloqueado. Precisamos desta informação para remover regras desatualizadas dos nossos filtros". [https://adguard-dns.io/pt_br/privacy.html](https://adguard.com/en/privacy/dns.html) [^2]: O Cloudflare coleta e armazena apenas os dados limitados de consulta de DNS que são enviados para o resolvedor 1.1.1.1. O serviço de resolução 1.1.1.1 não registra dados pessoais, e a maior parte dos limitados dados de consulta, não pessoalmente identificáveis, é armazenado por apenas 25 horas. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: ControlD somente coleta e armazena métricas para resolvedores "Premium" com perfis DNS personalizados. Resolvedores gratuitos não registram dados. [https://controld.com/privacy](https://controld.com/privacy) [^4]: O serviço DNS do Mullvad está disponível tanto para assinantes quanto para não assinantes do Mullvad VPN. A sua política de privacidade afirma explicitamente que não armazenam as solicitações DNS de maneira nenhuma. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 coleta alguns dados para fins de monitoramento e resposta a ameaças. Esses dados podem então ser misturados e divulgados, por exemplo, para fins de pesquisas de segurança. Quad9 não coleta ou grava endereços IP, ou outros dados que eles considerem pessoalmente identificáveis. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 coleta alguns dados para fins de monitoramento e resposta a ameaças. Esses dados podem então ser misturados e divulgados, por exemplo, para fins de pesquisas de segurança. Quad9 não coleta ou grava endereços IP, ou outros dados que eles considerem pessoalmente identificáveis. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/pt/advanced/dns-overview.md b/i18n/pt/advanced/dns-overview.md index 22e4f078..593535f6 100644 --- a/i18n/pt/advanced/dns-overview.md +++ b/i18n/pt/advanced/dns-overview.md @@ -82,6 +82,24 @@ O [**DNS sobre HTTPS**](https://en.wikipedia.org/wiki/DNS_over_HTTPS), tal como A implementação nativa do DoH apareceu no iOS 14, macOS 11, Microsoft Windows e Android 13 (no entanto, não será ativado [por predefinição](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). O suporte geral do ambiente de trabalho Linux está à espera da [implementação](https://github.com/systemd/systemd/issues/8639) do systemd, pelo que [ainda é necessário instalar software de terceiros](../dns.md#encrypted-dns-proxies). +### Native Operating System Support + +#### Android + +As últimas versões do iOS, iPadOS, tvOS e macOS, suportam tanto DoT como DoH. Ambos os protocolos são suportados nativamente através de [perfis de configuração](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) ou através de [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). + +#### Apple Devices + +Após a instalação de um perfil de configuração ou de um aplicativo que utiliza a API de configurações DNS, a configuração DNS pode ser selecionada. Se uma VPN estiver activa, a resolução dentro do túnel VPN utilizará as definições DNS da VPN e não as definições de todo o seu sistema. + +A Apple não fornece uma interface nativa para a criação de perfis DNS criptografados. [Criador de perfil DNS seguro](https://dns.notjakob.com/tool.html) é uma ferramenta não oficial para criar os seus próprios perfis DNS encriptados, no entanto eles não serão assinados. + +Apple does not provide a native interface for creating encrypted DNS profiles. Informações Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## O que é que uma pessoa de fora pode ver? Neste exemplo, vamos registar o que acontece quando fazemos um pedido ao DoH: @@ -318,4 +336,27 @@ A sub-rede de cliente [EDNS](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) Destina-se a "acelerar" a entrega de dados, dando ao cliente uma resposta que pertence a um servidor que está perto dele, como uma rede de entrega de conteúdos [](https://en.wikipedia.org/wiki/Content_delivery_network), que são frequentemente utilizados em streaming de vídeo e no fornecimento de aplicações Web JavaScript. -Esta funcionalidade tem um custo de privacidade, uma vez que fornece ao servidor DNS algumas informações sobre a localização do cliente. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/pt/dns.md b/i18n/pt/dns.md index 1bf50b1a..7bfeaf5a 100644 --- a/i18n/pt/dns.md +++ b/i18n/pt/dns.md @@ -15,52 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [ ## Provedores recomendados -| DNS | Política de Privacidade | Protocolo | Protocolos | Logging | ECS | -| ----------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ----------------------------------------------------------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Cleartext
DoH
DoT
DNSCrypt | Yes | Based on personal configuration. Filter list being used can be found here. [**DNS sobre HTTPS**](https://en.wikipedia.org/wiki/DNS_over_HTTPS) como definido em [RFC 8484](https://datatracker.ietf.org/doc/html/rfc8484) consultas de pacotes no protocolo [HTTP/2](https://en.wikipedia.org/wiki/HTTP/2) e fornece segurança com [HTTPS](https://en.wikipedia.org/wiki/HTTPS). | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Comercial | Cleartext
DoH
DoT | 4 | Based on personal configuration. | -| [**ControlID**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Comercial | Cleartext
DoH
DoT | 4 | Based on personal configuration. | -| [**IVPN**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | Comercial | DoH
DoT | 4 | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**PróximoDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Comercial | Cleartext
DoH
DoT
DNSCrypt | Opcional[^5] | Based on personal configuration. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Comercial | Some[^6] | Opcional[^5] | Based on personal configuration, Malware blocking by default. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Framadate +| DNS | Política de Privacidade | Protocolo | Protocolos | [Logging](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | ECS | Signed Apple Profile | +| ----------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ----------------------------------------------------------- | ------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Cleartext
DoH
DoT
DNSCrypt | Anonymized | Based on server choice. Filter list being used can be found here. [**DNS sobre HTTPS**](https://en.wikipedia.org/wiki/DNS_over_HTTPS) como definido em [RFC 8484](https://datatracker.ietf.org/doc/html/rfc8484) consultas de pacotes no protocolo [HTTP/2](https://en.wikipedia.org/wiki/HTTP/2) e fornece segurança com [HTTPS](https://en.wikipedia.org/wiki/HTTPS). | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Cleartext
DoH
DoT | 4 | Based on server choice. | [4](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Cleartext
DoH
DoT | 4 | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | 4 | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**IVPN**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | DoH
DoT | 4 | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Opcional[^5] | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. +## Self-Hosted DNS Filtering -- Deve suportar [DNSSEC](technology/dns.md#what-is-dnssec-and-when-is-it-used) -- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). -- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled. -- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. +A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. -## Native Operating System Support +### Pi-hole -### Android +
-As últimas versões do iOS, iPadOS, tvOS e macOS, suportam tanto DoT como DoH. Ambos os protocolos são suportados nativamente através de [perfis de configuração](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) ou através de [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple Devices +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -Após a instalação de um perfil de configuração ou de um aplicativo que utiliza a API de configurações DNS, a configuração DNS pode ser selecionada. Se uma VPN estiver activa, a resolução dentro do túnel VPN utilizará as definições DNS da VPN e não as definições de todo o seu sistema. +Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. -A Apple não fornece uma interface nativa para a criação de perfis DNS criptografados. [Criador de perfil DNS seguro](https://dns.notjakob.com/tool.html) é uma ferramenta não oficial para criar os seus próprios perfis DNS encriptados, no entanto eles não serão assinados. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### Signed Profiles - -Apple does not provide a native interface for creating encrypted DNS profiles. Informações Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -![logótipo DNSCloak](/assets/img/ios/dnscloak.png){ align=right } - -**DNSCloak** é um cliente iOS de código aberto que suporta [DNS-over-HTTPS](/dns/#dns-over-https-doh), [DNSCrypt](/dns/#dnscrypt), e [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy/wiki) opções como respostas DNS em cache, consultas DNS de registo local, e listas de blocos personalizadas. Os usuários podem [adicionar resolvedores personalizados por carimbo DNS](https://medium.com/privacyguides/adding-custom-dns-over-https-resolvers-to-dnscloak-20ff5845f4b5). +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home features a polished web interface to view insights and manage blocked content. + +[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### ControlID + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### PróximoDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Proxies DNS encriptados -Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). +Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -113,52 +187,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
-## Soluções auto-hospedadas +## Framadate -A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. +**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. -### AdGuard Home +### Requisitos mínimos -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home features a polished web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. [^1]: Armazenamos métricas agregadas de desempenho do nosso servidor DNS, nomeadamente o número de pedidos completos para um determinado servidor, o número de pedidos bloqueados, a velocidade de processamento dos pedidos. Nós mantemos e armazenamos a base de dados de domínios solicitados nas últimas 24 horas. Precisamos dessas informações para identificar e bloquear novos rastreadores e ameaças. Também registramos quantas vezes este ou aquele rastreador foi bloqueado. Precisamos desta informação para remover regras desactualizadas dos nossos filtros.[https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: O Cloudflare recolhe e armazena apenas os dados limitados da consulta DNS que são enviados para o resolvedor 1.1.1.1. O serviço resolver 1.1.1.1 não registra dados pessoais, e a maior parte dos dados de consulta limitados não identificáveis pessoalmente é armazenada apenas por 25 horas.[https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy) [^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/ru/advanced/dns-overview.md b/i18n/ru/advanced/dns-overview.md index 2f8155e9..ae1c6a08 100644 --- a/i18n/ru/advanced/dns-overview.md +++ b/i18n/ru/advanced/dns-overview.md @@ -82,6 +82,24 @@ DNS существует с [первых дней](https://en.wikipedia.org/wik Нативная реализация DoH появилась в iOS 14, macOS 11, Microsoft Windows и Android 13 (однако она не будет включена [по умолчанию](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). Общая поддержка Linux'а ожидает [реализации](https://github.com/systemd/systemd/issues/8639) systemd, поэтому [всё еще требуется установка стороннего программного обеспечения](../dns.md#encrypted-dns-proxies). +### Нативная поддержка в операционных системах + +#### Android + +Android 9 и новее поддерживает DNS over TLS. Его можно включить в **Настройках** → **Сеть и интернет** → **Частный DNS-сервер**. + +#### Устройства Apple + +Последние версии iOS, iPadOS, tvOS и macOS поддерживают протоколы DoT и DoH. Оба протокола можно настроить при помощи [профилей конфигурации](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) или [API настроек DNS](https://developer.apple.com/documentation/networkextension/dns_settings). + +После установки профиля конфигурации или приложения, использующего API настроек DNS, можно выбрать конфигурацию DNS. Если включен VPN, будут использоваться настройки DNS вашего VPN-сервиса, а не системные настройки. + +Apple не предоставляет нативного интерфейса для создания профилей зашифрованного DNS. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) — это неофициальный инструмент создания собственных профилей зашифрованного DNS, однако они не будут подписаны. Предпочтительнее использовать подписанные профили, так как подпись подтверждает надёжность источника профиля и помогает обеспечить его целостность. Зеленая метка «Проверено» присваивается подписанным профилям конфигурации. Чтобы получить больше информации о подписанном коде, смотрите статью [«О подписывании кода»](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## Что может увидеть посторонний человек? В этом примере мы запишем, что происходит, когда мы делаем запрос DoH: @@ -318,4 +336,27 @@ While this process can be slightly more inefficient, in this example neither the Он предназначен для "ускорения" доставки данных путем предоставления клиенту ответа, принадлежащего серверу, который находится рядом, например, [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), которые часто используются при потоковой передаче видео и обслуживании веб-приложений JavaScript. -Эта функция работает в ущерб конфиденциальности, поскольку она сообщает DNS-серверу некоторую информацию о местонахождении клиента. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/ru/dns.md b/i18n/ru/dns.md index 9d7c11f9..9d96f4de 100644 --- a/i18n/ru/dns.md +++ b/i18n/ru/dns.md @@ -15,50 +15,126 @@ global: ## Рекомендованные провайдеры -| DNS-провайдер | Политика конфиденциальности | Протоколы | Логирование | ECS | Фильтрация | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ---------------- | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Частичное[^1] | Yes | В зависимости от персональной конфигурации. Используемый список фильтрации можно найти здесь. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Без шифрования
DoH/3
DoT | Частичное[^2] | Нет | В зависимости от персональной конфигурации. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Без шифрования
DoH/3
DoT
DoQ | Опциональное[^3] | Нет | В зависимости от персональной конфигурации. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | Нет[^4] | Нет | В зависимости от персональной конфигурации. Используемый список фильтрации можно найти здесь. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Без шифрования
DoH/3
DoT
DoQ | Опциональное[^5] | Необязательное[^5] | В зависимости от персональной конфигурации. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Без шифрования
DoH
DoT
DNSCrypt | Частичное[^6] | Необязательное[^5] | В зависимости от персональной конфигурации, блокировка вредоносных программ по умолчанию. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Критерии +| DNS-провайдер | Политика конфиденциальности | Протоколы | Логирование | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Фильтрация | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ---------------- | -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Частичное[^1] | Anonymized | Based on server choice. Используемый список фильтрации можно найти здесь. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Частичное[^2] | Нет | Based on server choice. | [Нет](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Опциональное[^3] | Нет | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Нет | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | Нет[^4] | Нет | Based on server choice. Используемый список фильтрации можно найти здесь. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Необязательное[^5] | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Обратите внимание, что у нас нет связей ни с одним проектом, которые мы рекомендуем.** В дополнение к [нашим стандартным критериям](about/criteria.md) мы разработали четкий набор требований, позволяющий давать объективные рекомендации. Мы рекомендуем ознакомиться с данным списком перед выбором и провести самостоятельное исследование, чтобы убедиться, что для вас это правильный выбор. +## Self-Hosted DNS Filtering -- Поддержка [DNSSEC](advanced/dns-overview.md#what-is-dnssec). -- [Минимизация QNAME](advanced/dns-overview.md#what-is-qname-minimization). -- Позволяет отключить [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs). -- Предпочтительна поддержка [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) или поддержка гео-позиционирования. +DNS с самостоятельным хостингом полезно для обеспечения фильтрации на управляемых платформах, таких как телевизоры Smart TV и устройства IoT (Internet of Things - Интернет вещей), поскольку для этого не требуется клиентское ПО. -## Нативная поддержка в операционных системах +### Pi-hole -### Android +
-Android 9 и новее поддерживает DNS over TLS. Его можно включить в **Настройках** → **Сеть и интернет** → **Частный DNS-сервер**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Устройства Apple +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -Последние версии iOS, iPadOS, tvOS и macOS поддерживают протоколы DoT и DoH. Оба протокола можно настроить при помощи [профилей конфигурации](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) или [API настроек DNS](https://developer.apple.com/documentation/networkextension/dns_settings). +Pi-hole создана для развертывания на Raspberry Pi, но она не требует именно такого специфичного оборудования. Решение предлагает дружелюбный веб-интерфейс для просмотра подробных отчетов и управления блокировкой контента. -После установки профиля конфигурации или приложения, использующего API настроек DNS, можно выбрать конфигурацию DNS. Если включен VPN, будут использоваться настройки DNS вашего VPN-сервиса, а не системные настройки. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### Подписанные профили - -Apple не предоставляет нативного интерфейса для создания профилей зашифрованного DNS. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) — это неофициальный инструмент создания собственных профилей зашифрованного DNS, однако они не будут подписаны. Предпочтительнее использовать подписанные профили, так как подпись подтверждает надёжность источника профиля и помогает обеспечить его целостность. Зеленая метка «Проверено» присваивается подписанным профилям конфигурации. Чтобы получить больше информации о подписанном коде, смотрите статью [«О подписывании кода»](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Инфо.

- -`systemd-resolved`, используемый во многих дистрибутивах Linux для DNS-запросов, всё еще [не поддерживает DoH](https://github.com/systemd/systemd/issues/8639). Если вы хотите использовать DoH, вам следует установить [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) и [настроить его](https://wiki.archlinux.org/title/Dnscrypt-proxy) для обработки всех DNS-запросов в системе по протоколу HTTPS. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home предлагает продуманный интерфейс для просмотра развёрнутых отчетов и управления блокировкой контента. + +[:octicons-home-16: Официальный сайт](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Политика конфиденциальности" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Документация} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Исходный код" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Зашифрованные DNS-прокси -Зашифрованные DNS-прокси создают локальный прокси-сервер, на который будут перенаправляться запросы с вашего системного [незашифрованного DNS-резолвера](advanced/dns-overview.md#unencrypted-dns). Обычно они подходят для устройств, не поддерживающих [зашифрованный DNS](advanced/dns-overview.md#what-is-encrypted-dns). +Зашифрованные DNS-прокси создают локальный прокси-сервер, на который будут перенаправляться запросы с вашего системного [незашифрованного DNS-резолвера](advanced/dns-overview.md#unencrypted-dns). Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Apple не предоставляет нативного интерфейса д
-## Решения для самостоятельного хостинга +## Критерии -DNS с самостоятельным хостингом полезно для обеспечения фильтрации на управляемых платформах, таких как телевизоры Smart TV и устройства IoT (Internet of Things - Интернет вещей), поскольку для этого не требуется клиентское ПО. +**Обратите внимание, что у нас нет связей ни с одним проектом, которые мы рекомендуем.** В дополнение к [нашим стандартным критериям](about/criteria.md) мы разработали четкий набор требований, позволяющий давать объективные рекомендации. Мы рекомендуем ознакомиться с данным списком перед выбором и провести самостоятельное исследование, чтобы убедиться, что для вас это правильный выбор. -### AdGuard Home +### Минимальные требования к сервисам -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home предлагает продуманный интерфейс для просмотра развёрнутых отчетов и управления блокировкой контента. - -[:octicons-home-16: Официальный сайт](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Политика конфиденциальности" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Документация} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Исходный код" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole создана для развертывания на Raspberry Pi, но она не требует именно такого специфичного оборудования. Решение предлагает дружелюбный веб-интерфейс для просмотра подробных отчетов и управления блокировкой контента. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [Минимизация QNAME](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Предпочтительна поддержка [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) или поддержка гео-позиционирования. [^1]: AdGuard хранит показатели производительности их DNS серверов, содержащие в себе количество выполненных запросов к определенному серверу, количество заблокированных запросов и скорость обработки. Они также ведут и хранят базу данных доменов, запрошенных в течение последних 24 часов. "Нам нужна эта информация, чтобы выявлять и блокировать новые трекеры и угрозы." "Также мы храним информацию о том, сколько раз тот или иной трекер был заблокирован. Нам нужна эта информация, чтобы удалять устаревшие правила из наших фильтров." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare собирает и хранит только DNS-запросы, направленные на 1.1.1.1. Сервис не хранит персональные данные; большая часть неперсональных данных хранится только в течение 25 часов. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D ведет логи только на Premium-серверах с пользовательскими DNS-профилями. Бесплатные сервера не ведут логов. [https://controld.com/privacy](https://controld.com/privacy) [^4]: DNS-сервера Mullvad доступны и для пользователей Mullvad VPN, и для остальных пользователей Интернета. Их политика конфиденциальности утверждает, что они ни в каком виде не сохраняют DNS-запросы. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 собирает некоторые данные в целях обнаружения угроз и реагирования на них. Эти данные могут быть изменены и переданы, например, в целях исследования безопасности. Quad9 не собирает и не хранит IP-адреса и другую информацию, которую они считают идентифицирующей пользователя. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 собирает некоторые данные в целях обнаружения угроз и реагирования на них. Эти данные могут быть изменены и переданы, например, в целях исследования безопасности. Quad9 не собирает и не хранит IP-адреса и другую информацию, которую они считают идентифицирующей пользователя. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/sv/advanced/dns-overview.md b/i18n/sv/advanced/dns-overview.md index eccd5da5..818e08b5 100644 --- a/i18n/sv/advanced/dns-overview.md +++ b/i18n/sv/advanced/dns-overview.md @@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies). +### Native Operating System Support + +#### Android + +Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**. + +#### Apple Devices + +The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). + +After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. + +Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## What can an outside party see? In this example we will record what happens when we make a DoH request: @@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps. -This feature does come at a privacy cost, as it tells the DNS server some information about the client's location. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/sv/dns.md b/i18n/sv/dns.md index 0a5ecf66..57343283 100644 --- a/i18n/sv/dns.md +++ b/i18n/sv/dns.md @@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [ ## Recommended Providers -| DNS Provider | Integritetspolicy | Protocols | Logging | ECS | Filtering | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Some[^1] | Ja | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH/3
DoT | Some[^2] | No | Based on personal configuration. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH/3
DoT
DoQ | Optional[^3] | No | Based on personal configuration. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | No[^4] | No | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH/3
DoT
DoQ | Optional[^5] | Optional | Based on personal configuration. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext
DoH
DoT
DNSCrypt | Some[^6] | Optional | Based on personal configuration, Malware blocking by default. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Kriterier +| DNS Provider | Integritetspolicy | Protocols | Logging | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Ja](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | No | Based on server choice. | [Ja](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Ja](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Ja](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optional | Based on server choice, malware blocking by default. | [Ja](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Observera att vi inte är knutna till något av de projekt som vi rekommenderar.** Förutom [våra standardkriterier](about/criteria.md)har vi utvecklat en tydlig uppsättning krav som gör det möjligt för oss att ge objektiva rekommendationer. Vi föreslår att du bekantar dig med den här listan innan du väljer att använda ett projekt, och att du gör din egen forskning för att se till att det är rätt val för dig. +## Self-Hosted DNS Filtering -- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec). -- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). -- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled. -- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. +A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. -## Native Operating System Support +### Pi-hole -### Android +
-Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple Devices +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). +Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. -After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### Signed Profiles - -Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home features a polished web interface to view insights and manage blocked content. + +[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Krypterade DNS-proxyservrar -Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). +Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
-## Egenstyrda lösningar +## Kriterier -A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. +**Observera att vi inte är knutna till något av de projekt som vi rekommenderar.** Förutom [våra standardkriterier](about/criteria.md)har vi utvecklat en tydlig uppsättning krav som gör det möjligt för oss att ge objektiva rekommendationer. Vi föreslår att du bekantar dig med den här listan innan du väljer att använda ett projekt, och att du gör din egen forskning för att se till att det är rätt val för dig. -### AdGuard Home +### Minimikrav -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home features a polished web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy) [^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/tr/advanced/dns-overview.md b/i18n/tr/advanced/dns-overview.md index 2ffb67b2..67e02089 100644 --- a/i18n/tr/advanced/dns-overview.md +++ b/i18n/tr/advanced/dns-overview.md @@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies). +### İşletim Sistemi Desteği + +#### Android + +Android 9 ve üstü, TLS üzerinden DNS'yi destekler. Ayarlar şurada bulunabilir: **Ayarlar** → **Ağ & İnternet** → **Özel DNS**. + +#### Apple Cihazlar + +iOS, iPadOS, tvOS ve macOS'in en son sürümleri hem DoT hem de DoH'yi desteklemektedir. Her iki protokol de [yapılandırma profilleri](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) veya [DNS Ayarları API'si](https://developer.apple.com/documentation/networkextension/dns_settings)aracılığıyla doğal olarak desteklenmektedir. + +Bir yapılandırma profili veya DNS Ayarları API'sini kullanan bir uygulama yüklendikten sonra DNS yapılandırması seçilebilir. Bir VPN etkinse, VPN tüneli içindeki çözünürlük, sistem genelindeki ayarlarınızı değil VPN'in DNS ayarlarını kullanacaktır. + +Apple şifrelenmiş DNS profilleri oluşturmak için yerel bir arayüz sağlamaz. [Güvenli DNS profil oluşturucu](https://dns.notjakob.com/tool.html) kendi şifreli DNS profillerinizi oluşturmak için resmi olmayan bir araçtır, ancak bunlar imzalanmayacaktır. İmzalanmış profiller tercih edilir; imzalama profilin kaynağını doğrular ve profillerin bütünlüğünü sağlamaya yardımcı olur. İmzalanmış yapılandırma profillerine yeşil bir "Doğrulandı" etiketi verilir. Kod imzalama hakkında daha fazla bilgi için bkz. [Kod İmzalama Hakkında](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## What can an outside party see? In this example we will record what happens when we make a DoH request: @@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps. -This feature does come at a privacy cost, as it tells the DNS server some information about the client's location. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/tr/dns.md b/i18n/tr/dns.md index 50256790..2a4783de 100644 --- a/i18n/tr/dns.md +++ b/i18n/tr/dns.md @@ -15,50 +15,126 @@ global: ## Önerilen Sağlayıcılar -| DNS Sağlayıcısı | Gizlilik Politikası | Protokoller | Günlük kaydı | ECS | Filtreleme | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ---------------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Bazı[^1] | Yes | Kişisel yapılandırmaya göre. Kullanılan filtre listesine buradan ulaşabilirsiniz. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH/3
DoT | Bazı[^2] | Hayır | Kişisel yapılandırmaya göre. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH/3
DoT
DoQ | İsteğe bağlı[^3] | Hayır | Kişisel yapılandırmaya göre. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | Hayır[^4] | Hayır | Kişisel yapılandırmaya göre. Kullanılan filtre listesine buradan ulaşabilirsiniz. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH/3
DoT
DoQ | İsteğe bağlı[^5] | İsteğe bağlı | Kişisel yapılandırmaya göre. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext
DoH
DoT
DNSCrypt | Bazı[^6] | İsteğe bağlı | Kişisel yapılandırmaya göre, varsayılan olarak Kötü Amaçlı Yazılım engelleme. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Kriterler +| DNS Sağlayıcısı | Gizlilik Politikası | Protokoller | Günlük kaydı | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtreleme | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ---------------- | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Bazı[^1] | Anonymized | Based on server choice. Kullanılan filtre listesine buradan ulaşabilirsiniz. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Bazı[^2] | Hayır | Based on server choice. | [Hayır](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | İsteğe bağlı[^3] | Hayır | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Hayır | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | Hayır[^4] | Hayır | Based on server choice. Kullanılan filtre listesine buradan ulaşabilirsiniz. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | İsteğe bağlı | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Lütfen önerdiğimiz projelerin hiçbirine bağlı olmadığımızı unutmayın.** [standart kriterlerimize](about/criteria.md)ek olarak, objektif tavsiyelerde bulunabilmemiz için bir dizi gereklilik geliştirdik. Bir projeyi kullanmayı seçmeden önce bu listeye aşina olmanızı ve sizin için doğru seçim olduğundan emin olmak için kendi araştırmanızı yapmanızı öneririz. +## Self-Hosted DNS Filtering -- [DNSSEC](advanced/dns-overview.md#what-is-dnssec) desteklemelidir. -- [QNAME Minimizasyonu](advanced/dns-overview.md#what-is-qname-minimization). -- [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) adresinin devre dışı bırakılmasına izin verilmelidir. -- [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) desteği veya coğrafi yönlendirme desteği tercih edilmelidir. +A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. -## İşletim Sistemi Desteği +### Pi-hole -### Android +
-Android 9 ve üstü, TLS üzerinden DNS'yi destekler. Ayarlar şurada bulunabilir: **Ayarlar** → **Ağ & İnternet** → **Özel DNS**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple Cihazlar +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -iOS, iPadOS, tvOS ve macOS'in en son sürümleri hem DoT hem de DoH'yi desteklemektedir. Her iki protokol de [yapılandırma profilleri](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) veya [DNS Ayarları API'si](https://developer.apple.com/documentation/networkextension/dns_settings)aracılığıyla doğal olarak desteklenmektedir. +Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. -Bir yapılandırma profili veya DNS Ayarları API'sini kullanan bir uygulama yüklendikten sonra DNS yapılandırması seçilebilir. Bir VPN etkinse, VPN tüneli içindeki çözünürlük, sistem genelindeki ayarlarınızı değil VPN'in DNS ayarlarını kullanacaktır. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### İmzalı Profiller - -Apple şifrelenmiş DNS profilleri oluşturmak için yerel bir arayüz sağlamaz. [Güvenli DNS profil oluşturucu](https://dns.notjakob.com/tool.html) kendi şifreli DNS profillerinizi oluşturmak için resmi olmayan bir araçtır, ancak bunlar imzalanmayacaktır. İmzalanmış profiller tercih edilir; imzalama profilin kaynağını doğrular ve profillerin bütünlüğünü sağlamaya yardımcı olur. İmzalanmış yapılandırma profillerine yeşil bir "Doğrulandı" etiketi verilir. Kod imzalama hakkında daha fazla bilgi için bkz. [Kod İmzalama Hakkında](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -Birçok Linux dağıtımının DNS aramalarını yapmak için kullandığı `systemd-resolved` henüz [DoH'u desteklemiyor] (https://github.com/systemd/systemd/issues/8639). DoH kullanmak istiyorsanız, sistem çözümleyicinizden tüm DNS sorgularını almak ve HTTPS üzerinden iletmek için [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) gibi bir proxy yüklemeniz ve [yapılandırmanız] (https://wiki.archlinux.org/title/Dnscrypt-proxy) gerekir. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home features a polished web interface to view insights and manage blocked content. + +[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Şifrelenmiş DNS Proxy'leri -Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). +Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
-## Self-hosted Solutions +## Kriterler -A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. +**Lütfen önerdiğimiz projelerin hiçbirine bağlı olmadığımızı unutmayın.** [standart kriterlerimize](about/criteria.md)ek olarak, objektif tavsiyelerde bulunabilmemiz için bir dizi gereklilik geliştirdik. Bir projeyi kullanmayı seçmeden önce bu listeye aşina olmanızı ve sizin için doğru seçim olduğundan emin olmak için kendi araştırmanızı yapmanızı öneririz. -### AdGuard Home +### Minimum Requirements -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home features a polished web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [QNAME Minimizasyonu](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) desteği veya coğrafi yönlendirme desteği tercih edilmelidir. [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy) [^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/uk/advanced/dns-overview.md b/i18n/uk/advanced/dns-overview.md index 2ffb67b2..0ebe55fe 100644 --- a/i18n/uk/advanced/dns-overview.md +++ b/i18n/uk/advanced/dns-overview.md @@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies). +### Native Operating System Support + +#### Android + +Android 9 і вище підтримує DNS через TLS. Налаштування можна знайти тут: **Налаштування** → **Мережа & Інтернет** → **Приватний DNS**. + +#### Apple Devices + +Останні версії iOS, iPadOS, tvOS та macOS підтримують як DoT, так і DoH. Обидва протоколи підтримуються нативно через [профілі конфігурації](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) або через [API налаштувань DNS](https://developer.apple.com/documentation/networkextension/dns_settings). + +Після встановлення профілю конфігурації або програми, яка використовує API налаштувань DNS, можна вибрати конфігурацію DNS. Якщо VPN активна, при вирішенні в тунелі VPN будуть використовуватися налаштування DNS VPN, а не ваші загальносистемні налаштування. + +Apple не надає власного інтерфейсу для створення зашифрованих профілів DNS. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) — неофіційний інструмент для створення власних зашифрованих DNS профілів, які, однак, не будуть підписані. Підписаним профілям надається перевага; підпис підтверджує походження профілю і допомагає забезпечити цілісність профілів. Підписаним профілям конфігурації присвоюється зелена мітка "Перевірено". Для отримання додаткової інформації про підписання коду див. [Про підписання коду](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## What can an outside party see? In this example we will record what happens when we make a DoH request: @@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps. -This feature does come at a privacy cost, as it tells the DNS server some information about the client's location. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/uk/dns.md b/i18n/uk/dns.md index d8d74f8e..02563df5 100644 --- a/i18n/uk/dns.md +++ b/i18n/uk/dns.md @@ -15,50 +15,126 @@ global: ## Рекомендовані DNS-провайдери -| DNS-провайдер | Політика конфіденційності | Протоколи | Логування | ECS | Фільтрація | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | --------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Деяке[^1] | Yes | Based on personal configuration. Список використовуваних фільтрів можна знайти тут. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Незашифрований текст
DoH/3
DoT | Деяке[^2] | Ні | Based on personal configuration. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Незашифрований текст
DoH/3
DoT
DoQ | Опціонально[^3] | Ні | Based on personal configuration. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | Немає[^4] | Ні | Based on personal configuration. Список використовуваних фільтрів можна знайти тут. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Незашифрований текст
DoH/3
DoT
DoQ | Опціонально[^5] | Опціонально | Based on personal configuration. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Незашифрований текст
DoH
DoT
DNSCrypt | Деяке[^6] | Опціонально | Based on personal configuration, Malware blocking by default. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Criteria +| DNS-провайдер | Політика конфіденційності | Протоколи | Логування | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Фільтрація | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | --------------- | -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Деяке[^1] | Anonymized | Based on server choice. Список використовуваних фільтрів можна знайти тут. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Деяке[^2] | Ні | Based on server choice. | [Ні](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Опціонально[^3] | Ні | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Ні | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | Немає[^4] | Ні | Based on server choice. Список використовуваних фільтрів можна знайти тут. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Опціонально | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Зверніть увагу, що ми не пов'язані з жодним з проектів, які ми рекомендуємо.** На додаток до [наших стандартних критеріїв](about/criteria.md), ми розробили чіткий набір вимог, які дозволяють нам надавати об'єктивні рекомендації. Ми пропонуємо вам ознайомитися з цим списком перед тим, як вибрати проект, і провести власне дослідження, щоб переконатися, що це правильний вибір для вас. +## Self-Hosted DNS Filtering -- Повинен підтримувати [DNSSEC](advanced/dns-overview.md#what-is-dnssec). -- [Мінімізація QNAME](advanced/dns-overview.md#what-is-qname-minimization). -- Дозвіл відключити [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs). -- Віддавайте перевагу підтримці [anycast,](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) або підтримці геонавігації. +Самостійно розміщене рішення DNS корисно для забезпечення фільтрації на контрольованих платформах, таких як Smart TV та інші пристрої IoT, оскільки не потрібно клієнтське програмне забезпечення. -## Native Operating System Support +### Pi-hole -### Android +
-Android 9 і вище підтримує DNS через TLS. Налаштування можна знайти тут: **Налаштування** → **Мережа & Інтернет** → **Приватний DNS**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple Devices +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -Останні версії iOS, iPadOS, tvOS та macOS підтримують як DoT, так і DoH. Обидва протоколи підтримуються нативно через [профілі конфігурації](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) або через [API налаштувань DNS](https://developer.apple.com/documentation/networkextension/dns_settings). +Pi-hole розроблений для розміщення на Raspberry Pi, але він не обмежується цим обладнанням. Програмне забезпечення має зручний веб-інтерфейс для перегляду аналітики та управління заблокованим контентом. -Після встановлення профілю конфігурації або програми, яка використовує API налаштувань DNS, можна вибрати конфігурацію DNS. Якщо VPN активна, при вирішенні в тунелі VPN будуть використовуватися налаштування DNS VPN, а не ваші загальносистемні налаштування. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### Підписані профілі - -Apple не надає власного інтерфейсу для створення зашифрованих профілів DNS. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) — неофіційний інструмент для створення власних зашифрованих DNS профілів, які, однак, не будуть підписані. Підписаним профілям надається перевага; підпис підтверджує походження профілю і допомагає забезпечити цілісність профілів. Підписаним профілям конфігурації присвоюється зелена мітка "Перевірено". Для отримання додаткової інформації про підписання коду див. [Про підписання коду](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -`systemd-resolved`, за якою багато дистрибутивів Linux здійснюють вирішення своїх DNS-пошуків, поки що не [підтримують DoH](https://github.com/systemd/systemd/issues/8639). Якщо ви хочете використовувати DoH, вам потрібно встановити проксі на кшталт [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) і [налаштувати його] (https://wiki.archlinux.org/title/Dnscrypt-proxy), щоб він приймав усі DNS-запити від вашого системного розв'язувача і перенаправляв їх через HTTPS. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home має відшліфований веб-інтерфейс для перегляду аналітики та керування заблокованим контентом. + +[:octicons-home-16: Домашня сторінка](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Політика конфіденційності" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Документація} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Вихідний код" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Encrypted DNS Proxies -Програмне забезпечення для проксі-серверів із зашифрованим DNS надає локальний проксі-сервер для перенаправлення на [незашифрованого DNS](advanced/dns-overview.md#unencrypted-dns). Зазвичай він використовується на платформах, які не підтримують [зашифрований DNS](advanced/dns-overview.md#what-is-encrypted-dns). +Програмне забезпечення для проксі-серверів із зашифрованим DNS надає локальний проксі-сервер для перенаправлення на [незашифрованого DNS](advanced/dns-overview.md#unencrypted-dns). Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Apple не надає власного інтерфейсу для створе
-## Self-hosted Solutions +## Criteria -Самостійно розміщене рішення DNS корисно для забезпечення фільтрації на контрольованих платформах, таких як Smart TV та інші пристрої IoT, оскільки не потрібно клієнтське програмне забезпечення. +**Зверніть увагу, що ми не пов'язані з жодним з проектів, які ми рекомендуємо.** На додаток до [наших стандартних критеріїв](about/criteria.md), ми розробили чіткий набір вимог, які дозволяють нам надавати об'єктивні рекомендації. Ми пропонуємо вам ознайомитися з цим списком перед тим, як вибрати проект, і провести власне дослідження, щоб переконатися, що це правильний вибір для вас. -### AdGuard Home +### Minimum Requirements -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home має відшліфований веб-інтерфейс для перегляду аналітики та керування заблокованим контентом. - -[:octicons-home-16: Домашня сторінка](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Політика конфіденційності" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Документація} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Вихідний код" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole розроблений для розміщення на Raspberry Pi, але він не обмежується цим обладнанням. Програмне забезпечення має зручний веб-інтерфейс для перегляду аналітики та управління заблокованим контентом. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [Мінімізація QNAME](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Віддавайте перевагу підтримці [anycast,](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) або підтримці геонавігації. [^1]: AdGuard зберігає агреговані показники продуктивності своїх DNS-серверів, а саме: кількість завершених запитів до певного сервера, кількість заблокованих запитів і швидкість обробки запитів. Вони також ведуть і зберігають базу даних доменів, до яких надходили запити протягом останніх 24 годин. "Нам потрібна ця інформація, щоб виявляти та блокувати нові трекери та загрози". "Ми також фіксуємо, скільки разів той чи інший трекер був заблокований. Нам потрібна ця інформація, щоб видалити застарілі правила з наших фільтрів". [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare збирає та зберігає лише обмежену кількість даних DNS-запитів, які надсилаються до вирішувача 1.1.1.1. Сервіс 1.1.1.1 не реєструє особисті дані, а основна частина обмежених неперсоніфікованих даних запитів зберігається лише протягом 25 годин. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D веде журнали лише для преміум-вирішувачів зі спеціальними профілями DNS. Безкоштовні розв'язувачі не логують дані. [https://controld.com/privacy](https://controld.com/privacy) [^4]: DNS-сервіс Mullvad доступний обом підписникам та не підписникам Mullvad VPN. У їхній політиці конфіденційності чітко зазначено, що вони не реєструють DNS-запити жодним чином. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 збирає деякі дані з метою моніторингу загроз та реагування на них. Потім ці дані можуть бути змішані та поширені, наприклад, з метою дослідження безпеки. Quad9 не збирає і не записує IP-адреси або інші дані, які вони вважають особистими. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 збирає деякі дані з метою моніторингу загроз та реагування на них. Потім ці дані можуть бути змішані та поширені, наприклад, з метою дослідження безпеки. Quad9 не збирає і не записує IP-адреси або інші дані, які вони вважають особистими. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/vi/advanced/dns-overview.md b/i18n/vi/advanced/dns-overview.md index 2ffb67b2..f4090aa0 100644 --- a/i18n/vi/advanced/dns-overview.md +++ b/i18n/vi/advanced/dns-overview.md @@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies). +### Native Operating System Support + +#### Android + +Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**. + +#### Apple Devices + +The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). + +After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. + +Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## What can an outside party see? In this example we will record what happens when we make a DoH request: @@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps. -This feature does come at a privacy cost, as it tells the DNS server some information about the client's location. +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/vi/dns.md b/i18n/vi/dns.md index f1994bf5..989cf104 100644 --- a/i18n/vi/dns.md +++ b/i18n/vi/dns.md @@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [ ## Recommended Providers -| DNS Provider | Chính Sách Bảo Mật | Protocols | Logging | ECS | Filtering | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | Some[^1] | Yes | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH/3
DoT | Some[^2] | No | Based on personal configuration. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH/3
DoT
DoQ | Optional[^3] | No | Based on personal configuration. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | No[^4] | No | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH/3
DoT
DoQ | Optional[^5] | Optional | Based on personal configuration. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext
DoH
DoT
DNSCrypt | Some[^6] | Optional | Based on personal configuration, Malware blocking by default. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Framadate +| DNS Provider | Chính Sách Bảo Mật | Protocols | Logging | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | No | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. +## Self-Hosted DNS Filtering -- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec). -- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). -- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled. -- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. +A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. -## Native Operating System Support +### Pi-hole -### Android +
-Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**. +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple Devices +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings). +Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. -After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings. +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### Signed Profiles - -Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

Info

- -`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home features a polished web interface to view insights and manage blocked content. + +[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Encrypted DNS Proxies -Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). +Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
-## Self-hosted Solutions +## Framadate -A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed. +**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. -### AdGuard Home +### Minimum Requirements -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home features a polished web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content. - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support. [^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy) [^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/zh-Hant/advanced/dns-overview.md b/i18n/zh-Hant/advanced/dns-overview.md index dd31ef9b..f93c8272 100644 --- a/i18n/zh-Hant/advanced/dns-overview.md +++ b/i18n/zh-Hant/advanced/dns-overview.md @@ -82,6 +82,24 @@ DNS 從網際網路的 [早期](https://en.wikipedia.org/wiki/Domain_Name_System DoH 原生執行出現在 iOS 14, macOS 11, Microsoft Windows, 與 Android 13 (不過其並未[預設啟動 ](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144))。 一般 Linux 桌面支援仍待 systemd [實現](https://github.com/systemd/systemd/issues/8639)， 所以 [還是得安裝第三方軟體](../dns.md#encrypted-dns-proxies)。 +### 原生作業系統支援 + +#### Android + +Android 9 以上版本支持 DoT (DNS over TLS)。 設定方式可以在以下位置找到： **設定** → **網路 & 網際網路** → **私人 DNS**。 + +#### Apple裝置 + +最新版本的 iOS、iPadOS、tvOS 和 macOS 都支持 DoT 和 DoH。 這兩個通訊協議都透過 [組態檔](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) 或透過 [DNS 設定 API ](https://developer.apple.com/documentation/networkextension/dns_settings)獲得原生支援。 + +安裝設定設定檔或使用 DNS 設定API 的應用程式後，即可選擇 DNS 設定。 如果啟用 VPN， 隧道內的解析將使用 VPN 的 DNS 設置，而不是設備系統的設置。 + +Apple不提供用於建立加密DNS設定檔的原生介面。 [Secure DNS profile creator](https://dns.notjakob.com/tool.html) 是一款非正式工具用以建立您自己的加密 DNS 設定檔。不過這個軟體並未得到簽署。 最好是簽署過個人資設定檔；簽署會驗證個人資料的來源，並有助於確保個人資料的完整性。 綠色的「已驗證」標籤會提供給已簽署的配置文件。 代碼簽名的詳細資訊，請參閱 [關於代碼簽名](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html)。 + +#### Linux + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## 外部人士可以看到什麼？ 在此範例中，我們將記錄當我們提出 DoH 請求時發生的事情： @@ -160,9 +178,7 @@ DoH 原生執行出現在 iOS 14, macOS 11, Microsoft Windows, 與 Android 13 ( 即便使用「加密 DNS」伺服器，網域也可能會透過 SNI 披露。 [TLS v1.3](https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.3) 協議帶來 [加密的 Client Hello](https://blog.cloudflare。com /encrypted-client-hello)，可防止這種洩漏。 -各國政府，特別是 - -中國< /a> 和[俄羅斯](https://zdnet.com/article/ Russia-wants-to-ban-the-use-of-secure-protocols-such-as-tls-1-3-doh- dot -esni)，已經[開始阻止](https://en.wikipedia.org/wiki/Server_Name_Inspiration#Encrypted_Client_Hello)它，或表達出企圖這樣做的想法。 近來俄羅斯 開始屏蔽使用 [HTTP/3](https://en.wikipedia.org/wiki/HTTP/3)的外國網站。 這是因為作為HTTP/3的一部分的 [QUIC](https://en.wikipedia.org/wiki/QUIC) 協議要求 `ClientHello` 也被加密。

+各國政府，特別是中國< /a> 和[俄羅斯](https://zdnet.com/article/ Russia-wants-to-ban-the-use-of-secure-protocols-such-as-tls-1-3-doh- dot -esni)，已經[開始阻止](https://en.wikipedia.org/wiki/Server_Name_Inspiration#Encrypted_Client_Hello)它，或表達出企圖這樣做的想法。 近來俄羅斯 開始屏蔽使用 [HTTP/3](https://en.wikipedia.org/wiki/HTTP/3)的外國網站。 這是因為作為HTTP/3的一部分的 [QUIC](https://en.wikipedia.org/wiki/QUIC) 協議要求 `ClientHello` 也被加密。

@@ -355,7 +371,7 @@ QNAME 指 "合格域名"，例如 `discuss.privacyguides.net`. 過去，在解 | 根伺服器 | 什麼是 .net 域名伺服器? | *提供 .net 伺服器* | | .net 伺服器 | Privacyguides.net 的域名伺服器是什麼? | *提供 Privacy Guides 伺服器* | | Privacy Guides 伺服器 | discuss.privacyguides.net 的域名伺服器是什麼? | 此伺服器 | -| Privacy Guides 伺服器 | discuss.privacyguides.net 的 IP 是多少? | 5.161.195.190 | +| Privacy Guides 伺服器 | Discuss.privacyguides.net 的 IP 是多少? | 5.161.195.190 | 雖然此過程可能稍減低效率低，但中央根網域伺服器和 TLD 網域伺服器都不會收到有關您的*完整*查詢的資訊，從而減少了資訊量傳輸您瀏覽習慣。 進一步的技術描述在 [RFC 7816](https://datatracker.ietf.org/doc/html/rfc7816)。 @@ -368,4 +384,35 @@ QNAME 指 "合格域名"，例如 `discuss.privacyguides.net`. 過去，在解 它的目的是回答客戶端距離最靠近的伺服器以“加快”資料的傳遞，類似[內容傳遞網絡](https://en.wikipedia.org/wiki/Content_delivery_network)，後者通常用於視頻串流和 JavaScript Web 應用程序。 -此功能確實以隱私為代價，因為它會告訴 DNS伺服器一些有關客戶端位置的資訊。 +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + + + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + + + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + + + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/zh-Hant/dns.md b/i18n/zh-Hant/dns.md index c0656a50..1769dbf0 100644 --- a/i18n/zh-Hant/dns.md +++ b/i18n/zh-Hant/dns.md @@ -15,50 +15,126 @@ global: ## 推薦的 DNS 提供商 -| DNS 提供者 | 隐私政策 | 協議 | 日誌記錄 | ECS | 篩選 | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------- | ------ | --- | ------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | 明文
DoH/3
DoT
DoQ
DNSCrypt | 一些[^1] | 是 | 根據個人配置。 使用的過濾器列表可以在這裡找到。 [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | 明文
DoH/3
DoT | 一些[^2] | 不是 | 根據個人配置。 | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | 明文
DoH/3
DoT
DoQ | 可選[^3] | 不是 | 根據個人配置。 | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | 否[^4] | 不是 | 根據個人配置。 正在使用的過濾器列表可以在這裡找到。 [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | 明文
DoH/3
DoT
DoQ | 可選[^5] | 可選的 | 根據個人配置。 | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | 明文
DoH
DoT
DNSCrypt | 一些[^6] | 可選的 | 根據個人設定，預設會封鎖惡意軟體。 | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### 標準 +| DNS 提供者 | 隐私政策 | 協議 | 日誌記錄 | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | 篩選 | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | -------- | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | 一些[^1] | Anonymized | Based on server choice. 使用的過濾器列表可以在這裡找到。 [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [是](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | 一些[^2] | 不是 | Based on server choice. | [不是](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | 可選[^3] | 不是 | Based on server choice. | [是](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | 不是 | Anonymized | Based on server choice. | [是](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | 否[^4] | 不是 | Based on server choice. 正在使用的過濾器列表可以在這裡找到。 [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [是](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | 可選的 | Based on server choice, malware blocking by default. | [是](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**請注意，我們這裏所推薦專案沒有任何牽扯。 ** 除了 [我們的標準準則](about/criteria.md)外，還有一套明確要求以提出客觀建議。 我們建議您在選擇使用任何項目之前先熟悉此列表，並進行自己的研究，以確保您的正確選擇。 +## Self-Hosted DNS Filtering -- 必須支援 [ DNSSEC ](advanced/dns-overview.md#what-is-dnssec)。 -- [QNAME 最小化](advanced/dns-overview.md#what-is-qname-minimization). -- 可讓 [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs)禁用 。 -- 首選 [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) 支援或地理轉向支援。 +在被控制平臺，自主託管 DNS 可提供有用的過濾，例如智能電視和其他物聯網設備，因為不需要客戶端軟件。 -## 原生作業系統支援 +### Pi-hole -### Android +
-Android 9 以上版本支持 DoT (DNS over TLS)。 設定方式可以在以下位置找到： **設定** → **網路 & 網際網路** → **私人 DNS**。 +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple裝置 +**Pi-hole** 是一個開源的 [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) ，它使用 [DNS 篩選](https://cloudflare.com/learning/access-management/what-is-dns-filtering/)來阻止不需要的網頁內容，例如廣告。 -最新版本的 iOS、iPadOS、tvOS 和 macOS 都支持 DoT 和 DoH。 這兩個通訊協議都透過 [組態檔](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) 或透過 [DNS 設定 API ](https://developer.apple.com/documentation/networkextension/dns_settings)獲得原生支援。 +Pi-hole 設計應用在 Raspberry Pi ，但它不限於這種硬體。 該軟體良好的 Web 界面，可查看有用資訊和管理被阻止的內容。 -安裝設定設定檔或使用 DNS 設定API 的應用程式後，即可選擇 DNS 設定。 如果啟用 VPN， 隧道內的解析將使用 VPN 的 DNS 設置，而不是設備系統的設置。 +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### 已簽署的設定檔 - -Apple不提供用於建立加密DNS設定檔的原生介面。 [Secure DNS profile creator](https://dns.notjakob.com/tool.html) 是一款非正式工具用以建立您自己的加密 DNS 設定檔。不過這個軟體並未得到簽署。 最好是簽署過個人資設定檔；簽署會驗證個人資料的來源，並有助於確保個人資料的完整性。 綠色的「已驗證」標籤會提供給已簽署的配置文件。 代碼簽名的詳細資訊，請參閱 [關於代碼簽名](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html)。 **簽署過的設定資料**是由 [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io)與 [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles)所提供。 - -
-

資訊

- -許多 Linux 發行版用來進行DNS查詢的`systemd-resolved` 還不[支援 DoH](https://github.com/systemd/systemd/issues/8639)。 如果要使用 DoH ，您需要安裝一個類似 [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy)的代理，並[設定](https://wiki.archlinux.org/title/Dnscrypt-proxy) 讓系統解析器獲取所有 DNS 查詢，並透過 HTTPS 轉發。 +
+### AdGuard首頁 + +
+ +![AdGuard 首頁標誌](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard** 是一個開源的 [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) ，使用[DNS 過濾](https://cloudflare.com/learning/access-management/what-is-dns-filtering/) 來封鎖不需要的網頁內容，例如廣告。 + +AdGuard 首頁提供精美的網頁介面，可查看有用資訊並管理被封鎖的內容。 + +[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +與帳戶一起使用時，NextDNS 將預設啟用洞察和日誌記錄功能（因為某些功能需求）。 可選擇保留日誌的存留時間和儲存位置，或完全停用日誌。 + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## 加密的DNS代理 -加密DNS代理軟體提供了一個本地代理，用於將 [個未加密的DNS](advanced/dns-overview.md#unencrypted-dns) 解析器轉發到。 通常，它用於原本不支持 [加密 DNS ](advanced/dns-overview.md#what-is-encrypted-dns)的平臺。 +加密DNS代理軟體提供了一個本地代理，用於將 [個未加密的DNS](advanced/dns-overview.md#unencrypted-dns) 解析器轉發到。 Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Apple不提供用於建立加密DNS設定檔的原生介面。 [Secure DNS profi
-## 自主託管方案 +## 標準 -在被控制平臺，自主託管 DNS 可提供有用的過濾，例如智能電視和其他物聯網設備，因為不需要客戶端軟件。 +**請注意，我們這裏所推薦專案沒有任何牽扯。 ** 除了 [我們的標準準則](about/criteria.md)外，還有一套明確要求以提出客觀建議。 我們建議您在選擇使用任何項目之前先熟悉此列表，並進行自己的研究，以確保您的正確選擇。 -### AdGuard首頁 +### 最低合格要求 -
- -![AdGuard 首頁標誌](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard** 是一個開源的 [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) ，使用[DNS 過濾](https://cloudflare.com/learning/access-management/what-is-dns-filtering/) 來封鎖不需要的網頁內容，例如廣告。 - -AdGuard 首頁提供精美的網頁介面，可查看有用資訊並管理被封鎖的內容。 - -[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** 是一個開源的 [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) ，它使用 [DNS 篩選](https://cloudflare.com/learning/access-management/what-is-dns-filtering/)來阻止不需要的網頁內容，例如廣告。 - -Pi-hole 設計應用在 Raspberry Pi ，但它不限於這種硬體。 該軟體良好的 Web 界面，可查看有用資訊和管理被阻止的內容。 - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [QNAME 最小化](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- 首選 [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) 支援或地理轉向支援。 [^1]: AdGuard 儲存其 DNS 伺服器的總和效能指標，即對特定伺服器的全部請求數量、被封鎖的請求數量，以及處理請求的速度。 他們還會保存和儲存過去24小時內所請求的網域資料庫。 我們需要這些資訊來識別和阻止新的追蹤器和威脅。 我們還記錄了這些追蹤器被封鎖的次數。 我們需要這些資訊以便在過濾器中刪除過時的規則。 [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare 僅收集並儲存發送至 1.1.1.1解析器的有限 DNS 查詢資料。 1.1.1.1解析器服務不會記錄個人資料，且大部分有限的非個人識別查詢資料僅存儲25小時。 [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D 只有記錄使用自定義 DNS 配置的高級解析器。 免費解析器不記錄數據。 [https://controld.com/privacy](https://controld.com/privacy) [^4]: Mullvad 的 DNS 服務可供 Mullvad VPN 的訂閱者和非訂閱者使用。 他們的隱私政策明確聲稱他們不會以任何方式記錄 DNS 請求。 [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: 與帳戶一起使用時，NextDNS 將預設啟用洞察和日誌記錄功能（因為某些功能需求）。 可選擇保留日誌的存留時間和儲存位置，或完全停用日誌。 如果沒有使用帳戶，則不會記錄任何資料。 [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9會收集一些資料，以進行威脅監控和回應。 然後這些資料會被重新混合與共享，例如用於安全研究。 Quad9 不會收集或記錄 IP 位址或其他他們認為可識別個人身份的資料。 [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9會收集一些資料，以進行威脅監控和回應。 然後這些資料會被重新混合與共享，例如用於安全研究。 Quad9 不會收集或記錄 IP 位址或其他他們認為可識別個人身份的資料。 [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) diff --git a/i18n/zh/advanced/dns-overview.md b/i18n/zh/advanced/dns-overview.md index 0bd4eb54..93d32d9f 100644 --- a/i18n/zh/advanced/dns-overview.md +++ b/i18n/zh/advanced/dns-overview.md @@ -82,6 +82,24 @@ DNS自互联网的 [早期](https://en.wikipedia.org/wiki/Domain_Name_System#His DoH的原生实现出现在iOS 14、macOS 11、微软Windows和Android 13中（然而，它不会被默认启用 [](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)）。 一般的Linux桌面支持还在等待systemd [实现](https://github.com/systemd/systemd/issues/8639) ，所以 [目前依然需要安装第三方软件](../dns.md#linux)。 +### Native Operating System Support + +#### 安卓 + +安卓9及以上系统支持通过TLS的DNS。 这些设置可以在下面找到。 **设置** → **网络 & 互联网** → **私人DNS**。 + +#### Apple Devices + +最新版本的iOS、iPadOS、tvOS和macOS，同时支持DoT和DoH。 通过 [配置文件](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) ，或通过 [DNS设置API](https://developer.apple.com/documentation/networkextension/dns_settings)，这两种协议都得到了本地支持。 + +在安装配置文件或使用DNS设置API的应用程序后，可以选择DNS配置。 如果VPN处于激活状态，在VPN隧道内的解析将使用VPN的DNS设置，而不是你整个系统的设置。 + +苹果公司没有为创建加密的DNS配置文件提供本地接口。 [安全DNS配置文件创建者](https://dns.notjakob.com/tool.html) 是一个非官方的工具，用于创建你自己的加密DNS配置文件，然而它们将不会被签署。 签名的档案是首选；签名验证了档案的来源，有助于确保档案的完整性。 绿色的 "已验证 "标签被赋予已签署的配置文件。 关于代码签名的更多信息，见 [关于代码签名](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html)。 + +#### Linux系统 + +`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS. + ## 外部一方能看到什么？ 在本示例中，我们将记录当我们提出DoH请求时会发生什么： @@ -318,4 +336,27 @@ DNSSEC在DNS的所有层面上实现了分层的数字签名政策。 例如， 它的目的是 "加快 "数据的交付，给客户一个属于离他们很近的服务器的答案，如 [内容交付网络](https://en.wikipedia.org/wiki/Content_delivery_network)，这通常用于视频流和服务JavaScript网络应用。 -这项功能确实是以隐私为代价的，因为它告诉DNS服务器一些关于客户端位置的信息。 +This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location. + +If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command: + +```bash +dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example: + +```bash +dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats +``` + +If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider. + +```text +o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32" +o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24" +;; Query time: 64 msec +;; SERVER: 9.9.9.11#53(9.9.9.11) +;; WHEN: Wed Mar 13 10:23:08 CDT 2024 +;; MSG SIZE rcvd: 130 +``` diff --git a/i18n/zh/dns.md b/i18n/zh/dns.md index 3b8f835d..542ad96f 100644 --- a/i18n/zh/dns.md +++ b/i18n/zh/dns.md @@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [ ## 推荐的供应商 -| DNS供应商 | 隐私政策 | 协议 | 日志记录 | ECS | 筛选 | -| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------ | --- | ---------------------------------------------------------------------------------------------------------------------------- | -| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext
DoH/3
DoT
DoQ
DNSCrypt | 一些[^1] | Yes | Based on personal configuration. 正在使用的过滤器列表可以在这里找到。 [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | -| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext
DoH/3
DoT | 一些[^2] | No | Based on personal configuration. | -| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext
DoH/3
DoT
DoQ | 可选[^3] | No | Based on personal configuration. | -| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH
DoT | No[^4] | No | Based on personal configuration. 正在使用的过滤器列表可以在这里找到。 [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | -| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext
DoH/3
DoT
DoQ | 可选[^5] | 可选 | Based on personal configuration. | -| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext
DoH
DoT
DNSCrypt | 一些[^6] | 可选 | Based on personal configuration, Malware blocking by default. | +These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead. -### Criteria +| DNS供应商 | 隐私政策 | 协议 | 日志记录 | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | 筛选 | Signed Apple Profile | +| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | -------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | +| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | 一些[^1] | Anonymized | Based on server choice. 正在使用的过滤器列表可以在这里找到。 [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) | +| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | 一些[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) | +| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | 可选[^3] | No | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) | +| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) | +| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. 正在使用的过滤器列表可以在这里找到。 [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) | +| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | 可选 | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) | -**请注意，我们与我们推荐的任何项目都没有关系。** 除了 [我们的标准标准](about/criteria.md)，我们还制定了一套明确的要求，使我们能够提供客观的建议。 我们建议你在选择使用一个项目之前熟悉这个清单，并进行自己的研究以确保它是你的正确选择。 +## Self-Hosted DNS Filtering -- 必须支持 [DNSSEC](advanced/dns-overview.md#what-is-dnssec)。 -- [QNAME最小化](advanced/dns-overview.md#what-is-qname-minimization). -- 允许 [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) 被禁用。 -- 倾向于 [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) 支持或地理转向支持。 +自我托管的DNS解决方案对于在智能电视和其他物联网设备等受控平台上提供过滤非常有用，因为不需要客户端软件。 -## Native Operating System Support +### Pi-hole -### 安卓 +
-安卓9及以上系统支持通过TLS的DNS。 这些设置可以在下面找到。 **设置** → **网络 & 互联网** → **私人DNS**。 +![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } -### Apple Devices +**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. -最新版本的iOS、iPadOS、tvOS和macOS，同时支持DoT和DoH。 通过 [配置文件](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) ，或通过 [DNS设置API](https://developer.apple.com/documentation/networkextension/dns_settings)，这两种协议都得到了本地支持。 +Pi-hole被设计为在Raspberry Pi上托管，但它并不局限于这种硬件。 该软件具有一个友好的网络界面，可以查看洞察力和管理封锁的内容。 -在安装配置文件或使用DNS设置API的应用程序后，可以选择DNS配置。 如果VPN处于激活状态，在VPN隧道内的解析将使用VPN的DNS设置，而不是你整个系统的设置。 +[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } +[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } +[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } -#### 已签名的配置文件 - -苹果公司没有为创建加密的DNS配置文件提供本地接口。 [安全DNS配置文件创建者](https://dns.notjakob.com/tool.html) 是一个非官方的工具，用于创建你自己的加密DNS配置文件，然而它们将不会被签署。 签名的档案是首选；签名验证了档案的来源，有助于确保档案的完整性。 绿色的 "已验证 "标签被赋予已签署的配置文件。 关于代码签名的更多信息，见 [关于代码签名](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html)。 **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles). - -
-

信息

- -`systemd-resolved`，许多Linux发行版使用它来进行DNS查询，但还不[支持DoH](https://github.com/systemd/systemd/issues/8639)。 如果你想使用DoH，你需要安装一个代理，如 [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy)和[配置它](https://wiki.archlinux.org/title/Dnscrypt-proxy)，从你的系统解析器接收所有的DNS查询并通过HTTPS转发。 +
+### AdGuard Home + +
+ +![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } + +**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. + +AdGuard Home有一个精致的网络界面，可以查看洞察力和管理被阻止的内容。 + +[:octicons-home-16: 主页](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="隐私政策" } +[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=文档} +[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="源代码" } + + + +
+ +## Cloud-Based DNS Filtering + +These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration). + +### Control D + +
+ +![Control D logo](assets/img/dns/control-d.svg){ align=right } + +**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free. + +[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary } +[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility) +- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld) +- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility) +- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460) +- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5) + +
+ +
+ +### NextDNS + +
+ +![NextDNS logo](assets/img/dns/nextdns.svg){ align=right } + +**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use. + +[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary } +[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows) +- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853) +- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki) +- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498) +- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases) + +
+ +
+ +When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. + +NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists. + +NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy). + ## Encrypted DNS Proxies -加密的DNS代理软件为 [未加密的DNS](advanced/dns-overview.md#unencrypted-dns) 解析器提供一个本地代理转发。 通常情况下，它被用于那些不支持 [加密DNS的平台](advanced/dns-overview.md#what-is-encrypted-dns)。 +加密的DNS代理软件为 [未加密的DNS](advanced/dns-overview.md#unencrypted-dns) 解析器提供一个本地代理转发。 Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns). ### RethinkDNS @@ -112,52 +188,19 @@ Encrypted DNS with third-party servers should only be used to get around basic [
-## Self-hosted Solutions +## Criteria -自我托管的DNS解决方案对于在智能电视和其他物联网设备等受控平台上提供过滤非常有用，因为不需要客户端软件。 +**请注意，我们与我们推荐的任何项目都没有关系。** 除了 [我们的标准标准](about/criteria.md)，我们还制定了一套明确的要求，使我们能够提供客观的建议。 我们建议你在选择使用一个项目之前熟悉这个清单，并进行自己的研究以确保它是你的正确选择。 -### AdGuard Home +### Minimum Requirements -
- -![AdGuard Home logo](assets/img/dns/adguard-home.svg){ align=right } - -**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -AdGuard Home有一个精致的网络界面，可以查看洞察力和管理被阻止的内容。 - -[:octicons-home-16: 主页](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="隐私政策" } -[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=文档} -[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="源代码" } - - - -
- -### Pi-hole - -
- -![Pi-hole logo](assets/img/dns/pi-hole.svg){ align=right } - -**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements. - -Pi-hole被设计为在Raspberry Pi上托管，但它并不局限于这种硬件。 该软件具有一个友好的网络界面，可以查看洞察力和管理封锁的内容。 - -[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary } -[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" } -[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute } - - - -
+- [DNSSEC](advanced/dns-overview.md#what-is-dnssec). +- [QNAME最小化](advanced/dns-overview.md#what-is-qname-minimization). +- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default. +- 倾向于 [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) 支持或地理转向支持。 [^1]: AdGuard存储其DNS服务器的汇总性能指标，即对特定服务器的完整请求数、被阻止的请求数和处理请求的速度。 他们还保留并存储了过去24小时内请求的域名数据库。 "我们需要这些信息来识别和阻止新的追踪者和威胁。" "我们还记录了这个或那个追踪器被封锁的次数。 我们需要这些信息来从我们的过滤器中删除过时的规则"。 [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html) [^2]: Cloudflare只收集和存储发送到1.1.1.1解析器的有限DNS查询数据。 1.1.1.1解析器服务不记录个人数据，而且大部分有限的非个人识别的查询数据只存储25小时。 [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) [^3]: Control D只记录具有自定义DNS配置文件的高级解析器。 自由解析器不记录数据。 [https://controld.com/privacy](https://controld.com/privacy) [^4]: Mullvad的DNS服务对Mullvad VPN的订阅者和非订阅者都适用。 他们的隐私政策明确声称他们不会以任何方式记录DNS请求。 [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy) -[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy) -[^6]: Quad9收集了一些数据，用于威胁监测和应对。 然后，这些数据可能被重新混合和共享，例如为了安全研究的目的。 Quad9不会收集或记录IP地址或其他他们认为可以识别个人身份的数据。 [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy) +[^5]: Quad9收集了一些数据，用于威胁监测和应对。 然后，这些数据可能被重新混合和共享，例如为了安全研究的目的。 Quad9不会收集或记录IP地址或其他他们认为可以识别个人身份的数据。 [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)