mirror of
https://github.com/privacyguides/i18n.git
synced 2025-06-26 20:42:36 +00:00
New Crowdin translations by GitHub Action
This commit is contained in:
Crowdin Bot
@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be
|
|||||||
|
|
||||||
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Native Operating System Support
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
يدعم أندرويد ٩ وما بعده أنظمة أسماء النطاقات عبر أمن طبقة النقل (DNS over TLS). تجد هذا الإعداد في: **الإعدادات** ← ** الشبكة والإنترنت ** ← **نظام أسماء نطاقات خاص**.
|
||||||
|
|
||||||
|
#### Apple Devices
|
||||||
|
|
||||||
|
تدعم آخر إصدارات آيأوإس و آيبادأوإس و تيفيأوإس و ماكأوإس أنظمة DoT و DoH. يوجد دعم أصيل لهذه الموافيق باستخدام [ملفَّات تعريف الضبط](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) أو باستخدام [واجهة برمجة إعدادات نظام تسمية النطاقات](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
لك اختيار ضبط نظام تسمية النطاقات بعد تثبيت ملفِّ تعريف ضبط أو تثبيت تطبيق يستخدم واجهة برمجة إعدادات نظام تسمية النطاقات. إن كانت شبكة خاصَّة افتراضية (VPN) مفعَّلةً فسوف تُحلَّل الاتصالات داخلها باستخدام نظام تسمية نطاقاتها وليس باستخدام إعدادات نظامك.
|
||||||
|
|
||||||
|
لا تتيح أبل واجهةً أصيلةً لإنشاء ملفَّات تعريف معمَّاة. [مُنشئ ملفَّات تعريف نظام تسمية النطاقات الآمن](https://dns.notjakob.com/tool.html) هو أداة غير رسمية تتيح لك إنشاء ملفَّات تعريف نظام تسمية النطاقات معمَّاة، ولكن ضع في حسبانك أنها لن توقَّع. تفضَّل ملفَّات التعريف الموقَّعة على غيرها، وذلك ﻷن التوقيع يؤكِّد أصلها وصحَّتها. تعلَّم ملفَّات التعريف الموقَّعة بعلامة «مؤكَّد» خضراء. لتستزيد علمًا عن توقيع الرموز عليك مطالعة [عن توقيع الرموز](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## What can an outside party see?
|
## What can an outside party see?
|
||||||
|
|
||||||
In this example we will record what happens when we make a DoH request:
|
In this example we will record what happens when we make a DoH request:
|
||||||
@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a
|
|||||||
|
|
||||||
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
||||||
|
|
||||||
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/ar/dns.md
183
i18n/ar/dns.md
@ -15,50 +15,126 @@ global:
|
|||||||
|
|
||||||
## موفِّرو الخدمة الموصى بهم
|
## موفِّرو الخدمة الموصى بهم
|
||||||
|
|
||||||
| الموفِّر | سياسة الخصوصية | الموافيق | تسجيل الأنشطة | ECS | التصفية |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| ------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | -------------------------------------------------------------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**آدجارد**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | بعض منه <sup id="fnref:1"><a href="#fn:1" class="footnote-ref">١</a></sup> | Yes | Based on personal configuration. لك العثور على قائمة التصفيات المستخدمة هنا. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**كلاودفلير**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH/3 <br> DoT | بعض منه <sup id="fnref:2"><a href="#fn:2" class="footnote-ref">٢</a></sup> | لا يوجد | Based on personal configuration. |
|
|
||||||
| [**كنترول دي**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | اختياري<sup id="fnref:3"><a href="#fn:3" class="footnote-ref">٣</a></sup> | لا يوجد | Based on personal configuration. |
|
|
||||||
| [**ملفاد**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | لا يوجد<sup id="fnref:4"><a href="#fn:4" class="footnote-ref">٤</a></sup> | لا يوجد | Based on personal configuration. لك العثور على قائمة التصفيات المستخدمة هنا. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**نكستديإنإس**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | اختياري<sup id="fnref:5"><a href="#fn:5" class="footnote-ref">٥</a></sup> | اختياري | Based on personal configuration. |
|
|
||||||
| [**كواد٩**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | بعض منه<sup id="fnref:6"><a href="#fn:6" class="footnote-ref">٦</a></sup> | اختياري | Based on personal configuration, Malware blocking by default. |
|
|
||||||
|
|
||||||
### Criteria
|
| الموفِّر | سياسة الخصوصية | الموافيق | تسجيل الأنشطة | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | التصفية | Signed Apple Profile |
|
||||||
|
| ------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | -------------------------------------------------------------------------- | -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | بعض منه <sup id="fnref:1"><a href="#fn:1" class="footnote-ref">١</a></sup> | Anonymized | Based on server choice. لك العثور على قائمة التصفيات المستخدمة هنا. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**كلاودفلير**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | بعض منه <sup id="fnref:2"><a href="#fn:2" class="footnote-ref">٢</a></sup> | لا يوجد | Based on server choice. | [لا يوجد](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | اختياري<sup id="fnref:3"><a href="#fn:3" class="footnote-ref">٣</a></sup> | لا يوجد | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | لا يوجد | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**ملفاد**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | لا يوجد<sup id="fnref:4"><a href="#fn:4" class="footnote-ref">٤</a></sup> | لا يوجد | Based on server choice. لك العثور على قائمة التصفيات المستخدمة هنا. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**كواد٩**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | اختياري | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**عليك التنبُّه لأننا لسنا ذوي صلة بأيٍّ من المشاريع التي نوصي بها**، وزيادةً على [معاييرنا القياسية](about/criteria.md) فقد طوَّرنا مجموعة متطلَّبات تتيح لنا توصية توصيات موضوعية. ينبغي لك الاطِّلاع على هذه القائمة قبل الاختيار منها، وابحث بنفسك لتتيقَّن من أن ما اخترت يناسبك.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- يجب أن يدعم [إضافات الأمان لأنظمة أسماء النطاقات](advanced/dns-overview.md#what-is-dnssec).
|
تتيح الاستضافة الذاتية لنظام تسمية نطاقات التصفية في المنصَّات المتحكَّم بها، مثل أجهزة التلفاز الذكية وغيرها من أجهزة إنترنت الأشياء، وذلك لأن جهة العميل لا تحتاج لأي برمجيات.
|
||||||
- [تدنية الأسماء المؤهَّلة](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- يسمح بتعطيل [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs).
|
|
||||||
- يفضِّل دعم [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) أو دعم geo-steering.
|
|
||||||
|
|
||||||
## Native Operating System Support
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
يدعم أندرويد ٩ وما بعده أنظمة أسماء النطاقات عبر أمن طبقة النقل (DNS over TLS). تجد هذا الإعداد في: **الإعدادات** ← ** الشبكة والإنترنت ** ← **نظام أسماء نطاقات خاص**.
|
{ align=right }
|
||||||
|
|
||||||
### Apple Devices
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
تدعم آخر إصدارات آيأوإس و آيبادأوإس و تيفيأوإس و ماكأوإس أنظمة DoT و DoH. يوجد دعم أصيل لهذه الموافيق باستخدام [ملفَّات تعريف الضبط](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) أو باستخدام [واجهة برمجة إعدادات نظام تسمية النطاقات](https://developer.apple.com/documentation/networkextension/dns_settings).
|
صُمِّم باي-هول ليستضاف في جهاز راسبيري باي، ولكنَّه ليس محدودًا به. لهذه البرمجية واجهة وِب سهلة الاستخدام ترى فيها المعلومات وتدير ما حُظر.
|
||||||
|
|
||||||
لك اختيار ضبط نظام تسمية النطاقات بعد تثبيت ملفِّ تعريف ضبط أو تثبيت تطبيق يستخدم واجهة برمجة إعدادات نظام تسمية النطاقات. إن كانت شبكة خاصَّة افتراضية (VPN) مفعَّلةً فسوف تُحلَّل الاتصالات داخلها باستخدام نظام تسمية نطاقاتها وليس باستخدام إعدادات نظامك.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### ملفَّات التعريف الموقَّعة
|
</details>
|
||||||
|
|
||||||
لا تتيح أبل واجهةً أصيلةً لإنشاء ملفَّات تعريف معمَّاة. [مُنشئ ملفَّات تعريف نظام تسمية النطاقات الآمن](https://dns.notjakob.com/tool.html) هو أداة غير رسمية تتيح لك إنشاء ملفَّات تعريف نظام تسمية النطاقات معمَّاة، ولكن ضع في حسبانك أنها لن توقَّع. تفضَّل ملفَّات التعريف الموقَّعة على غيرها، وذلك ﻷن التوقيع يؤكِّد أصلها وصحَّتها. تعلَّم ملفَّات التعريف الموقَّعة بعلامة «مؤكَّد» خضراء. لتستزيد علمًا عن توقيع الرموز عليك مطالعة [عن توقيع الرموز](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
[لا يدعم](https://github.com/systemd/systemd/issues/8639) ‹systemd-resolved› ميفاق DoH بعد، وهو ما تستخدمه الكثير من توزيعات لينكس لتبحث في أنظمة تسمية النطاقات. إن أردت استخدام DoH فعليك تثبيت وسيط مثل [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) [وضبطه](https://wiki.archlinux.org/title/Dnscrypt-proxy) ليستلم كلَّ استعلامات أنظمة تسمية النطاقات من محلِّل نظامك ويوجِّههم عبر HTTPS.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
لدى آدجارد هوم واجهة وِب متقنة الصنع ترى فيها المعلومات وتدير ما حُظر.
|
||||||
|
|
||||||
|
[:octicons-home-16: الصفحة الرئيسة](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="سياسة الخصوصية" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=التوثيق}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="رمز المصدر" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### كنترول دي
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### نكستديإنإس
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Encrypted DNS Proxies
|
## Encrypted DNS Proxies
|
||||||
|
|
||||||
توفِّر برمجيات التوسُّط بين أنظمة تسمية النطاقات وسيطًا محليًّا [لمحلِّل نظام التسمية غير المعمَّى](advanced/dns-overview.md#unencrypted-dns) لتوجِّه الطلبات له. ويشيع استخدامه في المنصَّات التي لا تدعم [أنظمة تسمية النطاقات المعمَّاة](advanced/dns-overview.md#what-is-encrypted-dns) أصلًا.
|
توفِّر برمجيات التوسُّط بين أنظمة تسمية النطاقات وسيطًا محليًّا [لمحلِّل نظام التسمية غير المعمَّى](advanced/dns-overview.md#unencrypted-dns) لتوجِّه الطلبات له. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ global:
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Self-hosted Solutions
|
## Criteria
|
||||||
|
|
||||||
تتيح الاستضافة الذاتية لنظام تسمية نطاقات التصفية في المنصَّات المتحكَّم بها، مثل أجهزة التلفاز الذكية وغيرها من أجهزة إنترنت الأشياء، وذلك لأن جهة العميل لا تحتاج لأي برمجيات.
|
**عليك التنبُّه لأننا لسنا ذوي صلة بأيٍّ من المشاريع التي نوصي بها**، وزيادةً على [معاييرنا القياسية](about/criteria.md) فقد طوَّرنا مجموعة متطلَّبات تتيح لنا توصية توصيات موضوعية. ينبغي لك الاطِّلاع على هذه القائمة قبل الاختيار منها، وابحث بنفسك لتتيقَّن من أن ما اخترت يناسبك.
|
||||||
|
|
||||||
### AdGuard Home
|
### Minimum Requirements
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [تدنية الأسماء المؤهَّلة](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- يفضِّل دعم [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) أو دعم geo-steering.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
لدى آدجارد هوم واجهة وِب متقنة الصنع ترى فيها المعلومات وتدير ما حُظر.
|
|
||||||
|
|
||||||
[:octicons-home-16: الصفحة الرئيسة](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="سياسة الخصوصية" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=التوثيق}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="رمز المصدر" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
صُمِّم باي-هول ليستضاف في جهاز راسبيري باي، ولكنَّه ليس محدودًا به. لهذه البرمجية واجهة وِب سهلة الاستخدام ترى فيها المعلومات وتدير ما حُظر.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: تخزِّن آدجارد قياسات الأداء المجمَّعة من خوادم أنظمة تسمية نطاقاتهم، وتتضمَّن عدد الطلبات المكتملة لكلِّ خادم، وعدد الطلبات المحظورة، وسرعة معالجة الطلبات. وتخزِّن أيضًا قاعدة بيانات بها النطاقات المطلوبة خلال آخر ٢٤ ساعة. «نحتاج هذه المعلومات لنتحرَّى ونحظر المتتبِّعات والمخاطر الجديدة.» «وكذلك نسجِّل عدد المرات التي تُحظر فيها المتتبِّعات. نحتاج هذه المعلومات لنزيل القواعد القديمة من تصفياتنا.» [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: تخزِّن آدجارد قياسات الأداء المجمَّعة من خوادم أنظمة تسمية نطاقاتهم، وتتضمَّن عدد الطلبات المكتملة لكلِّ خادم، وعدد الطلبات المحظورة، وسرعة معالجة الطلبات. وتخزِّن أيضًا قاعدة بيانات بها النطاقات المطلوبة خلال آخر ٢٤ ساعة. «نحتاج هذه المعلومات لنتحرَّى ونحظر المتتبِّعات والمخاطر الجديدة.» «وكذلك نسجِّل عدد المرات التي تُحظر فيها المتتبِّعات. نحتاج هذه المعلومات لنزيل القواعد القديمة من تصفياتنا.» [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: تجمِّع وتخزِّن كلاودفلير عددًا قليلًا من استعلامات أنظمة تسمية النطاقات المرسلة للمحلِّل ١٫١٫١٫١. لا تسجِّل خدمة المحلِّل ١٫١٫١٫١ بيانات شخصيةً، وغالب ما تسِّجل من بيانات لا تعرِّف الأشخاص تخزَّن مدَّة ٢٥ ساعةً لا أكثر. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: تجمِّع وتخزِّن كلاودفلير عددًا قليلًا من استعلامات أنظمة تسمية النطاقات المرسلة للمحلِّل ١٫١٫١٫١. لا تسجِّل خدمة المحلِّل ١٫١٫١٫١ بيانات شخصيةً، وغالب ما تسِّجل من بيانات لا تعرِّف الأشخاص تخزَّن مدَّة ٢٥ ساعةً لا أكثر. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: تسجِّل كنترول دي البيانات من المحلِّلات المدفوعة التي لها ملفَّات تعريف مخصَّصة فقط. المحلِّلات المجَّانية لا تسجِّل بيانات. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: تسجِّل كنترول دي البيانات من المحلِّلات المدفوعة التي لها ملفَّات تعريف مخصَّصة فقط. المحلِّلات المجَّانية لا تسجِّل بيانات. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: خدمة أنظمة تسمية النطاقات من ملفاد متاحة للمشتركين في خدمة الشبكة الخاصة الافتراضية ولغير المشتركين كذلك. تزعم سياسة خصوصيتهم صريحًا أنهم لا يسجِّلون طلبات أنظمة تسمية النطاقات أبدًا. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: خدمة أنظمة تسمية النطاقات من ملفاد متاحة للمشتركين في خدمة الشبكة الخاصة الافتراضية ولغير المشتركين كذلك. تزعم سياسة خصوصيتهم صريحًا أنهم لا يسجِّلون طلبات أنظمة تسمية النطاقات أبدًا. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: تجمع كواد٩ بعض البيانات لمراقبة المخاطر والاستجابات. ويمكن لتلك البيانات أن تُخلط وتُشارك، وغرض ذلك قد يكون لأبحاث الأمن. لا تجمع كواد٩ ولا تسجِّل عناوين IP أو أيَّ بيانات تصنِّفها معرِّفةً شخصيًّا. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: تجمع كواد٩ بعض البيانات لمراقبة المخاطر والاستجابات. ويمكن لتلك البيانات أن تُخلط وتُشارك، وغرض ذلك قد يكون لأبحاث الأمن. لا تجمع كواد٩ ولا تسجِّل عناوين IP أو أيَّ بيانات تصنِّفها معرِّفةً شخصيًّا. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be
|
|||||||
|
|
||||||
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Native Operating System Support
|
||||||
|
|
||||||
|
#### অ্যান্ড্রয়েড
|
||||||
|
|
||||||
|
Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**.
|
||||||
|
|
||||||
|
#### Apple Devices
|
||||||
|
|
||||||
|
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
||||||
|
|
||||||
|
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## What can an outside party see?
|
## What can an outside party see?
|
||||||
|
|
||||||
In this example we will record what happens when we make a DoH request:
|
In this example we will record what happens when we make a DoH request:
|
||||||
@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a
|
|||||||
|
|
||||||
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
||||||
|
|
||||||
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [
|
|||||||
|
|
||||||
## Recommended Providers
|
## Recommended Providers
|
||||||
|
|
||||||
| DNS Provider | Privacy Policy | Protocols | Logging | ECS | Filtering |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Some[^1] | Yes | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH/3 <br> DoT | Some[^2] | No | Based on personal configuration. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^3] | No | Based on personal configuration. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | No[^4] | No | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^5] | Optional | Based on personal configuration. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^6] | Optional | Based on personal configuration, Malware blocking by default. |
|
|
||||||
|
|
||||||
### Criteria
|
| DNS Provider | Privacy Policy | Protocols | Logging | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | No | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
||||||
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled.
|
|
||||||
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
|
||||||
|
|
||||||
## Native Operating System Support
|
### Pi-hole
|
||||||
|
|
||||||
### অ্যান্ড্রয়েড
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**.
|
{ align=right }
|
||||||
|
|
||||||
### Apple Devices
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### Signed Profiles
|
</details>
|
||||||
|
|
||||||
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Encrypted DNS Proxies
|
## Encrypted DNS Proxies
|
||||||
|
|
||||||
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Self-hosted Solutions
|
## Criteria
|
||||||
|
|
||||||
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||||
|
|
||||||
### AdGuard Home
|
### Minimum Requirements
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be
|
|||||||
|
|
||||||
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Native Operating System Support
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**.
|
||||||
|
|
||||||
|
#### Apple Devices
|
||||||
|
|
||||||
|
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
||||||
|
|
||||||
|
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## What can an outside party see?
|
## What can an outside party see?
|
||||||
|
|
||||||
In this example we will record what happens when we make a DoH request:
|
In this example we will record what happens when we make a DoH request:
|
||||||
@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a
|
|||||||
|
|
||||||
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
||||||
|
|
||||||
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/bn/dns.md
183
i18n/bn/dns.md
@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [
|
|||||||
|
|
||||||
## Recommended Providers
|
## Recommended Providers
|
||||||
|
|
||||||
| DNS Provider | Privacy Policy | Protocols | Logging | ECS | Filtering |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Some[^1] | Yes | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH/3 <br> DoT | Some[^2] | No | Based on personal configuration. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^3] | No | Based on personal configuration. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | No[^4] | No | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^5] | Optional | Based on personal configuration. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^6] | Optional | Based on personal configuration, Malware blocking by default. |
|
|
||||||
|
|
||||||
### Criteria
|
| DNS Provider | Privacy Policy | Protocols | Logging | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | No | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
||||||
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled.
|
|
||||||
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
|
||||||
|
|
||||||
## Native Operating System Support
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**.
|
{ align=right }
|
||||||
|
|
||||||
### Apple Devices
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### Signed Profiles
|
</details>
|
||||||
|
|
||||||
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Encrypted DNS Proxies
|
## Encrypted DNS Proxies
|
||||||
|
|
||||||
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Self-hosted Solutions
|
## Criteria
|
||||||
|
|
||||||
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||||
|
|
||||||
### AdGuard Home
|
### Minimum Requirements
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be
|
|||||||
|
|
||||||
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Native Operating System Support
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**.
|
||||||
|
|
||||||
|
#### Apple Devices
|
||||||
|
|
||||||
|
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
||||||
|
|
||||||
|
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## What can an outside party see?
|
## What can an outside party see?
|
||||||
|
|
||||||
In this example we will record what happens when we make a DoH request:
|
In this example we will record what happens when we make a DoH request:
|
||||||
@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a
|
|||||||
|
|
||||||
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
||||||
|
|
||||||
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/cs/dns.md
183
i18n/cs/dns.md
@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [
|
|||||||
|
|
||||||
## Recommended Providers
|
## Recommended Providers
|
||||||
|
|
||||||
| DNS Provider | Privacy Policy | Protocols | Logging | ECS | Filtering |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Some[^1] | Yes | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH/3 <br> DoT | Some[^2] | Ne | Based on personal configuration. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^3] | Ne | Based on personal configuration. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | No[^4] | Ne | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^5] | Optional | Based on personal configuration. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^6] | Optional | Based on personal configuration, Malware blocking by default. |
|
|
||||||
|
|
||||||
### Criteria
|
| DNS Provider | Privacy Policy | Protocols | Logging | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | Ne | Based on server choice. | [Ne](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | Ne | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Ne | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | Ne | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
||||||
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled.
|
|
||||||
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
|
||||||
|
|
||||||
## Native Operating System Support
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**.
|
{ align=right }
|
||||||
|
|
||||||
### Apple Devices
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### Signed Profiles
|
</details>
|
||||||
|
|
||||||
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Encrypted DNS Proxies
|
## Encrypted DNS Proxies
|
||||||
|
|
||||||
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Self-hosted Solutions
|
## Criteria
|
||||||
|
|
||||||
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||||
|
|
||||||
### AdGuard Home
|
### Minimum Requirements
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ Verschlüsseltes DNS kann sich auf eine Reihe von Protokollen beziehen, von dene
|
|||||||
|
|
||||||
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Native Betriebssystemunterstützung
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9 und höher unterstützen DNS über TLS. Die Einstellungen sind zu finden unter: **Einstellungen** → **Netzwerk & Internet** → **Privates DNS**.
|
||||||
|
|
||||||
|
#### Apple-Geräte
|
||||||
|
|
||||||
|
Die neuesten Versionen von iOS, iPadOS, tvOS und macOS unterstützen sowohl DoT als auch DoH. Beide Protokolle werden nativ über [Konfigurationsprofile](https://support.apple.com/de-de/guide/security/secf6fb9f053/web) oder über die [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings)unterstützt.
|
||||||
|
|
||||||
|
Nach der Installation eines Konfigurationsprofils oder einer Anwendung, die die DNS-Einstellungs-API verwendet, kann die DNS-Konfiguration ausgewählt werden. Wenn ein VPN aktiv ist, verwendet die DNS Auflösung innerhalb des VPN-Tunnels die DNS-Einstellungen des VPN und nicht deine systemweiten Einstellungen.
|
||||||
|
|
||||||
|
Apple bietet keine native Schnittstelle zur Erstellung von Profilen mit verschlüsseltem DNS. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) ist ein inoffizielles Tool zur Erstellung eigener Profile mit verschlüsseltem DNS, diese sind jedoch nicht signiert. Signierte Profile sind zu bevorzugen; das Signieren bestätigt die Herkunft eines Profils und trägt dazu bei, die Integrität der Profile zu gewährleisten. Signierte Konfigurationsprofile erhalten ein grünes "Verifiziert"-Label. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## What can an outside party see?
|
## What can an outside party see?
|
||||||
|
|
||||||
In this example we will record what happens when we make a DoH request:
|
In this example we will record what happens when we make a DoH request:
|
||||||
@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a
|
|||||||
|
|
||||||
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
||||||
|
|
||||||
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/de/dns.md
183
i18n/de/dns.md
@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [
|
|||||||
|
|
||||||
## Empfohlene DNS-Anbieter
|
## Empfohlene DNS-Anbieter
|
||||||
|
|
||||||
| DNS-Anbieter | Datenschutzerklärung | Protokolle | Protokollierung | ECS | Filter |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | --------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Some[^1] | Yes | Based on personal configuration. Die verwendete Filterliste findest du hier. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Klartext <br> DoH/3 <br> DoT | Some[^2] | Nein | Based on personal configuration. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Klartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^3] | Nein | Based on personal configuration. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | Nein[^4] | Nein | Based on personal configuration. Die verwendete Filterliste findest du hier. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Klartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^5] | Optional | Based on personal configuration. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Klartext <br> DoH <br> DoT <br> DNSCrypt | Some[^6] | Optional | Based on personal configuration, Malware blocking by default. |
|
|
||||||
|
|
||||||
### Kriterien
|
| DNS-Anbieter | Datenschutzerklärung | Protokolle | Protokollierung | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filter | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | --------------- | -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Die verwendete Filterliste findest du hier. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | Nein | Based on server choice. | [Nein](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | Nein | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Nein | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | Nein[^4] | Nein | Based on server choice. Die verwendete Filterliste findest du hier. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Bitte beachte, dass wir mit keinem der Projekte, die wir empfehlen, verbunden sind.** Zusätzlich zu unseren [Standardkriterien](about/criteria.md) haben wir eine Reihe klarer Anforderungen entwickelt, die es uns ermöglichen, objektive Empfehlungen zu geben. Wir empfehlen, sich mit dieser Liste vertraut zu machen, bevor sich für ein Projekt entschieden wird und eigenen Nachforschungen anzustellen, um sicherzustellen, dass es die richtige Wahl ist.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Muss [DNSSEC](advanced/dns-overview.md#what-is-dnssec) unterstützen.
|
Eine selbst gehostete DNS-Lösung ist nützlich für die Filterung auf kontrollierten Plattformen wie Smart-TVs und anderen IoT-Geräten, da keine clientseitige Software erforderlich ist.
|
||||||
- [QNAME Minimierung](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Erlaubt es [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) zu deaktivieren.
|
|
||||||
- Bevorzugt [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) Unterstützung oder Geo-Steering-Unterstützung.
|
|
||||||
|
|
||||||
## Native Betriebssystemunterstützung
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 und höher unterstützen DNS über TLS. Die Einstellungen sind zu finden unter: **Einstellungen** → **Netzwerk & Internet** → **Privates DNS**.
|
{ align=right }
|
||||||
|
|
||||||
### Apple-Geräte
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
Die neuesten Versionen von iOS, iPadOS, tvOS und macOS unterstützen sowohl DoT als auch DoH. Beide Protokolle werden nativ über [Konfigurationsprofile](https://support.apple.com/de-de/guide/security/secf6fb9f053/web) oder über die [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings)unterstützt.
|
Pi-hole ist für den Betrieb auf einem Raspberry Pi konzipiert, ist aber nicht auf diese Hardware beschränkt. The software features a friendly web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
Nach der Installation eines Konfigurationsprofils oder einer Anwendung, die die DNS-Einstellungs-API verwendet, kann die DNS-Konfiguration ausgewählt werden. Wenn ein VPN aktiv ist, verwendet die DNS Auflösung innerhalb des VPN-Tunnels die DNS-Einstellungen des VPN und nicht deine systemweiten Einstellungen.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### Signierte Profile
|
</details>
|
||||||
|
|
||||||
Apple bietet keine native Schnittstelle zur Erstellung von Profilen mit verschlüsseltem DNS. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) ist ein inoffizielles Tool zur Erstellung eigener Profile mit verschlüsseltem DNS, diese sind jedoch nicht signiert. Signierte Profile sind zu bevorzugen; das Signieren bestätigt die Herkunft eines Profils und trägt dazu bei, die Integrität der Profile zu gewährleisten. Signierte Konfigurationsprofile erhalten ein grünes "Verifiziert"-Label. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, das viele Linux-Distributionen für ihre DNS Abfragen verwenden, unterstützt noch nicht [DoH](https://github.com/systemd/systemd/issues/8639). Wenn trotzdem DoH verwendent werden soll, muss ein Proxy wie [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) installiert und [konfiguriert](https://wiki.archlinux.org/title/Dnscrypt-proxy) werden, um alle DNS-Anfragen vom System-Resolver entgegenzunehmen und sie über HTTPS weiterzuleiten.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home bietet eine ausgefeilte Weboberfläche, über die Einblicke erhalten und blockierte Inhalte verwalten werden können.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Verschlüsselte DNS-Proxies
|
## Verschlüsselte DNS-Proxies
|
||||||
|
|
||||||
Verschlüsselte DNS-Proxy-Software stellt einen lokalen Proxy für den [unverschlüsselten DNS-](advanced/dns-overview.md#unencrypted-dns) Resolver zur Verfügung. Normalerweise wird es auf Plattformen verwendet, die [verschlüsseltes DNS](advanced/dns-overview.md#what-is-encrypted-dns) nicht unterstützen.
|
Verschlüsselte DNS-Proxy-Software stellt einen lokalen Proxy für den [unverschlüsselten DNS-](advanced/dns-overview.md#unencrypted-dns) Resolver zur Verfügung. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Verschlüsselte DNS-Proxy-Software stellt einen lokalen Proxy für den [unversch
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Selbstgehostete Lösungen
|
## Kriterien
|
||||||
|
|
||||||
Eine selbst gehostete DNS-Lösung ist nützlich für die Filterung auf kontrollierten Plattformen wie Smart-TVs und anderen IoT-Geräten, da keine clientseitige Software erforderlich ist.
|
**Bitte beachte, dass wir mit keinem der Projekte, die wir empfehlen, verbunden sind.** Zusätzlich zu unseren [Standardkriterien](about/criteria.md) haben wir eine Reihe klarer Anforderungen entwickelt, die es uns ermöglichen, objektive Empfehlungen zu geben. Wir empfehlen, sich mit dieser Liste vertraut zu machen, bevor sich für ein Projekt entschieden wird und eigenen Nachforschungen anzustellen, um sicherzustellen, dass es die richtige Wahl ist.
|
||||||
|
|
||||||
### AdGuard Home
|
### Minimum Requirements
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [QNAME Minimierung](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Bevorzugt [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) Unterstützung oder Geo-Steering-Unterstützung.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home bietet eine ausgefeilte Weboberfläche, über die Einblicke erhalten und blockierte Inhalte verwalten werden können.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole ist für den Betrieb auf einem Raspberry Pi konzipiert, ist aber nicht auf diese Hardware beschränkt. The software features a friendly web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be
|
|||||||
|
|
||||||
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Native Operating System Support
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**.
|
||||||
|
|
||||||
|
#### Apple Devices
|
||||||
|
|
||||||
|
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
||||||
|
|
||||||
|
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## What can an outside party see?
|
## What can an outside party see?
|
||||||
|
|
||||||
In this example we will record what happens when we make a DoH request:
|
In this example we will record what happens when we make a DoH request:
|
||||||
@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a
|
|||||||
|
|
||||||
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
||||||
|
|
||||||
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/el/dns.md
183
i18n/el/dns.md
@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [
|
|||||||
|
|
||||||
## Recommended Providers
|
## Recommended Providers
|
||||||
|
|
||||||
| DNS Provider | Privacy Policy | Protocols | Logging | ECS | Filtering |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Some[^1] | Yes | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH/3 <br> DoT | Some[^2] | No | Based on personal configuration. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^3] | No | Based on personal configuration. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | No[^4] | No | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^5] | Optional | Based on personal configuration. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^6] | Optional | Based on personal configuration, Malware blocking by default. |
|
|
||||||
|
|
||||||
### Criteria
|
| DNS Provider | Privacy Policy | Protocols | Logging | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | No | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
||||||
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled.
|
|
||||||
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
|
||||||
|
|
||||||
## Native Operating System Support
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**.
|
{ align=right }
|
||||||
|
|
||||||
### Apple Devices
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### Signed Profiles
|
</details>
|
||||||
|
|
||||||
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Encrypted DNS Proxies
|
## Encrypted DNS Proxies
|
||||||
|
|
||||||
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Self-hosted Solutions
|
## Criteria
|
||||||
|
|
||||||
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||||
|
|
||||||
### AdGuard Home
|
### Minimum Requirements
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be
|
|||||||
|
|
||||||
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Native Operating System Support
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**.
|
||||||
|
|
||||||
|
#### Apple Devices
|
||||||
|
|
||||||
|
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
||||||
|
|
||||||
|
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## What can an outside party see?
|
## What can an outside party see?
|
||||||
|
|
||||||
In this example we will record what happens when we make a DoH request:
|
In this example we will record what happens when we make a DoH request:
|
||||||
@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a
|
|||||||
|
|
||||||
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
||||||
|
|
||||||
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/eo/dns.md
183
i18n/eo/dns.md
@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [
|
|||||||
|
|
||||||
## Recommended Providers
|
## Recommended Providers
|
||||||
|
|
||||||
| DNS Provider | Privacy Policy | Protocols | Logging | ECS | Filtering |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Some[^1] | Yes | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH/3 <br> DoT | Some[^2] | No | Based on personal configuration. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^3] | No | Based on personal configuration. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | No[^4] | No | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^5] | Optional | Based on personal configuration. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^6] | Optional | Based on personal configuration, Malware blocking by default. |
|
|
||||||
|
|
||||||
### Criteria
|
| DNS Provider | Privacy Policy | Protocols | Logging | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | No | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
||||||
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled.
|
|
||||||
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
|
||||||
|
|
||||||
## Native Operating System Support
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**.
|
{ align=right }
|
||||||
|
|
||||||
### Apple Devices
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### Signed Profiles
|
</details>
|
||||||
|
|
||||||
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Encrypted DNS Proxies
|
## Encrypted DNS Proxies
|
||||||
|
|
||||||
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Self-hosted Solutions
|
## Criteria
|
||||||
|
|
||||||
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||||
|
|
||||||
### AdGuard Home
|
### Minimum Requirements
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ DNS encriptado puede referirse a uno de un número de protocolos, los más comun
|
|||||||
|
|
||||||
La implementación nativa de DoH apareció en iOS 14, macOS 11, Microsoft Windows y Android 13 (sin embargo, no estará habilitada [por defecto](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). El soporte general de los escritorios de Linux está a la espera de la [implementación](https://github.com/systemd/systemd/issues/8639) de systemd por lo que [la instalación de software de terceros sigue siendo necesaria](../dns.md#linux).
|
La implementación nativa de DoH apareció en iOS 14, macOS 11, Microsoft Windows y Android 13 (sin embargo, no estará habilitada [por defecto](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). El soporte general de los escritorios de Linux está a la espera de la [implementación](https://github.com/systemd/systemd/issues/8639) de systemd por lo que [la instalación de software de terceros sigue siendo necesaria](../dns.md#linux).
|
||||||
|
|
||||||
|
### Compatibilidad con Sistemas Operativos Nativos
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9 y superiores soportan DNS sobre TLS. Los ajustes se pueden encontrar en: **Configuración** → **Red & Internet** → **DNS privado**.
|
||||||
|
|
||||||
|
#### Dispositivos Apple
|
||||||
|
|
||||||
|
Las últimas versiones de iOS, iPadOS, tvOS y macOS, soportan tanto DoT como DoH. Ambos protocolos son soportados nativamente a través de [configuración de perfiles ](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) o a través de la [API de configuración DNS](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
Tras la instalación de un perfil de configuración o de una aplicación que utilice la API de configuración de DNS, se puede seleccionar la configuración de DNS. Si una VPN está activa, la resolución dentro del túnel VPN utilizará la configuración DNS de la VPN y no la configuración de todo el sistema.
|
||||||
|
|
||||||
|
Apple no proporciona una interfaz nativa para crear perfiles DNS encriptados. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) es una herramienta no oficial para crear tus propios perfiles DNS encriptados, aunque no estarán firmados. Son preferibles los perfiles firmados; la firma valida el origen de un perfil y ayuda a garantizar su integridad. Los perfiles de configuración firmados reciben la etiqueta verde de "Verificado". Para más información sobre la firma de código, consulte [Acerca de la firma de código](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## ¿Qué puede ver un tercero?
|
## ¿Qué puede ver un tercero?
|
||||||
|
|
||||||
En este ejemplo registraremos lo que sucede cuando hacemos una solicitud de DoH:
|
En este ejemplo registraremos lo que sucede cuando hacemos una solicitud de DoH:
|
||||||
@ -318,4 +336,27 @@ La [Subred de Cliente EDNS](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) es
|
|||||||
|
|
||||||
Su objetivo es "acelerar" la entrega de datos dando al cliente una respuesta que pertenece a un servidor que está cerca de él, como una [red de distribución de contenidos](https://es.wikipedia.org/wiki/Red_de_distribuci%C3%B3n_de_contenidos), que se utilizan a menudo en la transmisión de vídeo y el servicio de aplicaciones web de JavaScript.
|
Su objetivo es "acelerar" la entrega de datos dando al cliente una respuesta que pertenece a un servidor que está cerca de él, como una [red de distribución de contenidos](https://es.wikipedia.org/wiki/Red_de_distribuci%C3%B3n_de_contenidos), que se utilizan a menudo en la transmisión de vídeo y el servicio de aplicaciones web de JavaScript.
|
||||||
|
|
||||||
Esta característica tiene un coste de privacidad, ya que indica al servidor DNS cierta información sobre la ubicación del cliente.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/es/dns.md
183
i18n/es/dns.md
@ -15,50 +15,126 @@ Un DNS encriptado con servidores de terceros solo debe utilizarse para evitar el
|
|||||||
|
|
||||||
## Proveedores Recomendados
|
## Proveedores Recomendados
|
||||||
|
|
||||||
| Proveedor de DNS | Política de Privacidad | Protocolos | Registro | ECS | Filtrado |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Algún[^1] | Sí | Basado en la configuración personal. La lista de filtros siendo utilizada se puede encontrar aquí. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH/3 <br> DoT | Algún[^2] | No | Basado en la configuración personal. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Opcional[^3] | No | Basado en la configuración personal. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | No[^4] | No | Basado en la configuración personal. La lista de filtro que se está utilizando se puede encontrar aquí. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Opcional [^5] | Opcional | Basado en la configuración personal. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Texto claro <br> DoH <br> DoT <br> DNSCrypt | Algún[^6] | Opcional | Basado en la configuración personal, bloqueo de malware por defecto. |
|
|
||||||
|
|
||||||
### Criterios
|
| Proveedor de DNS | Política de Privacidad | Protocolos | Registro | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtrado | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Algún[^1] | Anonymized | Based on server choice. La lista de filtros siendo utilizada se puede encontrar aquí. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Sí](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Algún[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Opcional[^3] | No | Based on server choice. | [Sí](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Sí](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. La lista de filtro que se está utilizando se puede encontrar aquí. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Sí](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Opcional | Based on server choice, malware blocking by default. | [Sí](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Ten en cuenta que no estamos afiliados con ninguno de los proyectos que recomendamos.** Además de [nuestros criterios estándar](about/criteria.md), hemos desarrollado un conjunto claro de requisitos que nos permiten proporcionar recomendaciones objetivas. Te sugerimos que te familiarices con esta lista antes de elegir usar un proyecto, y que lleves a cabo tu propia investigación para asegurarte de que es la elección correcta para ti.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Debe soportar [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
Una solución DNS autoalojada es útil para proporcionar filtrado en plataformas controladas, como Smart TV y otros dispositivos IoT, ya que no se necesita software del lado del cliente.
|
||||||
- [Minimización QNAME](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Permitir que [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) sea desactivado.
|
|
||||||
- Preferir soporte [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) o soporte de dirección geográfica.
|
|
||||||
|
|
||||||
## Compatibilidad con Sistemas Operativos Nativos
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 y superiores soportan DNS sobre TLS. Los ajustes se pueden encontrar en: **Configuración** → **Red & Internet** → **DNS privado**.
|
{ align=right }
|
||||||
|
|
||||||
### Dispositivos Apple
|
**Pi-hole** es un [DNS-sinkhole](https://es.wikipedia.org/wiki/DNS_sinkhole) de código abierto que utiliza [filtrado DNS](https://cloudflare.com/learning/access-management/what-is-dns-filtering) para bloquear contenidos web no deseados, como la publicidad.
|
||||||
|
|
||||||
Las últimas versiones de iOS, iPadOS, tvOS y macOS, soportan tanto DoT como DoH. Ambos protocolos son soportados nativamente a través de [configuración de perfiles ](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) o a través de la [API de configuración DNS](https://developer.apple.com/documentation/networkextension/dns_settings).
|
Pi-hole está diseñado para alojarse en una Raspberry Pi, pero no se limita a dicho hardware. El software cuenta con una interfaz web fácil de usar para ver los datos y gestionar los contenidos bloqueados.
|
||||||
|
|
||||||
Tras la instalación de un perfil de configuración o de una aplicación que utilice la API de configuración de DNS, se puede seleccionar la configuración de DNS. Si una VPN está activa, la resolución dentro del túnel VPN utilizará la configuración DNS de la VPN y no la configuración de todo el sistema.
|
[:octicons-home-16: Página Principal](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Política de Privacidad" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentación}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Código Fuente" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribuir }
|
||||||
|
|
||||||
#### Perfiles Firmados
|
</details>
|
||||||
|
|
||||||
Apple no proporciona una interfaz nativa para crear perfiles DNS encriptados. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) es una herramienta no oficial para crear tus propios perfiles DNS encriptados, aunque no estarán firmados. Son preferibles los perfiles firmados; la firma valida el origen de un perfil y ayuda a garantizar su integridad. Los perfiles de configuración firmados reciben la etiqueta verde de "Verificado". Para más información sobre la firma de código, consulte [Acerca de la firma de código](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Perfiles firmados** son ofrecidos por [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io) y [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Detalles</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, que muchas distribuciones Linux utilizan para realizar sus búsquedas DNS, todavía no [soporta DoH](https://github.com/systemd/systemd/issues/8639). Si quieres usar DoH, necesitarás instalar un proxy como [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) y [configurarlo](https://wiki. rchlinux.org/title/Dnscrypt-proxy) para obtener todas las consultas DNS de la resolución del sistema y reenviarlas sobre HTTPS.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** es un [DNS-sinkhole](https://es.wikipedia.org/wiki/DNS_sinkhole) de código abierto que utiliza [filtrado DNS](https://cloudflare.com/learning/access-management/what-is-dns-filtering) para bloquear contenidos web no deseados, como la publicidad.
|
||||||
|
|
||||||
|
AdGuard Home cuenta con una interfaz web pulida para ver información y gestionar el contenido bloqueado.
|
||||||
|
|
||||||
|
[:octicons-home-16: Página de Inicio](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Politica de privacidad" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentación}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Código fuente" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
Cuando se utiliza con una cuenta, NextDNS habilitará las funciones de información y registro de forma predeterminada (ya que algunas funciones lo requieren). Puedes elegir los tiempos de retención y las ubicaciones de almacenamiento de los registros que desees conservar.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Proxies DNS Cifrados
|
## Proxies DNS Cifrados
|
||||||
|
|
||||||
El software de proxy de DNS encriptado proporciona un proxy local para que el resolver DNS [no encriptado](advanced/dns-overview.md#unencrypted-dns) lo reenvíe. Típicamente se utiliza en plataformas que no soportan de forma nativa el [DNS encriptado](advanced/dns-overview.md#what-is-encrypted-dns).
|
El software de proxy de DNS encriptado proporciona un proxy local para que el resolver DNS [no encriptado](advanced/dns-overview.md#unencrypted-dns) lo reenvíe. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ El software de proxy de DNS encriptado proporciona un proxy local para que el re
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Soluciones Autoalojadas
|
## Criterios
|
||||||
|
|
||||||
Una solución DNS autoalojada es útil para proporcionar filtrado en plataformas controladas, como Smart TV y otros dispositivos IoT, ya que no se necesita software del lado del cliente.
|
**Ten en cuenta que no estamos afiliados con ninguno de los proyectos que recomendamos.** Además de [nuestros criterios estándar](about/criteria.md), hemos desarrollado un conjunto claro de requisitos que nos permiten proporcionar recomendaciones objetivas. Te sugerimos que te familiarices con esta lista antes de elegir usar un proyecto, y que lleves a cabo tu propia investigación para asegurarte de que es la elección correcta para ti.
|
||||||
|
|
||||||
### AdGuard Home
|
### Requisitos Mínimos
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [Minimización QNAME](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Preferir soporte [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) o soporte de dirección geográfica.
|
||||||
**AdGuard Home** es un [DNS-sinkhole](https://es.wikipedia.org/wiki/DNS_sinkhole) de código abierto que utiliza [filtrado DNS](https://cloudflare.com/learning/access-management/what-is-dns-filtering) para bloquear contenidos web no deseados, como la publicidad.
|
|
||||||
|
|
||||||
AdGuard Home cuenta con una interfaz web pulida para ver información y gestionar el contenido bloqueado.
|
|
||||||
|
|
||||||
[:octicons-home-16: Página de Inicio](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Politica de privacidad" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentación}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Código fuente" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** es un [DNS-sinkhole](https://es.wikipedia.org/wiki/DNS_sinkhole) de código abierto que utiliza [filtrado DNS](https://cloudflare.com/learning/access-management/what-is-dns-filtering) para bloquear contenidos web no deseados, como la publicidad.
|
|
||||||
|
|
||||||
Pi-hole está diseñado para alojarse en una Raspberry Pi, pero no se limita a dicho hardware. El software cuenta con una interfaz web fácil de usar para ver los datos y gestionar los contenidos bloqueados.
|
|
||||||
|
|
||||||
[:octicons-home-16: Página Principal](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Política de Privacidad" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentación}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Código Fuente" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribuir }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard almacena métricas de rendimiento agregadas de sus servidores DNS, es decir, el número de solicitudes completas a un servidor en particular, el número de solicitudes bloqueadas, y la velocidad de procesamiento de solicitudes. También guardan y almacenan la base de datos de dominios solicitados dentro de las últimas 24 horas. "Necesitamos esta información para identificar y bloquear nuevos rastreadores y amenazas". "También registramos cuántas veces se ha bloqueado tal o cual rastreador. Necesitamos esta información para eliminar normas obsoletas de nuestros filtros". [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard almacena métricas de rendimiento agregadas de sus servidores DNS, es decir, el número de solicitudes completas a un servidor en particular, el número de solicitudes bloqueadas, y la velocidad de procesamiento de solicitudes. También guardan y almacenan la base de datos de dominios solicitados dentro de las últimas 24 horas. "Necesitamos esta información para identificar y bloquear nuevos rastreadores y amenazas". "También registramos cuántas veces se ha bloqueado tal o cual rastreador. Necesitamos esta información para eliminar normas obsoletas de nuestros filtros". [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare recopila y almacena únicamente los datos de consulta DNS limitados que se envían al resolver 1.1.1.1. El servicio de resolución 1.1.1.1 no registra datos personales, y el grueso de los limitados datos de consulta no identificables personalmente se almacena solo durante 25 horas. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare recopila y almacena únicamente los datos de consulta DNS limitados que se envían al resolver 1.1.1.1. El servicio de resolución 1.1.1.1 no registra datos personales, y el grueso de los limitados datos de consulta no identificables personalmente se almacena solo durante 25 horas. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: El Control D solo registra los resolvers Premium con perfiles DNS personalizados. Los resolvers libres no registran datos. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: El Control D solo registra los resolvers Premium con perfiles DNS personalizados. Los resolvers libres no registran datos. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: El servicio DNS de Mullvad está disponible tanto para suscriptores como para no suscriptores de Mullvad VPN. Su política de privacidad afirma explícitamente que no registran solicitudes DNS de ninguna manera. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: El servicio DNS de Mullvad está disponible tanto para suscriptores como para no suscriptores de Mullvad VPN. Su política de privacidad afirma explícitamente que no registran solicitudes DNS de ninguna manera. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: Cuando se utiliza con una cuenta, NextDNS habilitará las funciones de información y registro de forma predeterminada (ya que algunas funciones lo requieren). Puedes elegir los tiempos de retención y las ubicaciones de almacenamiento de los registros que desees conservar. Si se utiliza sin una cuenta, no se registra ningún dato. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 recopila algunos datos con fines de monitorización y respuesta ante amenazas. Esos datos pueden remezclarse y compartirse, por ejemplo, con fines de investigación sobre seguridad. Quad9 no colecciona ni registra direcciones IP ni otros datos que consideren personalmente identificables. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 recopila algunos datos con fines de monitorización y respuesta ante amenazas. Esos datos pueden remezclarse y compartirse, por ejemplo, con fines de investigación sobre seguridad. Quad9 no colecciona ni registra direcciones IP ni otros datos que consideren personalmente identificables. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be
|
|||||||
|
|
||||||
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Native Operating System Support
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**.
|
||||||
|
|
||||||
|
#### Apple Devices
|
||||||
|
|
||||||
|
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
||||||
|
|
||||||
|
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## What can an outside party see?
|
## What can an outside party see?
|
||||||
|
|
||||||
In this example we will record what happens when we make a DoH request:
|
In this example we will record what happens when we make a DoH request:
|
||||||
@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a
|
|||||||
|
|
||||||
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
||||||
|
|
||||||
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/fa/dns.md
183
i18n/fa/dns.md
@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [
|
|||||||
|
|
||||||
## Recommended Providers
|
## Recommended Providers
|
||||||
|
|
||||||
| DNS Provider | Privacy Policy | Protocols | Logging | ECS | Filtering |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Some[^1] | Yes | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH/3 <br> DoT | Some[^2] | No | Based on personal configuration. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^3] | No | Based on personal configuration. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | No[^4] | No | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^5] | Optional | Based on personal configuration. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^6] | Optional | Based on personal configuration, Malware blocking by default. |
|
|
||||||
|
|
||||||
### Criteria
|
| DNS Provider | Privacy Policy | Protocols | Logging | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | No | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
||||||
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled.
|
|
||||||
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
|
||||||
|
|
||||||
## Native Operating System Support
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**.
|
{ align=right }
|
||||||
|
|
||||||
### Apple Devices
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### Signed Profiles
|
</details>
|
||||||
|
|
||||||
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Encrypted DNS Proxies
|
## Encrypted DNS Proxies
|
||||||
|
|
||||||
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Self-hosted Solutions
|
## Criteria
|
||||||
|
|
||||||
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||||
|
|
||||||
### AdGuard Home
|
### Minimum Requirements
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ Un DNS chiffré peut faire référence à un certain nombre de protocoles, les p
|
|||||||
|
|
||||||
L'implémentation native de DoH est apparue dans iOS 14, macOS 11, Microsoft Windows et Android 13 (cependant, elle ne sera pas activée [par défaut](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). Sous Linux la prise en charge sera assurée par [l'implémentation](https://github.com/systemd/systemd/issues/8639) dans systemd donc [l'installation de logiciels tiers est encore nécessaire](../dns.md#encrypted-dns-proxies).
|
L'implémentation native de DoH est apparue dans iOS 14, macOS 11, Microsoft Windows et Android 13 (cependant, elle ne sera pas activée [par défaut](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). Sous Linux la prise en charge sera assurée par [l'implémentation](https://github.com/systemd/systemd/issues/8639) dans systemd donc [l'installation de logiciels tiers est encore nécessaire](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Prise en charge native des systèmes d'exploitation
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9 et supérieur prennent en charge DNS via TLS. Les paramètres peuvent être trouvés dans : **Paramètres** → **Réseau & Internet** → **DNS Privé**.
|
||||||
|
|
||||||
|
#### Appareils Apple
|
||||||
|
|
||||||
|
Les dernières versions d'iOS, iPadOS, tvOS et macOS prennent en charge à la fois DoT et DoH. Les deux protocoles sont pris en charge nativement par l'intermédiaire des [profils de configuration](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) ou par l'intermédiaire de [l'API de Paramètres DNS](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
Après l'installation d'un profil de configuration ou d'une application qui utilise l'API des Paramètres DNS, la configuration DNS peut être sélectionnée. Si un VPN est actif, la résolution au sein du tunnel VPN utilisera les paramètres DNS du VPN et non les paramètres de votre système.
|
||||||
|
|
||||||
|
Apple ne fournit pas d'interface native pour la création de profils DNS chiffrés. Le [créateur de profil DNS Sécurisé](https://dns.notjakob.com/tool.html) est un outil non officiel permettant de créer vos propres profils DNS chiffrés, mais ils ne seront pas signés. Les profils signés sont préférables ; la signature valide l'origine d'un profil et contribue à garantir l'intégrité des profils. Un label vert "Vérifié" est attribué aux profils de configuration signés. Pour plus d'informations sur la signature de code, voir [A propos de la signature de code](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## Que peut voir un tiers ?
|
## Que peut voir un tiers ?
|
||||||
|
|
||||||
Dans cet exemple, nous allons enregistrer ce qui se passe lorsque nous faisons une requête DoH :
|
Dans cet exemple, nous allons enregistrer ce qui se passe lorsque nous faisons une requête DoH :
|
||||||
@ -318,4 +336,27 @@ Le [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) est un
|
|||||||
|
|
||||||
Il est destiné à "accélérer" la transmission des données en donnant au client une réponse qui appartient à un serveur proche de lui, comme un [réseau de diffusion de contenu](https://fr.wikipedia.org/wiki/Réseau_de_diffusion_de_contenu), souvent utilisé pour la diffusion de vidéos en continu et pour servir des applications Web JavaScript.
|
Il est destiné à "accélérer" la transmission des données en donnant au client une réponse qui appartient à un serveur proche de lui, comme un [réseau de diffusion de contenu](https://fr.wikipedia.org/wiki/Réseau_de_diffusion_de_contenu), souvent utilisé pour la diffusion de vidéos en continu et pour servir des applications Web JavaScript.
|
||||||
|
|
||||||
Cette fonction a un coût en termes de confidentialité, car elle fournit au serveur DNS des informations sur la localisation du client.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/fr/dns.md
183
i18n/fr/dns.md
@ -15,50 +15,126 @@ Les DNS chiffrés avec des serveurs tiers ne doivent être utilisés que pour co
|
|||||||
|
|
||||||
## Fournisseurs recommandés
|
## Fournisseurs recommandés
|
||||||
|
|
||||||
| Fournisseur DNS | Politique de confidentialité | Protocoles | Journalisation | ECS | Filtrage |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | --------------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Un peu[^1] | Oui | En fonction de la configuration personnelle. La liste des filtres utilisés peut être consultée ici. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH <br> DoT | Un peu[^2] | Non | En fonction de la configuration personnelle. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt <br> DoQ <br> DoH3 | Optionnelle[^3] | Non | En fonction de la configuration personnelle. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | Aucune[^4] | Non | En fonction de la configuration personnelle. La liste des filtres utilisés peut être consultée ici. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt <br> DoQ <br> DoH3 | Optionnelle[^5] | Optionnel | En fonction de la configuration personnelle. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Un peu[^6] | Optionnel | En fonction de la configuration personnelle, blocage des logiciels malveillants par défaut. |
|
|
||||||
|
|
||||||
### Critères
|
| Fournisseur DNS | Politique de confidentialité | Protocoles | Journalisation | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtrage | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | --------------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Un peu[^1] | Anonymized | Based on server choice. La liste des filtres utilisés peut être consultée ici. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Oui](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Un peu[^2] | Non | Based on server choice. | [Non](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optionnelle[^3] | Non | Based on server choice. | [Oui](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Non | Anonymized | Based on server choice. | [Oui](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | Aucune[^4] | Non | Based on server choice. La liste des filtres utilisés peut être consultée ici. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Oui](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optionnel | Based on server choice, malware blocking by default. | [Oui](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Veuillez noter que nous ne sommes affiliés à aucun des projets que nous recommandons.** En plus de [nos critères de base](about/criteria.md), nous avons développé un ensemble d'exigences claires pour nous permettre de fournir des recommandations objectives. Nous vous suggérons de vous familiariser avec cette liste avant de choisir d'utiliser un projet, et de mener vos propres recherches pour vous assurer que c'est le bon choix pour vous.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Doit supporter [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
Une solution DNS auto-hébergée est utile pour assurer le filtrage sur les plateformes contrôlées, telles que les téléviseurs intelligents et autres appareils IoT, car aucun logiciel côté client n'est nécessaire.
|
||||||
- [Minimisation QNAME](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Permettre la désactivation de [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs)
|
|
||||||
- Doit préférer la prise en charge [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) ou geo-steering.
|
|
||||||
|
|
||||||
## Prise en charge native des systèmes d'exploitation
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 et supérieur prennent en charge DNS via TLS. Les paramètres peuvent être trouvés dans : **Paramètres** → **Réseau & Internet** → **DNS Privé**.
|
{ align=right }
|
||||||
|
|
||||||
### Appareils Apple
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
Les dernières versions d'iOS, iPadOS, tvOS et macOS prennent en charge à la fois DoT et DoH. Les deux protocoles sont pris en charge nativement par l'intermédiaire des [profils de configuration](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) ou par l'intermédiaire de [l'API de Paramètres DNS](https://developer.apple.com/documentation/networkextension/dns_settings).
|
Pi-hole est conçu pour être hébergé sur un Raspberry Pi, mais il n'est pas limité à ce type de matériel. Le logiciel est doté d'une interface web conviviale permettant de visualiser et de gérer les contenus bloqués.
|
||||||
|
|
||||||
Après l'installation d'un profil de configuration ou d'une application qui utilise l'API des Paramètres DNS, la configuration DNS peut être sélectionnée. Si un VPN est actif, la résolution au sein du tunnel VPN utilisera les paramètres DNS du VPN et non les paramètres de votre système.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### Profils signés
|
</details>
|
||||||
|
|
||||||
Apple ne fournit pas d'interface native pour la création de profils DNS chiffrés. Le [créateur de profil DNS Sécurisé](https://dns.notjakob.com/tool.html) est un outil non officiel permettant de créer vos propres profils DNS chiffrés, mais ils ne seront pas signés. Les profils signés sont préférables ; la signature valide l'origine d'un profil et contribue à garantir l'intégrité des profils. Un label vert "Vérifié" est attribué aux profils de configuration signés. Pour plus d'informations sur la signature de code, voir [A propos de la signature de code](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, que de nombreuses distributions Linux utilisent pour effectuer leurs recherches DNS, ne [supporte pas encore DoH](https://github.com/systemd/systemd/issues/8639). Si vous voulez utiliser DoH, vous devez installer un proxy comme [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) et [le configurer](https://wiki.archlinux.org/title/Dnscrypt-proxy) pour prendre toutes les requêtes DNS du résolveur de votre système et les transmettre via HTTPS.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home est doté d'une interface web conviviale qui permet de visualiser et de gérer le contenu bloqué.
|
||||||
|
|
||||||
|
[:octicons-home-16: Page d'accueil](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Politique de confidentialité" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Code source" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Proxys DNS chiffrés
|
## Proxys DNS chiffrés
|
||||||
|
|
||||||
Un logiciel de proxy DNS chiffré fourni un proxy local vers lequel le résolveur [DNS non chiffré](advanced/dns-overview.md#unencrypted-dns) doit rediriger. Il est généralement utilisé sur les plates-formes qui ne supportent pas nativement les [DNS chiffrés](advanced/dns-overview.md#what-is-encrypted-dns).
|
Un logiciel de proxy DNS chiffré fourni un proxy local vers lequel le résolveur [DNS non chiffré](advanced/dns-overview.md#unencrypted-dns) doit rediriger. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Un logiciel de proxy DNS chiffré fourni un proxy local vers lequel le résolveu
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Solutions auto-hébergées
|
## Critères
|
||||||
|
|
||||||
Une solution DNS auto-hébergée est utile pour assurer le filtrage sur les plateformes contrôlées, telles que les téléviseurs intelligents et autres appareils IoT, car aucun logiciel côté client n'est nécessaire.
|
**Veuillez noter que nous ne sommes affiliés à aucun des projets que nous recommandons.** En plus de [nos critères de base](about/criteria.md), nous avons développé un ensemble d'exigences claires pour nous permettre de fournir des recommandations objectives. Nous vous suggérons de vous familiariser avec cette liste avant de choisir d'utiliser un projet, et de mener vos propres recherches pour vous assurer que c'est le bon choix pour vous.
|
||||||
|
|
||||||
### AdGuard Home
|
### Exigences minimales
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [Minimisation QNAME](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Doit préférer la prise en charge [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) ou geo-steering.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home est doté d'une interface web conviviale qui permet de visualiser et de gérer le contenu bloqué.
|
|
||||||
|
|
||||||
[:octicons-home-16: Page d'accueil](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Politique de confidentialité" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Code source" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole est conçu pour être hébergé sur un Raspberry Pi, mais il n'est pas limité à ce type de matériel. Le logiciel est doté d'une interface web conviviale permettant de visualiser et de gérer les contenus bloqués.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard stocke des mesures de performance agrégées de ses serveurs DNS, à savoir le nombre de demandes complètes adressées à un serveur particulier, le nombre de demandes bloquées et la vitesse de traitement des demandes. Ils conservent et stockent également la base de données des domaines demandés dans les dernières 24 heures. "Nous avons besoin de ces informations pour identifier et bloquer les nouveaux traqueurs et menaces." "Nous enregistrons également le nombre de fois où tel ou tel traqueur a été bloqué. Nous avons besoin de ces informations pour supprimer les règles obsolètes de nos filtres." [https://adguard.com/fr/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard stocke des mesures de performance agrégées de ses serveurs DNS, à savoir le nombre de demandes complètes adressées à un serveur particulier, le nombre de demandes bloquées et la vitesse de traitement des demandes. Ils conservent et stockent également la base de données des domaines demandés dans les dernières 24 heures. "Nous avons besoin de ces informations pour identifier et bloquer les nouveaux traqueurs et menaces." "Nous enregistrons également le nombre de fois où tel ou tel traqueur a été bloqué. Nous avons besoin de ces informations pour supprimer les règles obsolètes de nos filtres." [https://adguard.com/fr/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare ne collecte et ne stocke que les données limitées des requêtes DNS qui sont envoyées au résolveur 1.1.1.1. Le service de résolution 1.1.1.1 n'enregistre pas de données personnelles, et la majeure partie des données de requête limitées et non personnellement identifiables n'est stockée que pendant 25 heures. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare ne collecte et ne stocke que les données limitées des requêtes DNS qui sont envoyées au résolveur 1.1.1.1. Le service de résolution 1.1.1.1 n'enregistre pas de données personnelles, et la majeure partie des données de requête limitées et non personnellement identifiables n'est stockée que pendant 25 heures. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D n'enregistre que les résolveurs Premium avec des profils DNS personnalisés. Les résolveurs libres n'enregistrent pas de données. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D n'enregistre que les résolveurs Premium avec des profils DNS personnalisés. Les résolveurs libres n'enregistrent pas de données. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: Le service DNS de Mullvad est disponible à la fois pour les abonnés et les non-abonnés de Mullvad VPN. Leur politique de confidentialité affirme explicitement qu'ils n'enregistrent pas les requêtes DNS de quelque manière que ce soit. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: Le service DNS de Mullvad est disponible à la fois pour les abonnés et les non-abonnés de Mullvad VPN. Leur politique de confidentialité affirme explicitement qu'ils n'enregistrent pas les requêtes DNS de quelque manière que ce soit. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 recueille certaines données à des fins de surveillance et de réponse aux menaces. Ces données peuvent ensuite être remélangées et partagées, par exemple à des fins de recherche sur la sécurité. Quad9 ne collecte ni n'enregistre les adresses IP ou d'autres données qu'elle juge personnellement identifiables. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 recueille certaines données à des fins de surveillance et de réponse aux menaces. Ces données peuvent ensuite être remélangées et partagées, par exemple à des fins de recherche sur la sécurité. Quad9 ne collecte ni n'enregistre les adresses IP ou d'autres données qu'elle juge personnellement identifiables. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ DNS מוצפן יכול להתייחס לאחד ממספר פרוטוקולים,
|
|||||||
|
|
||||||
יישום מקורי של DoH הופיע ב-iOS 14, macOS 11, Microsoft Windows ו-אנדרואיד 13 (עם זאת, הוא לא יופעל [>כברירת מחדל](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). תמיכת שולחן העבודה הכללית של לינוקס ממתינה ל[יישום](https://github.com/systemd/systemd/issues/8639) של systemd כך ש[עדיין נדרשת התקנת תוכנת צד שלישי](../dns.md#encrypted-dns-proxies).
|
יישום מקורי של DoH הופיע ב-iOS 14, macOS 11, Microsoft Windows ו-אנדרואיד 13 (עם זאת, הוא לא יופעל [>כברירת מחדל](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). תמיכת שולחן העבודה הכללית של לינוקס ממתינה ל[יישום](https://github.com/systemd/systemd/issues/8639) של systemd כך ש[עדיין נדרשת התקנת תוכנת צד שלישי](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### תמיכה במערכת הפעלה מקומית
|
||||||
|
|
||||||
|
#### אנדרואיד
|
||||||
|
|
||||||
|
אנדרואיד 9 ומעלה תומכת ב-DNS דרך TLS. ניתן למצוא את ההגדרות ב: **הגדרות** → **רשת & אינטרנט** → **פרטי DNS**.
|
||||||
|
|
||||||
|
#### מוצרי Apple
|
||||||
|
|
||||||
|
הגרסאות האחרונות של iOS, iPadOS, tvOS ו-macOS, תומכות הן ב-DoT והן ב-DoH. שני הפרוטוקולים נתמכים באופן מקורי באמצעות [פרופילי תצורה](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) או דרך [ממשק API להגדרות DNS](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
לאחר התקנה של פרופיל תצורה או אפליקציה המשתמשת ב-API של הגדרות DNS, ניתן לבחור את תצורת ה-DNS. אם VPN פעיל, הרזולוציה בתוך מנהרת ה-VPN תשתמש בהגדרות ה-DNS של ה-VPN ולא בהגדרות כלל המערכת שלך.
|
||||||
|
|
||||||
|
Apple אינה מספקת ממשק מקורי ליצירת פרופילי DNS מוצפנים. [יוצר פרופיל DNS מאובטח](https://dns.notjakob.com/tool.html) הוא כלי לא רשמי ליצירת פרופילי DNS מוצפנים משלך, אולם הם לא ייחתמו. פרופילים חתומים מועדפים; החתימה מאמתת את מקור הפרופיל ומסייעת להבטיח את שלמות הפרופילים. תווית "מאומת" ירוקה ניתנת לפרופילי תצורה חתומים. לקבלת מידע נוסף על חתימת קוד, ראה [אודות חתימת קוד](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### לינוקס
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## מה יכול גורם חיצוני לראות?
|
## מה יכול גורם חיצוני לראות?
|
||||||
|
|
||||||
בדוגמה זו נתעד מה קורה כאשר אנו מבקשים בקשת DoH:
|
בדוגמה זו נתעד מה קורה כאשר אנו מבקשים בקשת DoH:
|
||||||
@ -308,7 +326,7 @@ With "QNAME minimization," your DNS resolver now only asks for just enough infor
|
|||||||
| Root server | What's the nameserver for .net? | *Provides .net's server* |
|
| Root server | What's the nameserver for .net? | *Provides .net's server* |
|
||||||
| .net's server | What's the nameserver for privacyguides.net? | *Provides Privacy Guides' server* |
|
| .net's server | What's the nameserver for privacyguides.net? | *Provides Privacy Guides' server* |
|
||||||
| Privacy Guides' server | What's the nameserver for discuss.privacyguides.net? | השרת הזה! |
|
| Privacy Guides' server | What's the nameserver for discuss.privacyguides.net? | השרת הזה! |
|
||||||
| השרת של Privacy Guides | מה ה-IP של discuss.privacyguides.net? | 5.161.195.190 |
|
| Privacy Guides' server | What's the IP of discuss.privacyguides.net? | 5.161.195.190 |
|
||||||
|
|
||||||
While this process can be slightly more inefficient, in this example neither the central root nameservers nor the TLD's nameservers ever receive information about your *full* query, thus reducing the amount of information being transmitted about your browsing habits. תיאור טכני נוסף מוגדר ב [RFC 7816](https://datatracker.ietf.org/doc/html/rfc7816).
|
While this process can be slightly more inefficient, in this example neither the central root nameservers nor the TLD's nameservers ever receive information about your *full* query, thus reducing the amount of information being transmitted about your browsing habits. תיאור טכני נוסף מוגדר ב [RFC 7816](https://datatracker.ietf.org/doc/html/rfc7816).
|
||||||
|
|
||||||
@ -318,4 +336,27 @@ While this process can be slightly more inefficient, in this example neither the
|
|||||||
|
|
||||||
זה נועד "לזרז" את מסירת הנתונים על ידי מתן תשובה ללקוח השייך לשרת הקרוב אליו כגון [תוכן רשת מסירה](https://en.wikipedia.org/wiki/Content_delivery_network), המשמשות לעתים קרובות בהזרמת וידאו והגשת יישומי אינטרנט של JavaScript.
|
זה נועד "לזרז" את מסירת הנתונים על ידי מתן תשובה ללקוח השייך לשרת הקרוב אליו כגון [תוכן רשת מסירה](https://en.wikipedia.org/wiki/Content_delivery_network), המשמשות לעתים קרובות בהזרמת וידאו והגשת יישומי אינטרנט של JavaScript.
|
||||||
|
|
||||||
תכונה זו כרוכה בעלות פרטיות, מכיוון שהיא מספרת לשרת ה-DNS מידע על מיקומו של הלקוח.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/he/dns.md
183
i18n/he/dns.md
@ -15,50 +15,126 @@ global:
|
|||||||
|
|
||||||
## ספקים מומלצים
|
## ספקים מומלצים
|
||||||
|
|
||||||
| ספקי DNS | מדיניות פרטיות | פרוטוקולים | תיעוד בקשות | ECS | סינון |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | -------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | חלקי[^1] | Yes | מבוסס על תצורה אישית. רשימת סינון בשימוש ניתן למצוא כאן. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH <br> DoT | חלקי[^2] | לא | מבוסס על תצורה אישית. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt <br> DoQ <br> DoH3 | אופציונאלי[^3] | לא | מבוסס על תצורה אישית. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | לא[^4] | לא | מבוסס על תצורה אישית. רשימת סינון בשימוש ניתן למצוא כאן. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt <br> DoQ <br> DoH3 | אופציונאלי[^5] | אופציונאלי | מבוסס על תצורה אישית. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | חלק[^6] | אופציונאלי | בהתבסס על תצורה אישית, חוסם תוכנות זדוניות כברירת מחדל. |
|
|
||||||
|
|
||||||
### קריטריונים
|
| ספקי DNS | מדיניות פרטיות | פרוטוקולים | תיעוד בקשות | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | סינון | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | -------------- | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | חלקי[^1] | Anonymized | Based on server choice. רשימת סינון בשימוש ניתן למצוא כאן. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | חלקי[^2] | לא | Based on server choice. | [לא](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | אופציונאלי[^3] | לא | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | לא | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | לא[^4] | לא | Based on server choice. רשימת סינון בשימוש ניתן למצוא כאן. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | אופציונאלי | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**שים לב שאיננו קשורים לאף אחד מהפרויקטים שאנו ממליצים עליהם.** בנוסף ל [הקריטריונים הסטנדרטיים שלנו](about/criteria.md), פיתחנו סט ברור של דרישות כדי לאפשר לנו לספק המלצות אובייקטיביות. אנו מציעים לך להכיר את הרשימה הזו לפני שתבחר להשתמש בְּספק, ולערוך מחקר משלך כדי להבטיח שזו הבחירה הנכונה עבורך.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- חייב לתמוך ב [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
פתרון DNS שמתארח בעצמו שימושי לאספקת סינון בפלטפורמות מבוקרות, כגון טלוויזיות חכמות והתקני IoT אחרים, מכיוון שאין צורך בתוכנה בצד הלקוח.
|
||||||
- [מזעור QNAME](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- אפשר ל - [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) להיות מנוטרל
|
|
||||||
- תעדוף תמיכה ב[Anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) או תמיכה ב"היגוי גיאוגרפי".
|
|
||||||
|
|
||||||
## תמיכה במערכת הפעלה מקומית
|
### Pi-hole
|
||||||
|
|
||||||
### אנדרואיד
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
אנדרואיד 9 ומעלה תומכת ב-DNS דרך TLS. ניתן למצוא את ההגדרות ב: **הגדרות** → **רשת & אינטרנט** → **פרטי DNS**.
|
{ align=right }
|
||||||
|
|
||||||
### מוצרי Apple
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
הגרסאות האחרונות של iOS, iPadOS, tvOS ו-macOS, תומכות הן ב-DoT והן ב-DoH. שני הפרוטוקולים נתמכים באופן מקורי באמצעות [פרופילי תצורה](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) או דרך [ממשק API להגדרות DNS](https://developer.apple.com/documentation/networkextension/dns_settings).
|
Pi-hole מיועד להתארח ב-Raspberry Pi, אך הוא אינו מוגבל לחומרה כזו. התוכנה כוללת ממשק אינטרנט ידידותי כדי להציג תובנות ולנהל תוכן חסום.
|
||||||
|
|
||||||
לאחר התקנה של פרופיל תצורה או אפליקציה המשתמשת ב-API של הגדרות DNS, ניתן לבחור את תצורת ה-DNS. אם VPN פעיל, הרזולוציה בתוך מנהרת ה-VPN תשתמש בהגדרות ה-DNS של ה-VPN ולא בהגדרות כלל המערכת שלך.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### פרופילים חתומים
|
</details>
|
||||||
|
|
||||||
Apple אינה מספקת ממשק מקורי ליצירת פרופילי DNS מוצפנים. [יוצר פרופיל DNS מאובטח](https://dns.notjakob.com/tool.html) הוא כלי לא רשמי ליצירת פרופילי DNS מוצפנים משלך, אולם הם לא ייחתמו. פרופילים חתומים מועדפים; החתימה מאמתת את מקור הפרופיל ומסייעת להבטיח את שלמות הפרופילים. תווית "מאומת" ירוקה ניתנת לפרופילי תצורה חתומים. לקבלת מידע נוסף על חתימת קוד, ראה [אודות חתימת קוד](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, שהפצות לינוקס רבות משתמשות בו כדי לבצע את חיפושי ה-DNS שלהם, עדיין לא [תומך ב-DoH](https://github.com/systemd/systemd/issues/8639). אם אתה רוצה להשתמש ב-DoH, תצטרך להתקין פרוקסי כמו [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) ו[להגדיר אותו](https://wiki.archlinux.org/title/Dnscrypt-proxy) כדי לקחת את כל שאילתות ה-DNS מפותר המערכת ולהעביר אותן באמצעות HTTPS.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home כולל ממשק אינטרנט משופשף כדי להציג תובנות ולנהל תוכן חסום.
|
||||||
|
|
||||||
|
[:octicons-home-16: דף הבית](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="מדיניות פרטיות" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=תיעוד}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="קוד מקור" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## פרוקסי DNS מוצפנים
|
## פרוקסי DNS מוצפנים
|
||||||
|
|
||||||
תוכנת פרוקסי DNS מוצפנת מספקת פרוקסי מקומי שאליו ניתן להעביר את פותר [ה-DNS הלא מוצפן](advanced/dns-overview.md#unencrypted-dns). בדרך כלל הוא משמש בפלטפורמות שאינן תומכות באופן מקורי [ב-DNS מוצפן](advanced/dns-overview.md#what-is-encrypted-dns).
|
תוכנת פרוקסי DNS מוצפנת מספקת פרוקסי מקומי שאליו ניתן להעביר את פותר [ה-DNS הלא מוצפן](advanced/dns-overview.md#unencrypted-dns). Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Apple אינה מספקת ממשק מקורי ליצירת פרופילי DNS מ
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## פתרונות אירוח עצמי
|
## קריטריונים
|
||||||
|
|
||||||
פתרון DNS שמתארח בעצמו שימושי לאספקת סינון בפלטפורמות מבוקרות, כגון טלוויזיות חכמות והתקני IoT אחרים, מכיוון שאין צורך בתוכנה בצד הלקוח.
|
**שים לב שאיננו קשורים לאף אחד מהפרויקטים שאנו ממליצים עליהם.** בנוסף ל [הקריטריונים הסטנדרטיים שלנו](about/criteria.md), פיתחנו סט ברור של דרישות כדי לאפשר לנו לספק המלצות אובייקטיביות. אנו מציעים לך להכיר את הרשימה הזו לפני שתבחר להשתמש בְּספק, ולערוך מחקר משלך כדי להבטיח שזו הבחירה הנכונה עבורך.
|
||||||
|
|
||||||
### AdGuard Home
|
### דרישות מינימליות
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [מזעור QNAME](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- תעדוף תמיכה ב[Anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) או תמיכה ב"היגוי גיאוגרפי".
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home כולל ממשק אינטרנט משופשף כדי להציג תובנות ולנהל תוכן חסום.
|
|
||||||
|
|
||||||
[:octicons-home-16: דף הבית](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="מדיניות פרטיות" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=תיעוד}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="קוד מקור" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole מיועד להתארח ב-Raspberry Pi, אך הוא אינו מוגבל לחומרה כזו. התוכנה כוללת ממשק אינטרנט ידידותי כדי להציג תובנות ולנהל תוכן חסום.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard מאחסן מדדי ביצועים מצטברים של שרתי ה-DNS שלהם, כלומר מספר הבקשות המלאות לשרת מסוים, מספר הבקשות החסומות ומהירות עיבוד הבקשות. הם גם שומרים ומאחסנים את מסד הנתונים של הדומיינים שהתבקשו ב-24 השעות האחרונות. "אנחנו צריכים את המידע הזה כדי לזהות ולחסום עוקבים ואיומים חדשים." "אנחנו גם מתעדים כמה פעמים גשש זה או אחר נחסם. אנחנו צריכים את המידע הזה כדי להסיר את הכללים המיושנים מהמסננים שלנו." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard מאחסן מדדי ביצועים מצטברים של שרתי ה-DNS שלהם, כלומר מספר הבקשות המלאות לשרת מסוים, מספר הבקשות החסומות ומהירות עיבוד הבקשות. הם גם שומרים ומאחסנים את מסד הנתונים של הדומיינים שהתבקשו ב-24 השעות האחרונות. "אנחנו צריכים את המידע הזה כדי לזהות ולחסום עוקבים ואיומים חדשים." "אנחנו גם מתעדים כמה פעמים גשש זה או אחר נחסם. אנחנו צריכים את המידע הזה כדי להסיר את הכללים המיושנים מהמסננים שלנו." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare אוספת ומאחסנת רק את נתוני שאילתת ה-DNS המוגבלים שנשלחים לפותר 1.1.1.1. שירות הפותר 1.1.1.1 אינו רושם נתונים אישיים, וחלק הארי של נתוני השאילתות המוגבלים שאינם ניתנים לזיהוי אישי מאוחסן למשך 25 שעות בלבד. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare אוספת ומאחסנת רק את נתוני שאילתת ה-DNS המוגבלים שנשלחים לפותר 1.1.1.1. שירות הפותר 1.1.1.1 אינו רושם נתונים אישיים, וחלק הארי של נתוני השאילתות המוגבלים שאינם ניתנים לזיהוי אישי מאוחסן למשך 25 שעות בלבד. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D רק מתעדים עבור פותרי Premium עם פרופילי DNS מותאמים אישית. פותרים חינמיים אינם רושמים נתונים. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D רק מתעדים עבור פותרי Premium עם פרופילי DNS מותאמים אישית. פותרים חינמיים אינם רושמים נתונים. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: שירות ה-DNS של Mullvad זמין הן למנויים והן ללא מנויים של Mullvad VPN. מדיניות הפרטיות שלהם טוענת במפורש שהם לא רושמים בקשות DNS בשום צורה. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: שירות ה-DNS של Mullvad זמין הן למנויים והן ללא מנויים של Mullvad VPN. מדיניות הפרטיות שלהם טוענת במפורש שהם לא רושמים בקשות DNS בשום צורה. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 אוספת חלק מהנתונים למטרות ניטור ותגובה של איומים. לאחר מכן ניתן לערבב מחדש את הנתונים הללו ולשתף אותם, למשל לצורך מחקר אבטחה. Quad9 אינה אוספת או מתעדת כתובות IP או נתונים אחרים שלדעתם ניתנים לזיהוי אישי. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 אוספת חלק מהנתונים למטרות ניטור ותגובה של איומים. לאחר מכן ניתן לערבב מחדש את הנתונים הללו ולשתף אותם, למשל לצורך מחקר אבטחה. Quad9 אינה אוספת או מתעדת כתובות IP או נתונים אחרים שלדעתם ניתנים לזיהוי אישי. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be
|
|||||||
|
|
||||||
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Native Operating System Support
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**.
|
||||||
|
|
||||||
|
#### Apple Devices
|
||||||
|
|
||||||
|
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
||||||
|
|
||||||
|
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## What can an outside party see?
|
## What can an outside party see?
|
||||||
|
|
||||||
In this example we will record what happens when we make a DoH request:
|
In this example we will record what happens when we make a DoH request:
|
||||||
@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a
|
|||||||
|
|
||||||
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
||||||
|
|
||||||
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/hi/dns.md
183
i18n/hi/dns.md
@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [
|
|||||||
|
|
||||||
## Recommended Providers
|
## Recommended Providers
|
||||||
|
|
||||||
| DNS Provider | Privacy Policy | Protocols | Logging | ECS | Filtering |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Some[^1] | Yes | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH/3 <br> DoT | Some[^2] | No | Based on personal configuration. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^3] | No | Based on personal configuration. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | No[^4] | No | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^5] | Optional | Based on personal configuration. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^6] | Optional | Based on personal configuration, Malware blocking by default. |
|
|
||||||
|
|
||||||
### Criteria
|
| DNS Provider | Privacy Policy | Protocols | Logging | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | No | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
||||||
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled.
|
|
||||||
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
|
||||||
|
|
||||||
## Native Operating System Support
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**.
|
{ align=right }
|
||||||
|
|
||||||
### Apple Devices
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### Signed Profiles
|
</details>
|
||||||
|
|
||||||
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Encrypted DNS Proxies
|
## Encrypted DNS Proxies
|
||||||
|
|
||||||
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Self-hosted Solutions
|
## Criteria
|
||||||
|
|
||||||
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||||
|
|
||||||
### AdGuard Home
|
### Minimum Requirements
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be
|
|||||||
|
|
||||||
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Native Operating System Support
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Az Android 9 és újabb verziói támogatják a DNS-t TLS-en keresztül. A beállítások megtalálhatók itt: **Beállítások** → **Hálózat és Internet** → **Privát DNS**.
|
||||||
|
|
||||||
|
#### Apple Devices
|
||||||
|
|
||||||
|
Az iOS, iPadOS, tvOS és macOS legújabb verziói támogatják a DoT és a DoH funkciót is. Mindkét protokoll alapból támogatva van a [konfigurációs profilok](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) vagy a [DNS-beállítás API](https://developer.apple.com/documentation/networkextension/dns_settings)-n keresztül.
|
||||||
|
|
||||||
|
Egy konfigurációs profilt vagy egy DNS-beállítások API-t használó alkalmazás telepítése után kiválasztható a DNS-konfiguráció. Ha egy VPN aktív, a VPN-alagúton belüli elosztás a VPN DNS-beállításait fogja használni, nem pedig a rendszerbeállításokat.
|
||||||
|
|
||||||
|
Az Apple nem biztosít natív felületet titkosított DNS-profilok létrehozásához. A [Secure DNS profile creator](https://dns.notjakob.com/tool.html) egy nem hivatalos eszköz saját titkosított DNS-profilok létrehozására, azonban ezek a profilok nem lesznek aláírva. Az aláírt profilok előnyben részesítendők; az aláírás igazolja a profil eredetét, és segít biztosítani a profilok integritását. Az aláírt konfigurációs profilok zöld "Ellenőrzött" címkét kapnak. A kódaláírással kapcsolatos további információkért lásd: [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## What can an outside party see?
|
## What can an outside party see?
|
||||||
|
|
||||||
In this example we will record what happens when we make a DoH request:
|
In this example we will record what happens when we make a DoH request:
|
||||||
@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a
|
|||||||
|
|
||||||
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
||||||
|
|
||||||
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/hu/dns.md
183
i18n/hu/dns.md
@ -15,50 +15,126 @@ Titkosított DNS-t harmadik féltől származó szerverekkel csak alapvető [DNS
|
|||||||
|
|
||||||
## Ajánlott Szolgáltatók
|
## Ajánlott Szolgáltatók
|
||||||
|
|
||||||
| DNS Szolgáltatók | Adatvédelmi Tájékoztató | Protokollok | Naplózás | ECS | Szűrés |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | --------------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Némi[^1] | Yes | Based on personal configuration. A használt szűrőlista itt található. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Nyílt szöveg <br> DoH/3 <br> DoT | Némi[^2] | Nem | Based on personal configuration. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Nyílt szöveg <br> DoH/3 <br> DoT <br> DoQ | Választható[^3] | Nem | Based on personal configuration. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | Nem[^4] | Nem | Based on personal configuration. A használt szűrőlista itt található. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Nyílt szöveg <br> DoH/3 <br> DoT <br> DoQ | Választható[^5] | Választható | Based on personal configuration. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Nyílt szöveg <br> DoH <br> DoT <br> DNSCrypt | Némi[^6] | Választható | Based on personal configuration, Malware blocking by default. |
|
|
||||||
|
|
||||||
### Követelmények
|
| DNS Szolgáltatók | Adatvédelmi Tájékoztató | Protokollok | Naplózás | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Szűrés | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | --------------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Némi[^1] | Anonymized | Based on server choice. A használt szűrőlista itt található. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Némi[^2] | Nem | Based on server choice. | [Nem](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Választható[^3] | Nem | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Nem | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | Nem[^4] | Nem | Based on server choice. A használt szűrőlista itt található. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Választható | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Tartsd figyelemben, hogy nem állunk kapcsolatban az általunk ajánlott projektek egyikével sem.** Az [alap kritériumaink mellett](about/criteria.md), egyértelmű követelményrendszert dolgoztunk ki, hogy objektív ajánlásokat tudjunk tenni. Javasoljuk, hogy ismerkedj meg ezzel a listával, mielőtt kiválasztanál egy projektet, és végezz saját kutatásokat, hogy megbizonyosodj arról, hogy ez a megfelelő választás számodra.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Támogatnia kell a [DNSSEC](advanced/dns-overview.md#what-is-dnssec)-et.
|
Egy saját üzemeltetésű DNS-megoldás hasznos ellenőrzött platformokon, például Smart TV-ken és más IoT-eszközökön történő szűrés biztosításához, mivel nincs szükség kliensoldali szoftverre.
|
||||||
- [QNAME Minimalizáció](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Lehetővé teszi az [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) letiltását.
|
|
||||||
- Előnyben részesíti az [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods), vagy a geo-steering támogatását.
|
|
||||||
|
|
||||||
## Native Operating System Support
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Az Android 9 és újabb verziói támogatják a DNS-t TLS-en keresztül. A beállítások megtalálhatók itt: **Beállítások** → **Hálózat és Internet** → **Privát DNS**.
|
{ align=right }
|
||||||
|
|
||||||
### Apple Devices
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
Az iOS, iPadOS, tvOS és macOS legújabb verziói támogatják a DoT és a DoH funkciót is. Mindkét protokoll alapból támogatva van a [konfigurációs profilok](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) vagy a [DNS-beállítás API](https://developer.apple.com/documentation/networkextension/dns_settings)-n keresztül.
|
A Pi-hole-t úgy tervezték, hogy egy Raspberry Pi-n lehessen üzemeltetni, de az nem korlátozott erre a hardverre. Az szoftver egy kifinomult webes felületet kínál az betekintések megtekintéséhez és blokkolt tartalmak kezeléséhez.
|
||||||
|
|
||||||
Egy konfigurációs profilt vagy egy DNS-beállítások API-t használó alkalmazás telepítése után kiválasztható a DNS-konfiguráció. Ha egy VPN aktív, a VPN-alagúton belüli elosztás a VPN DNS-beállításait fogja használni, nem pedig a rendszerbeállításokat.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### Aláírt Profilok
|
</details>
|
||||||
|
|
||||||
Az Apple nem biztosít natív felületet titkosított DNS-profilok létrehozásához. A [Secure DNS profile creator](https://dns.notjakob.com/tool.html) egy nem hivatalos eszköz saját titkosított DNS-profilok létrehozására, azonban ezek a profilok nem lesznek aláírva. Az aláírt profilok előnyben részesítendők; az aláírás igazolja a profil eredetét, és segít biztosítani a profilok integritását. Az aláírt konfigurációs profilok zöld "Ellenőrzött" címkét kapnak. A kódaláírással kapcsolatos további információkért lásd: [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
A `systemd-resolved`, amelyet sok Linux disztribúció használ a DNS-lekérdezéseikhez, még nem [támogatja a DoH-t](https://github.com/systemd/systemd/issues/8639). Ha a DoH-t szeretnéd használni, telepítened kell egy proxyt, mint például a [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) és [konfigurálnod kell azt](https://wiki.archlinux.org/title/Dnscrypt-proxy), hogy az átvegye az összes DNS-lekérdezést a rendszer resolverjétől, és azokat HTTPS-en keresztül továbbítsa.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
Az AdGuard Home egy kifinomult webes felületet kínál az betekintések megtekintéséhez és blokkolt tartalmak kezeléséhez.
|
||||||
|
|
||||||
|
[:octicons-home-16: Honlap](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Adatvédelmi Tájékoztató" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Dokumentáció}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Forráskód" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Titkosított DNS proxyk
|
## Titkosított DNS proxyk
|
||||||
|
|
||||||
Egy titkosított DNS proxy szoftver helyi proxy-t biztosít a [titkosítatlan DNS](advanced/dns-overview.md#unencrypted-dns) resolver számára, amelyhez majd továbbít. Általában olyan platformokon használatos, amelyek nem támogatják natívan a [titkosított DNS-t](advanced/dns-overview.md#what-is-encrypted-dns).
|
Egy titkosított DNS proxy szoftver helyi proxy-t biztosít a [titkosítatlan DNS](advanced/dns-overview.md#unencrypted-dns) resolver számára, amelyhez majd továbbít. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ A **dnscrypt-proxy** egy DNS-proxy, amely támogatja a [DNSCrypt](advanced/dns-o
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Saját Üzemeltetésű Megoldások
|
## Követelmények
|
||||||
|
|
||||||
Egy saját üzemeltetésű DNS-megoldás hasznos ellenőrzött platformokon, például Smart TV-ken és más IoT-eszközökön történő szűrés biztosításához, mivel nincs szükség kliensoldali szoftverre.
|
**Tartsd figyelemben, hogy nem állunk kapcsolatban az általunk ajánlott projektek egyikével sem.** Az [alap kritériumaink mellett](about/criteria.md), egyértelmű követelményrendszert dolgoztunk ki, hogy objektív ajánlásokat tudjunk tenni. Javasoljuk, hogy ismerkedj meg ezzel a listával, mielőtt kiválasztanál egy projektet, és végezz saját kutatásokat, hogy megbizonyosodj arról, hogy ez a megfelelő választás számodra.
|
||||||
|
|
||||||
### AdGuard Home
|
### Alap elvárások
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [QNAME Minimalizáció](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Előnyben részesíti az [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods), vagy a geo-steering támogatását.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Az AdGuard Home egy kifinomult webes felületet kínál az betekintések megtekintéséhez és blokkolt tartalmak kezeléséhez.
|
|
||||||
|
|
||||||
[:octicons-home-16: Honlap](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Adatvédelmi Tájékoztató" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Dokumentáció}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Forráskód" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
A Pi-hole-t úgy tervezték, hogy egy Raspberry Pi-n lehessen üzemeltetni, de az nem korlátozott erre a hardverre. Az szoftver egy kifinomult webes felületet kínál az betekintések megtekintéséhez és blokkolt tartalmak kezeléséhez.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: Az AdGuard tárolja a DNS szervereik összesített teljesítményméréseit, nevezetesen az adott szerverhez érkező teljes kérések számát, a blokkolt kérések számát és a kérések feldolgozásának sebességét. Az elmúlt 24 órában igényelt domainek adatbázisát is eltárolják. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/hu/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: Az AdGuard tárolja a DNS szervereik összesített teljesítményméréseit, nevezetesen az adott szerverhez érkező teljes kérések számát, a blokkolt kérések számát és a kérések feldolgozásának sebességét. Az elmúlt 24 órában igényelt domainek adatbázisát is eltárolják. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/hu/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: A Cloudflare csak azokat a korlátozott DNS-lekérdezési adatokat gyűjti és tárolja ami az 1.1.1.1 resolverhez érkezik. Az 1.1.1.1 resolver szolgáltatás nem naplóz személyes adatokat, és a korlátozott, személyazonosításra nem alkalmas lekérdezési adatok nagy részét csak 25 órán keresztül tárolja. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: A Cloudflare csak azokat a korlátozott DNS-lekérdezési adatokat gyűjti és tárolja ami az 1.1.1.1 resolverhez érkezik. Az 1.1.1.1 resolver szolgáltatás nem naplóz személyes adatokat, és a korlátozott, személyazonosításra nem alkalmas lekérdezési adatok nagy részét csak 25 órán keresztül tárolja. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: A Control D csak az egyedi DNS-profilokkal rendelkező Premium resolverek esetében naplóz. Az ingyenes resolverek nem naplóznak adatokat. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: A Control D csak az egyedi DNS-profilokkal rendelkező Premium resolverek esetében naplóz. Az ingyenes resolverek nem naplóznak adatokat. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: A Mullvad DNS szolgáltatása a Mullvad VPN előfizetői és nem előfizetői számára egyaránt elérhető. Az adatvédelmi irányelvük kifejezetten azt állítja, hogy semmilyen módon nem naplóznak DNS-kéréseket. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: A Mullvad DNS szolgáltatása a Mullvad VPN előfizetői és nem előfizetői számára egyaránt elérhető. Az adatvédelmi irányelvük kifejezetten azt állítja, hogy semmilyen módon nem naplóznak DNS-kéréseket. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: A Quad9 bizonyos adatokat a fenyegetések megfigyelése és elhárítása céljából gyűjt. Ezek az adatok ezután összekeverhetők és megoszthatók, például biztonsági kutatások céljából. A Quad9 nem gyűjt vagy rögzít IP-címeket vagy más, személyazonosításra alkalmasnak ítélt adatokat. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: A Quad9 bizonyos adatokat a fenyegetések megfigyelése és elhárítása céljából gyűjt. Ezek az adatok ezután összekeverhetők és megoszthatók, például biztonsági kutatások céljából. A Quad9 nem gyűjt vagy rögzít IP-címeket vagy más, személyazonosításra alkalmasnak ítélt adatokat. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ DNS terenkripsi dapat merujuk pada salah satu dari sejumlah protokol, yang palin
|
|||||||
|
|
||||||
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Dukungan Sistem Operasi
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9 ke atas mendukung DNS melalui TLS. Pengaturan dapat ditemukan di: **Pengaturan** → **Jaringan & Internet** → **DNS Pribadi**.
|
||||||
|
|
||||||
|
#### Perangkat Apple
|
||||||
|
|
||||||
|
Versi terbaru iOS, iPadOS, tvOS, dan macOS, mendukung DoT dan DoH. Kedua protokol didukung secara default melalui [profil konfigurasi](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) atau melalui [API Pengaturan DNS](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
Setelah pemasangan profil konfigurasi atau aplikasi yang menggunakan API Pengaturan DNS, konfigurasi DNS dapat dipilih. Jika VPN aktif, pengaturan DNS dalam VPN akan digunakan untuk menentukan resolusi, bukan pengaturan DNS sistem Anda secara keseluruhan.
|
||||||
|
|
||||||
|
Apple tidak menyediakan antarmuka asli untuk membuat profil DNS terenkripsi. [Pembuat profil DNS aman](https://dns.notjakob.com/tool.html) adalah alat tidak resmi untuk membuat profil DNS terenkripsi Anda sendiri, namun profil tersebut tidak akan ditandatangani. Profil yang ditandatangani lebih disukai; penandatanganan memvalidasi asal profil dan membantu memastikan integritas profil. Label "Terverifikasi" berwarna hijau diberikan pada profil konfigurasi yang telah ditandatangani. Untuk informasi lebih lanjut tentang penandatanganan kode, lihat [Tentang Penandatanganan Kode](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## What can an outside party see?
|
## What can an outside party see?
|
||||||
|
|
||||||
In this example we will record what happens when we make a DoH request:
|
In this example we will record what happens when we make a DoH request:
|
||||||
@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a
|
|||||||
|
|
||||||
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
||||||
|
|
||||||
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/id/dns.md
183
i18n/id/dns.md
@ -15,50 +15,126 @@ DNS terenkripsi dengan server pihak ketiga sebaiknya hanya digunakan untuk menga
|
|||||||
|
|
||||||
## Penyedia yang Direkomendasikan
|
## Penyedia yang Direkomendasikan
|
||||||
|
|
||||||
| Penyedia DNS | Kebijakan Privasi | Protokol | Pencatatan Log | ECS | Pemfilteran |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | -------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Beberapa[^1] | Yes | Berdasarkan konfigurasi pribadi. Daftar filter yang digunakan dapat ditemukan di sini. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Teks biasa <br> DoH/3 <br> DoT | Beberapa[^2] | Tidak | Berdasarkan konfigurasi pribadi. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Teks biasa <br> DoH/3 <br> DoT <br> DoQ | Opsional[^3] | Tidak | Berdasarkan konfigurasi pribadi. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | Tidak[^4] | Tidak | Berdasarkan konfigurasi pribadi. Daftar filter yang digunakan dapat ditemukan di sini. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Teks biasa <br> DoH/3 <br> DoT <br> DoQ | Opsional[^5] | Opsional | Berdasarkan konfigurasi pribadi. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Teks biasa <br> DoH <br> DoT <br> DNSCrypt | Beberapa[^6] | Opsional | Berdasarkan konfigurasi personal, Malware terblokir secara default. |
|
|
||||||
|
|
||||||
### Kriteria
|
| Penyedia DNS | Kebijakan Privasi | Protokol | Pencatatan Log | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Pemfilteran | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | -------------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------ |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Beberapa[^1] | Anonymized | Based on server choice. Daftar filter yang digunakan dapat ditemukan di sini. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Beberapa[^2] | Tidak | Based on server choice. | [Tidak](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Opsional[^3] | Tidak | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Tidak | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | Tidak[^4] | Tidak | Based on server choice. Daftar filter yang digunakan dapat ditemukan di sini. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Opsional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Harap dicatat bahwa kami tidak berafiliasi dengan proyek-proyek yang kami rekomendasikan.** Selain [kriteria standar kami](about/criteria.md), kami telah mengembangkan serangkaian persyaratan yang jelas untuk memungkinkan kami memberikan rekomendasi yang objektif. Kami menyarankan agar Anda mengenal lebih lanjut daftar di bawah ini sebelum memutuskan untuk menggunakan project tertentu. Selalu lakukan riset sendiri untuk memastikan bahwa project tersebut adalah pilihan yang tepat untuk Anda.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Harus mendukung [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
Solusi DNS yang dihosting sendiri berguna untuk menyediakan penyaringan pada platform terkontrol, seperti Smart TV dan perangkat IoT lainnya, karena tidak ada perangkat lunak di sisi klien yang diperlukan.
|
||||||
- [Minimalisasi QNAME](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Mengizinkan [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) untuk dinonaktifkan.
|
|
||||||
- Dukungan [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) atau geo-steering lebih disukai.
|
|
||||||
|
|
||||||
## Dukungan Sistem Operasi
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 ke atas mendukung DNS melalui TLS. Pengaturan dapat ditemukan di: **Pengaturan** → **Jaringan & Internet** → **DNS Pribadi**.
|
{ align=right }
|
||||||
|
|
||||||
### Perangkat Apple
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
Versi terbaru iOS, iPadOS, tvOS, dan macOS, mendukung DoT dan DoH. Kedua protokol didukung secara default melalui [profil konfigurasi](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) atau melalui [API Pengaturan DNS](https://developer.apple.com/documentation/networkextension/dns_settings).
|
Pi-hole dirancang untuk dihosting di Raspberry Pi, tetapi tidak terbatas pada perangkat keras tersebut. Perangkat lunak ini memiliki antarmuka web yang ramah untuk melihat analisis dan mengelola konten yang diblokir.
|
||||||
|
|
||||||
Setelah pemasangan profil konfigurasi atau aplikasi yang menggunakan API Pengaturan DNS, konfigurasi DNS dapat dipilih. Jika VPN aktif, pengaturan DNS dalam VPN akan digunakan untuk menentukan resolusi, bukan pengaturan DNS sistem Anda secara keseluruhan.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### Profil yang Ditandatangani
|
</details>
|
||||||
|
|
||||||
Apple tidak menyediakan antarmuka asli untuk membuat profil DNS terenkripsi. [Pembuat profil DNS aman](https://dns.notjakob.com/tool.html) adalah alat tidak resmi untuk membuat profil DNS terenkripsi Anda sendiri, namun profil tersebut tidak akan ditandatangani. Profil yang ditandatangani lebih disukai; penandatanganan memvalidasi asal profil dan membantu memastikan integritas profil. Label "Terverifikasi" berwarna hijau diberikan pada profil konfigurasi yang telah ditandatangani. Untuk informasi lebih lanjut tentang penandatanganan kode, lihat [Tentang Penandatanganan Kode](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, yang digunakan banyak distribusi Linux untuk melakukan pencarian DNS, belum [mendukung DoH](https://github.com/systemd/systemd/issues/8639). Jika Anda ingin menggunakan DoH, Anda perlu menginstal proxy seperti [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) dan [konfigurasikan] (https://wiki.archlinux.org/title/Dnscrypt-proxy) untuk mengambil semua permintaan DNS dari resolver sistem Anda dan meneruskannya melalui HTTPS.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home memiliki antarmuka web yang dipoles untuk melihat wawasan dan mengelola konten yang diblokir.
|
||||||
|
|
||||||
|
[:octicons-home-16: Beranda](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Kebijakan Privasi" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Dokumentasi}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Kode Sumber" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## DNS Proxy yang Terenkripsi
|
## DNS Proxy yang Terenkripsi
|
||||||
|
|
||||||
Perangkat lunak proxy DNS terenkripsi menyediakan proxy lokal untuk [DNS tidak terenkripsi](advanced/dns-overview.md#unencrypted-dns) resolver untuk diteruskan. Biasanya digunakan pada platform yang tidak mendukung [DNS terenkripsi](advanced/dns-overview.md#what-is-encrypted-dns).
|
Perangkat lunak proxy DNS terenkripsi menyediakan proxy lokal untuk [DNS tidak terenkripsi](advanced/dns-overview.md#unencrypted-dns) resolver untuk diteruskan. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Perangkat lunak proxy DNS terenkripsi menyediakan proxy lokal untuk [DNS tidak t
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Solusi Self-hosting
|
## Kriteria
|
||||||
|
|
||||||
Solusi DNS yang dihosting sendiri berguna untuk menyediakan penyaringan pada platform terkontrol, seperti Smart TV dan perangkat IoT lainnya, karena tidak ada perangkat lunak di sisi klien yang diperlukan.
|
**Harap dicatat bahwa kami tidak berafiliasi dengan proyek-proyek yang kami rekomendasikan.** Selain [kriteria standar kami](about/criteria.md), kami telah mengembangkan serangkaian persyaratan yang jelas untuk memungkinkan kami memberikan rekomendasi yang objektif. Kami menyarankan agar Anda mengenal lebih lanjut daftar di bawah ini sebelum memutuskan untuk menggunakan project tertentu. Selalu lakukan riset sendiri untuk memastikan bahwa project tersebut adalah pilihan yang tepat untuk Anda.
|
||||||
|
|
||||||
### AdGuard Home
|
### Persyaratan Minimum
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [Minimalisasi QNAME](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Dukungan [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) atau geo-steering lebih disukai.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home memiliki antarmuka web yang dipoles untuk melihat wawasan dan mengelola konten yang diblokir.
|
|
||||||
|
|
||||||
[:octicons-home-16: Beranda](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Kebijakan Privasi" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Dokumentasi}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Kode Sumber" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole dirancang untuk dihosting di Raspberry Pi, tetapi tidak terbatas pada perangkat keras tersebut. Perangkat lunak ini memiliki antarmuka web yang ramah untuk melihat analisis dan mengelola konten yang diblokir.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard menyimpan informasi kinerja dari server DNS mereka, seperti informasi request kepada server tertentu, jumlah request yang terblokir dan informasi mengenai kecepatan request ketika sedang diproses. Mereka juga menyimpan database domain yang diminta dalam waktu 24 jam terakhir. "Kami membutuhkan informasi ini untuk mengidentifikasi dan memblokir pelacak dan ancaman baru." "Kami juga mencatat berapa kali pelacak telah diblokir. Kami membutuhkan informasi ini untuk menghapus aturan lama dari filter kami." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard menyimpan informasi kinerja dari server DNS mereka, seperti informasi request kepada server tertentu, jumlah request yang terblokir dan informasi mengenai kecepatan request ketika sedang diproses. Mereka juga menyimpan database domain yang diminta dalam waktu 24 jam terakhir. "Kami membutuhkan informasi ini untuk mengidentifikasi dan memblokir pelacak dan ancaman baru." "Kami juga mencatat berapa kali pelacak telah diblokir. Kami membutuhkan informasi ini untuk menghapus aturan lama dari filter kami." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare hanya mengumpulkan dan menyimpan data permintaan DNS terbatas yang dikirim ke resolver 1.1.1.1. Layanan resolver 1.1.1.1 tidak mencatat data pribadi, dan sebagian besar data yang tidak dapat diidentifikasi secara pribadi hanya disimpan selama 25 jam. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare hanya mengumpulkan dan menyimpan data permintaan DNS terbatas yang dikirim ke resolver 1.1.1.1. Layanan resolver 1.1.1.1 tidak mencatat data pribadi, dan sebagian besar data yang tidak dapat diidentifikasi secara pribadi hanya disimpan selama 25 jam. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D hanya mencatat untuk resolver Premium dengan profil DNS khusus. Resolver gratis tidak mencatat data. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D hanya mencatat untuk resolver Premium dengan profil DNS khusus. Resolver gratis tidak mencatat data. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: Layanan DNS Mullvad tersedia untuk pelanggan dan non-pelanggan Mullvad VPN. Kebijakan privasi mereka secara eksplisit mengklaim bahwa mereka tidak mencatat permintaan DNS dengan cara apa pun. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: Layanan DNS Mullvad tersedia untuk pelanggan dan non-pelanggan Mullvad VPN. Kebijakan privasi mereka secara eksplisit mengklaim bahwa mereka tidak mencatat permintaan DNS dengan cara apa pun. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 mengumpulkan beberapa data untuk tujuan pemantauan dan tanggapan ancaman. Data nantinya diacak dan dibagikan untuk tujuan penelitian keamanan. Quad9 tidak mengumpulkan atau mencatat alamat IP atau data lain yang mereka anggap dapat diidentifikasi secara pribadi. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 mengumpulkan beberapa data untuk tujuan pemantauan dan tanggapan ancaman. Data nantinya diacak dan dibagikan untuk tujuan penelitian keamanan. Quad9 tidak mengumpulkan atau mencatat alamat IP atau data lain yang mereka anggap dapat diidentifikasi secara pribadi. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ Il DNS crittografato può riferirsi a uno dei numerosi protocolli, i più comuni
|
|||||||
|
|
||||||
L'implementazione nativa di DoH è arrivata su iOS 14, macOS 11, Microsoft Windows e Android 13 (tuttavia, non sarà abilitata [di default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). Il supporto generale per i desktop Linux è in attesa dell'[implementazione](https://github.com/systemd/systemd/issues/8639) di systemd, quindi [è necessario installare un software di terze parti](../dns.md#encrypted-dns-proxies).
|
L'implementazione nativa di DoH è arrivata su iOS 14, macOS 11, Microsoft Windows e Android 13 (tuttavia, non sarà abilitata [di default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). Il supporto generale per i desktop Linux è in attesa dell'[implementazione](https://github.com/systemd/systemd/issues/8639) di systemd, quindi [è necessario installare un software di terze parti](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Supporto Nativo del Sistema Operativo
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9 e successive supportano il 'DNS over TLS'. Le impostazioni si possono trovare in: **Impostazioni** → **Rete e Internet** → **DNS Privato**.
|
||||||
|
|
||||||
|
#### Dispositivi Apple
|
||||||
|
|
||||||
|
Le versioni più recenti di iOS, iPadOS, tvOS e macOS, supportano sia DoT che DoH. Entrambi i protocolli sono supportati nativamente tramite i [profili di configurazione](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) o tramite l'[API delle Impostazioni DNS](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
Dopo l'installazione di un profilo di configurazione o di un'app che utilizza l'API delle Impostazioni DNS, è possibile selezionare la configurazione DNS. Se una VPN è attiva, la risoluzione nel tunnel VPN utilizzerà le impostazioni DNS della VPN e non le impostazioni di sistema.
|
||||||
|
|
||||||
|
Apple non fornisce un'interfaccia nativa per la creazione di profili DNS crittografati. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) è uno strumento non ufficiale per creare i propri profili DNS crittografati, tuttavia, non saranno firmati. I profili firmati sono da preferire; la firma convalida l'origine di un profilo e contribuisce a garantire l'integrità. Un'etichetta verde "Verificato" è data ai profili di configurazione firmati. Per ulteriori informazioni sulla firma del codice, consulta [Informazioni sulla firma del codice](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## Cosa può vedere una parte esterna?
|
## Cosa può vedere una parte esterna?
|
||||||
|
|
||||||
In questo esempio registreremo cosa si verifica quando effettuiamo una richiesta DoH:
|
In questo esempio registreremo cosa si verifica quando effettuiamo una richiesta DoH:
|
||||||
@ -318,4 +336,27 @@ La [Sottorete del Client EDNS](https://en.wikipedia.org/wiki/EDNS_Client_Subnet)
|
|||||||
|
|
||||||
Esiste per "velocizzare" la consegna dei dati, dando al client una risposta appartenente a un server nei suoi pressi, come una [rete di consegna dei contenuti](https://en.wikipedia.org/wiki/Content_delivery_network), spesso utilizzate nello streaming di video e per servire app web in JavaScript.
|
Esiste per "velocizzare" la consegna dei dati, dando al client una risposta appartenente a un server nei suoi pressi, come una [rete di consegna dei contenuti](https://en.wikipedia.org/wiki/Content_delivery_network), spesso utilizzate nello streaming di video e per servire app web in JavaScript.
|
||||||
|
|
||||||
Questa funzionalità non ha un costo in termini di privacy, poiché comunica al server DNS alcune informazioni sulla posizione del client.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/it/dns.md
183
i18n/it/dns.md
@ -15,50 +15,126 @@ I DNS crittografati con server di terze parti dovrebbero essere utilizzati solta
|
|||||||
|
|
||||||
## Fornitori consigliati
|
## Fornitori consigliati
|
||||||
|
|
||||||
| Fornitore DNS | Politica sulla Privacy | Protocolli | Registrazione | ECS | Filtraggio |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | --------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Parziale[^1] | Sì | Secondo la configurazione personale. L'elenco dei filtri utilizzati è disponibile qui. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH/3 <br> DoT | Parziale[^2] | No | Secondo la configurazione personale. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Facoltativa[^3] | No | Secondo la configurazione personale. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | No[^4] | No | Secondo la configurazione personale. L'elenco dei filtri utilizzati è disponibile qui. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Facoltativa[^5] | Facoltativa | Secondo la configurazione personale. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Parziale[^6] | Facoltativa | Secondo la configurazione personale, blocco dei malware predefinito. |
|
|
||||||
|
|
||||||
### Criteri
|
| Fornitore DNS | Politica sulla Privacy | Protocolli | Registrazione | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtraggio | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | --------------- | -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Parziale[^1] | Anonymized | Based on server choice. L'elenco dei filtri utilizzati è disponibile qui. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Sì](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Parziale[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Facoltativa[^3] | No | Based on server choice. | [Sì](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Sì](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. L'elenco dei filtri utilizzati è disponibile qui. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Sì](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Facoltativa | Based on server choice, malware blocking by default. | [Sì](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Ti preghiamo di notare che non siamo affiliati con alcun progetto consigliato.** Oltre ai [nostri criteri standard](about/criteria.md), abbiamo sviluppato una serie chiara di requisiti per consentirci di fornire consigli oggettivi. Ti suggeriamo di familiarizzare con questo elenco prima di scegliere di utilizzare un progetto e di condurre le tue ricerche per assicurarti che si tratti della scelta adatta a te.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Deve supportare le [DNSSEC](advanced/dns-overview.md#what-is-dnssec)
|
Una soluzione DNS self-hosted è utile per fornire il filtraggio su piattaforme controllate, come Smart TV e altri dispositivi IoT, poiché non è necessario alcun software lato client.
|
||||||
- [Minimizzazione QNAME](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Consente di disabilitare la [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs)
|
|
||||||
- Preferire il supporto di [anycast](https://it.wikipedia.org/wiki/Anycast) o il supporto di geo-steering
|
|
||||||
|
|
||||||
## Supporto Nativo del Sistema Operativo
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 e successive supportano il 'DNS over TLS'. Le impostazioni si possono trovare in: **Impostazioni** → **Rete e Internet** → **DNS Privato**.
|
{ align=right }
|
||||||
|
|
||||||
### Dispositivi Apple
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
Le versioni più recenti di iOS, iPadOS, tvOS e macOS, supportano sia DoT che DoH. Entrambi i protocolli sono supportati nativamente tramite i [profili di configurazione](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) o tramite l'[API delle Impostazioni DNS](https://developer.apple.com/documentation/networkextension/dns_settings).
|
Pi-hole è stato progettato per essere ospitato su un Raspberry Pi, ma non si limita a tale hardware. Il software dispone di un'interfaccia web intuitiva per visualizzare i dettagli e gestire i contenuti bloccati.
|
||||||
|
|
||||||
Dopo l'installazione di un profilo di configurazione o di un'app che utilizza l'API delle Impostazioni DNS, è possibile selezionare la configurazione DNS. Se una VPN è attiva, la risoluzione nel tunnel VPN utilizzerà le impostazioni DNS della VPN e non le impostazioni di sistema.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### Profili firmati
|
</details>
|
||||||
|
|
||||||
Apple non fornisce un'interfaccia nativa per la creazione di profili DNS crittografati. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) è uno strumento non ufficiale per creare i propri profili DNS crittografati, tuttavia, non saranno firmati. I profili firmati sono da preferire; la firma convalida l'origine di un profilo e contribuisce a garantire l'integrità. Un'etichetta verde "Verificato" è data ai profili di configurazione firmati. Per ulteriori informazioni sulla firma del codice, consulta [Informazioni sulla firma del codice](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, utilizzato da molte distribuzioni Linux per effettuare le ricerche DNS, non supporta ancora [DoH](https://github.com/systemd/systemd/issues/8639). Se vuoi usare DoH, è necessario installare un proxy come [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) e [configurarlo] (https://wiki.archlinux.org/title/Dnscrypt-proxy) per prendere tutte le query DNS dal resolver di sistema e inoltrarle tramite HTTPS.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home dispone di un'interfaccia web raffinata per visualizzare i dettagli e gestire i contenuti bloccati.
|
||||||
|
|
||||||
|
[:octicons-home-16: Home](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Politica sulla Privacy" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentazione}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Codice Sorgente" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Proxy DNS Crittografati
|
## Proxy DNS Crittografati
|
||||||
|
|
||||||
I software proxy per il DNS crittografato forniscono un proxy locale a cui inoltrare le richieste [DNS non crittografate](advanced/dns-overview.md#unencrypted-dns). Tipicamente, è utilizzato sulle piattaforme che non supportano nativamente il [DNS crittografato](advanced/dns-overview.md#what-is-encrypted-dns).
|
I software proxy per il DNS crittografato forniscono un proxy locale a cui inoltrare le richieste [DNS non crittografate](advanced/dns-overview.md#unencrypted-dns). Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ I software proxy per il DNS crittografato forniscono un proxy locale a cui inolt
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Soluzioni ospitate autonomamente
|
## Criteri
|
||||||
|
|
||||||
Una soluzione DNS self-hosted è utile per fornire il filtraggio su piattaforme controllate, come Smart TV e altri dispositivi IoT, poiché non è necessario alcun software lato client.
|
**Ti preghiamo di notare che non siamo affiliati con alcun progetto consigliato.** Oltre ai [nostri criteri standard](about/criteria.md), abbiamo sviluppato una serie chiara di requisiti per consentirci di fornire consigli oggettivi. Ti suggeriamo di familiarizzare con questo elenco prima di scegliere di utilizzare un progetto e di condurre le tue ricerche per assicurarti che si tratti della scelta adatta a te.
|
||||||
|
|
||||||
### AdGuard Home
|
### Requisiti minimi
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [Minimizzazione QNAME](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Preferire il supporto di [anycast](https://it.wikipedia.org/wiki/Anycast) o il supporto di geo-steering
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home dispone di un'interfaccia web raffinata per visualizzare i dettagli e gestire i contenuti bloccati.
|
|
||||||
|
|
||||||
[:octicons-home-16: Home](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Politica sulla Privacy" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentazione}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Codice Sorgente" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole è stato progettato per essere ospitato su un Raspberry Pi, ma non si limita a tale hardware. Il software dispone di un'interfaccia web intuitiva per visualizzare i dettagli e gestire i contenuti bloccati.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard memorizza le statistiche aggregate sulle prestazioni dei propri server DNS, ossia il numero di richieste complete a un server in particolare, il numero di richieste bloccate e la velocità d'elaborazione delle richieste. Inoltre, conserva e memorizza il database dei domini richiesti nelle ultime 24 ore. "Necessitiamo di queste informazioni per identificare e bloccare i nuovi tracciatori e minacce." "Inoltre, registriamo quante volte un tracciatore è stato bloccato. Necessitiamo di queste informazioni per rimuovere le regole obsolete dai nostri filtri." [https://adguard.com/it/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard memorizza le statistiche aggregate sulle prestazioni dei propri server DNS, ossia il numero di richieste complete a un server in particolare, il numero di richieste bloccate e la velocità d'elaborazione delle richieste. Inoltre, conserva e memorizza il database dei domini richiesti nelle ultime 24 ore. "Necessitiamo di queste informazioni per identificare e bloccare i nuovi tracciatori e minacce." "Inoltre, registriamo quante volte un tracciatore è stato bloccato. Necessitiamo di queste informazioni per rimuovere le regole obsolete dai nostri filtri." [https://adguard.com/it/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare raccoglie e memorizza soltanto i dati limitati delle richieste DNS inviate al risolutore 1.1.1.1. Il servizio del risolutore 1.1.1.1 non registra i dati personali e, gran parte dei dati delle richieste limitate e non personalmente identificabili, sono memorizzati soltanto per 25 ore. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare raccoglie e memorizza soltanto i dati limitati delle richieste DNS inviate al risolutore 1.1.1.1. Il servizio del risolutore 1.1.1.1 non registra i dati personali e, gran parte dei dati delle richieste limitate e non personalmente identificabili, sono memorizzati soltanto per 25 ore. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D registra soltanto i risolutori Premium con profili DNS personalizzati. I risolutori gratuiti non registrano dati. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D registra soltanto i risolutori Premium con profili DNS personalizzati. I risolutori gratuiti non registrano dati. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: Il servizio DNS di Mullvad è disponibile per tutti, abbonati a Mullvad VPN e non. La loro politica sulla privacy dichiara esplicitamente che non registrano in alcun modo le richieste DNS. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: Il servizio DNS di Mullvad è disponibile per tutti, abbonati a Mullvad VPN e non. La loro politica sulla privacy dichiara esplicitamente che non registrano in alcun modo le richieste DNS. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 raccoglie alcuni dati per monitorare e rispondere a eventuali minacce. Tali dati potrebbero essere poi rimescolati e condivisi, ad esempio ai fini della ricerca sulla sicurezza. Quad9 non raccoglie o registra gli indirizzi IP o qualsiasi altro dato ritenuto personalmente identificabile. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 raccoglie alcuni dati per monitorare e rispondere a eventuali minacce. Tali dati potrebbero essere poi rimescolati e condivisi, ad esempio ai fini della ricerca sulla sicurezza. Quad9 non raccoglie o registra gli indirizzi IP o qualsiasi altro dato ritenuto personalmente identificabile. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be
|
|||||||
|
|
||||||
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### OSでのネイティブサポート
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9以降ではDNS over TLSをサポートしています。 設定は以下にて確認できます： **設定** → **ネットワーク & インターネット** → **プライベートDNS**.
|
||||||
|
|
||||||
|
#### Appleデバイス
|
||||||
|
|
||||||
|
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
||||||
|
|
||||||
|
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## What can an outside party see?
|
## What can an outside party see?
|
||||||
|
|
||||||
In this example we will record what happens when we make a DoH request:
|
In this example we will record what happens when we make a DoH request:
|
||||||
@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a
|
|||||||
|
|
||||||
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
||||||
|
|
||||||
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/ja/dns.md
183
i18n/ja/dns.md
@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [
|
|||||||
|
|
||||||
## 推奨するサービスプロバイダー
|
## 推奨するサービスプロバイダー
|
||||||
|
|
||||||
| DNSプロバイダー | プライバシーポリシー | プロトコル | ログ設定 | ECS | フィルタリング |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | --- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Some[^1] | Yes | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH/3 <br> DoT | Some[^2] | いいえ | Based on personal configuration. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^3] | いいえ | Based on personal configuration. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | いいえ[^4] | いいえ | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^5] | 任意 | Based on personal configuration. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^6] | 任意 | Based on personal configuration, Malware blocking by default. |
|
|
||||||
|
|
||||||
### 規準
|
| DNSプロバイダー | プライバシーポリシー | プロトコル | ログ設定 | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | フィルタリング | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | いいえ | Based on server choice. | [いいえ](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | いいえ | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | いいえ | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | いいえ[^4] | いいえ | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | 任意 | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**私たちは、推薦するどのプロジェクトとも提携していません。**客観的に推薦できるよう、[標準となる規準](about/criteria.md)に加えて、一連の明確な要件を定めています。 プロジェクトを利用する前に、このリストをよく理解し、ご自身で調査を行って、そのプロジェクトがあなたにとって適切な選択かどうかをご確認ください。
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec)のサポートを必須とする。
|
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
||||||
- [QNAMEの最小化](advanced/dns-overview.md#what-is-qname-minimization)。
|
|
||||||
- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled.
|
|
||||||
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
|
||||||
|
|
||||||
## OSでのネイティブサポート
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9以降ではDNS over TLSをサポートしています。 設定は以下にて確認できます： **設定** → **ネットワーク & インターネット** → **プライベートDNS**.
|
{ align=right }
|
||||||
|
|
||||||
### Appleデバイス
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### 署名済みプロファイル
|
</details>
|
||||||
|
|
||||||
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">詳細</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## 暗号化DNSプロキシ
|
## 暗号化DNSプロキシ
|
||||||
|
|
||||||
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## セルフホストソリューション
|
## 規準
|
||||||
|
|
||||||
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
**私たちは、推薦するどのプロジェクトとも提携していません。**客観的に推薦できるよう、[標準となる規準](about/criteria.md)に加えて、一連の明確な要件を定めています。 プロジェクトを利用する前に、このリストをよく理解し、ご自身で調査を行って、そのプロジェクトがあなたにとって適切な選択かどうかをご確認ください。
|
||||||
|
|
||||||
### AdGuard Home
|
### 最低要件
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [QNAMEの最小化](advanced/dns-overview.md#what-is-qname-minimization)。
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -70,9 +70,7 @@ DNS는 [인터넷의 초창기](https://ko.wikipedia.org/wiki/%EB%8F%84%EB%A9%94
|
|||||||
|
|
||||||
### DNSCrypt
|
### DNSCrypt
|
||||||
|
|
||||||
[**DNSCrypt**](https://en.wikipedia.org/wiki/DNSCrypt)는 DNS 쿼리를 암호화하는 최초의 방법 중 하나였습니다. DNSCrypt는 443 포트에서 작동하며, TCP/UDP 전송 프로토콜 모두에서 작동합니다. DNSCrypt는 [국제 인터넷 표준화 기구(IETF)](https://ko.wikipedia.org/wiki/%EA%B5%AD%EC%A0%9C_%EC%9D%B8%ED%84%B0%EB%84%B7_%ED%91%9C%EC%A4%80%ED%99%94_%EA%B8%B0%EA%B5%AC)에 제출되지 않았고
|
[**DNSCrypt**](https://en.wikipedia.org/wiki/DNSCrypt)는 DNS 쿼리를 암호화하는 최초의 방법 중 하나였습니다. DNSCrypt는 443 포트에서 작동하며, TCP/UDP 전송 프로토콜 모두에서 작동합니다. DNSCrypt는 [국제 인터넷 표준화 기구(IETF)](https://ko.wikipedia.org/wiki/%EA%B5%AD%EC%A0%9C_%EC%9D%B8%ED%84%B0%EB%84%B7_%ED%91%9C%EC%A4%80%ED%99%94_%EA%B8%B0%EA%B5%AC)에 제출되지 않았고RFC 절차를 거치지 않았기 때문에, [일부 구현체](https://dnscrypt.info/implementations)를 제외하고는 널리 사용되지 않았습니다. 결과적으로, 보다 널리 사용되는 [DNS over HTTPS](#dns-over-https-doh)로 대체되었습니다.</p>
|
||||||
|
|
||||||
RFC 절차를 거치지 않았기 때문에, [일부 구현체](https://dnscrypt.info/implementations)를 제외하고는 널리 사용되지 않았습니다. 결과적으로, 보다 널리 사용되는 [DNS over HTTPS](#dns-over-https-doh)로 대체되었습니다.</p>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -90,6 +88,32 @@ DoH 네이티브 구현은 iOS 14, macOS 11, Microsoft Windows, Android 13(단,
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
### 운영 체제 기본 지원
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9 이상 버전은 DNS over TLS를 지원합니다. 해당 설정은 **설정** → **네트워크 및 인터넷** → **비공개 DNS**에서 확인할 수 있습니다.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
#### Apple 기기
|
||||||
|
|
||||||
|
iOS, iPadOS, tvOS, macOS 최신 버전은 DoT, DoH를 모두 지원합니다. 두 프로토콜 모두 [구성 프로필](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web)이나 [DNS 설정 API](https://developer.apple.com/documentation/networkextension/dns_settings)를 통해 운영 체제에서 기본으로 지원합니다.
|
||||||
|
|
||||||
|
구성 프로필이나, DNS 설정 API를 사용하는 앱을 설치하고 나면 DNS 구성에서 선택 가능합니다. VPN이 활성화되어 있는 경우, VPN 연결 내 DNS 요청은 시스템 전체 설정이 아닌 VPN의 DNS 설정을 사용합니다.
|
||||||
|
|
||||||
|
Apple은 암호화 DNS 프로필 생성을 위한 기본 인터페이스를 제공하지 않습니다. [보안 DNS 프로필 생성기(Secure DNS profile creator)](https://dns.notjakob.com/tool.html)는 자신만의 암호화 DNS 프로필을 생성할 수 있는 비공식 툴이지만, 프로필 서명은 불가능합니다. 프로필 서명은 프로필 출처 확인 및 무결성 보장에 도움이 되므로, 서명된 프로필이 선호됩니다. 서명된 구성 프로필에는 '확인 완료' 표시가 나타납니다. 코드 서명에 대한 자세한 내용은 [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html)을 참고하세요.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## 외부 주체는 무엇을 볼 수 있나요?
|
## 외부 주체는 무엇을 볼 수 있나요?
|
||||||
|
|
||||||
다음 예시에서는 DoH 요청 시 실제로 어떤 일이 일어나는지 기록해보겠습니다.
|
다음 예시에서는 DoH 요청 시 실제로 어떤 일이 일어나는지 기록해보겠습니다.
|
||||||
@ -401,4 +425,35 @@ While this process can be slightly more inefficient, in this example neither the
|
|||||||
|
|
||||||
ECS는 동영상 스트리밍이나 JavaScript 웹 앱 서비스에 때 자주 쓰이는 [콘텐츠 전송 네트워크(CDN)](https://ko.wikipedia.org/wiki/%EC%BD%98%ED%85%90%EC%B8%A0_%EC%A0%84%EC%86%A1_%EB%84%A4%ED%8A%B8%EC%9B%8C%ED%81%AC)처럼 클라이언트와 가까운 서버의 응답을 제공하여 데이터 전송 속도를 높이는 기술입니다.
|
ECS는 동영상 스트리밍이나 JavaScript 웹 앱 서비스에 때 자주 쓰이는 [콘텐츠 전송 네트워크(CDN)](https://ko.wikipedia.org/wiki/%EC%BD%98%ED%85%90%EC%B8%A0_%EC%A0%84%EC%86%A1_%EB%84%A4%ED%8A%B8%EC%9B%8C%ED%81%AC)처럼 클라이언트와 가까운 서버의 응답을 제공하여 데이터 전송 속도를 높이는 기술입니다.
|
||||||
|
|
||||||
단, ECS는 DNS 서버에 클라이언트의 위치에 관한 일부 정보를 알려주기 때문에 프라이버시 면에서 불이익이 존재합니다.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/ko/dns.md
183
i18n/ko/dns.md
@ -15,50 +15,126 @@ global:
|
|||||||
|
|
||||||
## 권장 제공 업체
|
## 권장 제공 업체
|
||||||
|
|
||||||
| DNS 제공 업체 | 프라이버시 정책 | 프로토콜 | 로그 보관 | ECS | 필터링 |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------- | ----- | ----------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | 일부[^1] | Yes | 개인 설정에 따라 달라집니다. 필터 목록은 여기에서 확인할 수 있습니다. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | 평문 <br> DoH/3 <br> DoT | 일부[^2] | 비활성화 | 개인 설정에 따라 달라집니다. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | 평문 <br> DoH/3 <br> DoT <br> DoQ | 선택적[^3] | 비활성화 | 개인 설정에 따라 달라집니다. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | 없음[^4] | 비활성화 | 개인 설정에 따라 달라집니다. 필터 목록은 여기에서 확인할 수 있습니다. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | 평문 <br> DoH/3 <br> DoT <br> DoQ | 선택적[^5] | 선택 사항 | 개인 설정에 따라 달라집니다. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | 평문 <br> DoH <br> DoT <br> DNSCrypt | 일부[^6] | 선택 사항 | 개인 설정에 따라 달라지지만, 멀웨어는 기본적으로 차단됩니다. |
|
|
||||||
|
|
||||||
### 평가 기준
|
| DNS 제공 업체 | 프라이버시 정책 | 프로토콜 | 로그 보관 | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | 필터링 | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | -------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | 일부[^1] | Anonymized | Based on server choice. 필터 목록은 여기에서 확인할 수 있습니다. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | 일부[^2] | 비활성화 | Based on server choice. | [비활성화](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | 선택적[^3] | 비활성화 | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | 비활성화 | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | 없음[^4] | 비활성화 | Based on server choice. 필터 목록은 여기에서 확인할 수 있습니다. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | 선택 사항 | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Privacy Guides는 권장 목록의 어떠한 프로젝트와도 제휴를 맺지 않았습니다.** 객관적인 권장 목록을 제공하기 위해, [일반적인 평가 기준](about/criteria.md)에 더해 명확한 요구 사항을 정립하였습니다. 어떠한 프로젝트를 선택해 사용하기 전에, 이러한 요구 사항들을 숙지하고 여러분 스스로 조사하는 과정을 거쳐 적절한 선택을 하시기 바랍니다.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec)를 지원해야 합니다.
|
자체 호스팅 DNS 솔루션은 클라이언트 측 소프트웨어가 필요하지 않기 때문에, 스마트 TV 및 기타 IoT 기기처럼 통제된 플랫폼에서 필터링을 적용하기에 유용합니다.
|
||||||
- [QNAME 최소화](advanced/dns-overview.md#what-is-qname-minimization)를 지원해야 합니다.
|
|
||||||
- [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) 비활성화를 지원해야 합니다.
|
|
||||||
- [Anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) 혹은 Geo steering을 적극 지원해야 합니다.
|
|
||||||
|
|
||||||
## 운영 체제 기본 지원
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 이상 버전은 DNS over TLS를 지원합니다. 해당 설정은 **설정** → **네트워크 및 인터넷** → **비공개 DNS**에서 확인할 수 있습니다.
|
{ align=right }
|
||||||
|
|
||||||
### Apple 기기
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
iOS, iPadOS, tvOS, macOS 최신 버전은 DoT, DoH를 모두 지원합니다. 두 프로토콜 모두 [구성 프로필](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web)이나 [DNS 설정 API](https://developer.apple.com/documentation/networkextension/dns_settings)를 통해 운영 체제에서 기본으로 지원합니다.
|
Pi-hole은 라즈베리 파이에서 호스팅되도록 설계되었지만, 그 외 하드웨어에서도 사용할 수 있습니다. 친절한 웹 인터페이스를 통해 쉽고 빠른 분석 및 차단 콘텐츠 관리가 가능합니다.
|
||||||
|
|
||||||
구성 프로필이나, DNS 설정 API를 사용하는 앱을 설치하고 나면 DNS 구성에서 선택 가능합니다. VPN이 활성화되어 있는 경우, VPN 연결 내 DNS 요청은 시스템 전체 설정이 아닌 VPN의 DNS 설정을 사용합니다.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### 서명된 프로필
|
</details>
|
||||||
|
|
||||||
Apple은 암호화 DNS 프로필 생성을 위한 기본 인터페이스를 제공하지 않습니다. [보안 DNS 프로필 생성기(Secure DNS profile creator)](https://dns.notjakob.com/tool.html)는 자신만의 암호화 DNS 프로필을 생성할 수 있는 비공식 툴이지만, 프로필 서명은 불가능합니다. 프로필 서명은 프로필 출처 확인 및 무결성 보장에 도움이 되므로, 서명된 프로필이 선호됩니다. 서명된 구성 프로필에는 '확인 완료' 표시가 나타납니다. 코드 서명에 대한 자세한 내용은 [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html)을 참고하세요. **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
많은 Linux 배포판에서 DNS 조회에 사용하는 `systemd-resolved`는 아직 [DoH를 지원하지 않습니다](https://github.com/systemd/systemd/issues/8639). DoH를 사용하려는 경우, [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) 등의 프록시를 설치 및 [설정하여](https://wiki.archlinux.org/title/Dnscrypt-proxy), 시스템 리졸버에서 모든 DNS 요청을 가져와 HTTPS로 전달하도록 해야 합니다.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
세련된 웹 인터페이스를 통해 쉽고 빠른 분석 및 차단 콘텐츠 관리가 가능합니다.
|
||||||
|
|
||||||
|
[:octicons-home-16: 홈페이지](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="프라이버시 정책" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=문서}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="소스 코드" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## 암호화 DNS 프록시
|
## 암호화 DNS 프록시
|
||||||
|
|
||||||
암호화 DNS 프록시 소프트웨어는 [비암호화 DNS](advanced/dns-overview.md#unencrypted-dns) 리졸버로부터 요청을 전달 받는 로컬 프록시를 제공합니다. 보통 [암호화 DNS](advanced/dns-overview.md#what-is-encrypted-dns)를 기본적으로 지원하지 않는 플랫폼에서 사용됩니다.
|
암호화 DNS 프록시 소프트웨어는 [비암호화 DNS](advanced/dns-overview.md#unencrypted-dns) 리졸버로부터 요청을 전달 받는 로컬 프록시를 제공합니다. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Apple은 암호화 DNS 프로필 생성을 위한 기본 인터페이스를 제
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## 자체 호스팅 솔루션
|
## 평가 기준
|
||||||
|
|
||||||
자체 호스팅 DNS 솔루션은 클라이언트 측 소프트웨어가 필요하지 않기 때문에, 스마트 TV 및 기타 IoT 기기처럼 통제된 플랫폼에서 필터링을 적용하기에 유용합니다.
|
**Privacy Guides는 권장 목록의 어떠한 프로젝트와도 제휴를 맺지 않았습니다.** 객관적인 권장 목록을 제공하기 위해, [일반적인 평가 기준](about/criteria.md)에 더해 명확한 요구 사항을 정립하였습니다. 어떠한 프로젝트를 선택해 사용하기 전에, 이러한 요구 사항들을 숙지하고 여러분 스스로 조사하는 과정을 거쳐 적절한 선택을 하시기 바랍니다.
|
||||||
|
|
||||||
### AdGuard Home
|
### 최소 요구 사항
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [QNAME 최소화](advanced/dns-overview.md#what-is-qname-minimization)를 지원해야 합니다.
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- [Anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) 혹은 Geo steering을 적극 지원해야 합니다.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
세련된 웹 인터페이스를 통해 쉽고 빠른 분석 및 차단 콘텐츠 관리가 가능합니다.
|
|
||||||
|
|
||||||
[:octicons-home-16: 홈페이지](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="프라이버시 정책" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=문서}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="소스 코드" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole은 라즈베리 파이에서 호스팅되도록 설계되었지만, 그 외 하드웨어에서도 사용할 수 있습니다. 친절한 웹 인터페이스를 통해 쉽고 빠른 분석 및 차단 콘텐츠 관리가 가능합니다.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard는 특정 서버의 완료된 요청 수, 차단된 요청 수, 요청 처리 속도 등 DNS 서버의 집계 성능 지표를 저장합니다. 또한, 지난 24시간 이내의 도메인 요청 데이터베이스를 보관 및 저장합니다. "해당 정보는 새로운 추적기 및 위협을 식별하고 차단하기 위해 필요합니다." "각 추적기가 차단된 횟수 또한 기록합니다. 이는 오래되어 불필요한 규칙을 필터에서 제거하기 위해 필요합니다." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard는 특정 서버의 완료된 요청 수, 차단된 요청 수, 요청 처리 속도 등 DNS 서버의 집계 성능 지표를 저장합니다. 또한, 지난 24시간 이내의 도메인 요청 데이터베이스를 보관 및 저장합니다. "해당 정보는 새로운 추적기 및 위협을 식별하고 차단하기 위해 필요합니다." "각 추적기가 차단된 횟수 또한 기록합니다. 이는 오래되어 불필요한 규칙을 필터에서 제거하기 위해 필요합니다." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare는 1.1.1.1 리졸버로 전송되는 DNS 쿼리의 제한된 데이터만 수집 및 저장합니다. 1.1.1.1 리졸버는 개인 데이터를 기록하지 않으며, 개인 식별이 불가능하도록 제한된 쿼리 데이터는 대부분 25시간 동안만 저장됩니다. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare는 1.1.1.1 리졸버로 전송되는 DNS 쿼리의 제한된 데이터만 수집 및 저장합니다. 1.1.1.1 리졸버는 개인 데이터를 기록하지 않으며, 개인 식별이 불가능하도록 제한된 쿼리 데이터는 대부분 25시간 동안만 저장됩니다. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D는 사용자 정의 프로필이 있는 프리미엄 리졸버에 대해서만 로그를 기록합니다. 무료 리졸버는 데이터를 기록하지 않습니다. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D는 사용자 정의 프로필이 있는 프리미엄 리졸버에 대해서만 로그를 기록합니다. 무료 리졸버는 데이터를 기록하지 않습니다. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: Mullvad DNS 서비스는 Mullvad VPN 가입자/비가입자 모두 이용 가능합니다. 프라이버시 정책 상, 어떤 방식으로든 DNS 요청을 기록하지 않는다고 명시되어 있습니다. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: Mullvad DNS 서비스는 Mullvad VPN 가입자/비가입자 모두 이용 가능합니다. 프라이버시 정책 상, 어떤 방식으로든 DNS 요청을 기록하지 않는다고 명시되어 있습니다. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9은 위협 모니터링 및 대응 목적으로 일부 데이터를 수집합니다. 해당 데이터는 보안 연구 등의 목적으로 변형 후 공유될 수 있습니다. Quad9은 개인 식별 용도로 쓰일 수 있다고 판단되는 IP 주소 및 기타 데이터를 수집하거나 기록하지 않습니다. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9은 위협 모니터링 및 대응 목적으로 일부 데이터를 수집합니다. 해당 데이터는 보안 연구 등의 목적으로 변형 후 공유될 수 있습니다. Quad9은 개인 식별 용도로 쓰일 수 있다고 판단되는 IP 주소 및 기타 데이터를 수집하거나 기록하지 않습니다. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be
|
|||||||
|
|
||||||
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Native Operating System Support
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
ئەندرۆید 9 و سەرووتر پشتگیری DNS دەکەن لە ڕێگەی TLS. ڕێکخستنەکان دەتوانرێ بدۆزرێتەوە لە: **Settings**→**Network & Internet**→**Private DNS**.
|
||||||
|
|
||||||
|
#### Apple Devices
|
||||||
|
|
||||||
|
کۆتا وەشەنەکان لە tvOS، iPadOS، iOS لەگەڵ macOS هەموویان پشتگیری لە DoT و DoH دەکەن. هەردوو پرۆتۆکۆلەکە بە شێوەیەکی ڕەسەن پشتگیری دەکرێن لە ڕێگەی [شێوەپێدانی پڕؤفایلەکان](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) یان لە ڕێگەی [ڕێکخستنەکانیDNS API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
دوای دامەزراندنی شێوەپێدانێکی پڕۆفایل یان کاربەرنامەیەک کە ڕێکخستنەکانی DNS API بەکاردێنێ، دەتوانیت شێوەپێدانی DNS دیاریبکەیت. ئەگەر VPN چالاک بێت، چارەسەری ناو تونێلی VPNـەکە ڕێکخستەنەکانی DNSـی VPNـەکە بەکاردێنیت. نەک ڕێکخستەنە فراوانەکەی سیستەمەکەت.
|
||||||
|
|
||||||
|
Apple ڕووکارێکی بنەچەیی دابین ناکات بۆ دروستکردنی پرۆفایلی DNSـی شفرەکراو. [ دروستکەری پرۆفایلی DNSـی پارێزراو](https://dns.notjakob.com/tool.html) ئامرازێکی نافەرمییە بۆ دروستکردنی پرۆفایلی DNSـی شفرەکراوی تایبەت بەخۆت، بەڵام هەرچۆنێک بێت ئەوان واژۆ ناکرێن. پرۆڤایلی واژۆکراو پەسندن؛ واژۆکە سەرچاوەی پرۆفایلەکە ڕوون دەکاتەوە و یارمەتیدەرە بۆ دڵنیابوون لە ڕاستی پرۆفایلەکان. نیشانەیەکی "پشتڕاستکراو" بە ڕەنگی سەوز دراوە بە پرۆفایلی شێوەپێدانی واژۆکراو. بۆ زانیاری زیاتر لەسەر هێمای واژۆکان، [ دەربارەی هێمای واژۆکان](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html) ببینە.
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## What can an outside party see?
|
## What can an outside party see?
|
||||||
|
|
||||||
In this example we will record what happens when we make a DoH request:
|
In this example we will record what happens when we make a DoH request:
|
||||||
@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a
|
|||||||
|
|
||||||
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
||||||
|
|
||||||
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
@ -15,50 +15,126 @@ DNSـی شفرکراو تەنها دەبێت بەکار بهێنرێت لەگە
|
|||||||
|
|
||||||
## دابینکەرانی پێشنیارکراو
|
## دابینکەرانی پێشنیارکراو
|
||||||
|
|
||||||
| دابینکەری DNS | سیاسەتی تایبەتێتـی | پڕۆتۆکۆڵەکان | هەڵگرتنی تۆمار | ECS | پاڵاوتن |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------------ | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | هەندێک[^1] | Yes | Based on personal configuration. لیستی پاڵاوتنی بەکارهێنراو لێرە دەدۆزرێتەوە. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH <br> DoT | هەندێک[^2] | نەخێر | Based on personal configuration. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | ئارەزوومەندانە[^3] | نەخێر | Based on personal configuration. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | نەخێر[^4] | نەخێر | Based on personal configuration. لیستی پاڵاوتنی بەکارهێنراو لێرە دەدۆزرێتەوە. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | ئارەزوومەندانە[^5] | ئارەزوومەندانە | Based on personal configuration. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | هەندێک[^6] | ئارەزوومەندانە | Based on personal configuration, Malware blocking by default. |
|
|
||||||
|
|
||||||
### Criteria
|
| دابینکەری DNS | سیاسەتی تایبەتێتـی | پڕۆتۆکۆڵەکان | هەڵگرتنی تۆمار | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | پاڵاوتن | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------------ | -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | هەندێک[^1] | Anonymized | Based on server choice. لیستی پاڵاوتنی بەکارهێنراو لێرە دەدۆزرێتەوە. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | هەندێک[^2] | نەخێر | Based on server choice. | [نەخێر](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | ئارەزوومەندانە[^3] | نەخێر | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | نەخێر | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | نەخێر[^4] | نەخێر | Based on server choice. لیستی پاڵاوتنی بەکارهێنراو لێرە دەدۆزرێتەوە. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | ئارەزوومەندانە | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**تکایە تێبینی ئەوە بکە کە ئێمە سەر بە هیچ کام لەو پرۆژانە نین کە پێشنیاری دەکەین.** وە جگە لە [ پێوەرە بنچینەییەکانمان](about/criteria.md), ئێمە کۆمەڵێک مەرجی ڕوونمان دامەزراندووە بۆ ئەوەی ڕێگەمان پێبدات پێشنیاری ڕاست بکەین. ئێمە پێشنیاری ئەوە دەکەین کە تۆ خۆت ئاشنا بکەیت لەگەڵ ئەم لیستە پێش هەڵبژاردن و بەکارهێنانی دابینکەرەکە وە لێکۆڵینەوەی خۆت بکەیت بۆ دڵنیابوون لەوەی، کە ئەمە هەڵبژاردنێکی گونجاوە بۆ تۆ.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- پێویستە بشتگیری [DNSSEC](advanced/dns-overview.md#what-is-dnssec) بکات.
|
سەرپەرشتیکردنی-خودی DNS چارەسەرێکی بەسوودە بۆ دابینکردنی پاڵاوتن بۆ ئامێرە سەرپەرشتی کراوەکانی وەک تەلەڤزیۆنی زیرەک و ئامێرە زیرەکەکانی تر، چونکە پێویستی بە هیچ نەرمەواڵەیەکی ڕاژەخواز نیە.
|
||||||
- [بچووکردنەوەی QNAME](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- ڕێگە بە ناچالاک کردنی [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) بدات.
|
|
||||||
- پەسند کردنی [Anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) یان پشتگیری "ئاڕاستەی-جوگرافی".
|
|
||||||
|
|
||||||
## Native Operating System Support
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
ئەندرۆید 9 و سەرووتر پشتگیری DNS دەکەن لە ڕێگەی TLS. ڕێکخستنەکان دەتوانرێ بدۆزرێتەوە لە: **Settings**→**Network & Internet**→**Private DNS**.
|
{ align=right }
|
||||||
|
|
||||||
### Apple Devices
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
کۆتا وەشەنەکان لە tvOS، iPadOS، iOS لەگەڵ macOS هەموویان پشتگیری لە DoT و DoH دەکەن. هەردوو پرۆتۆکۆلەکە بە شێوەیەکی ڕەسەن پشتگیری دەکرێن لە ڕێگەی [شێوەپێدانی پڕؤفایلەکان](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) یان لە ڕێگەی [ڕێکخستنەکانیDNS API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
Pi-hole وا دروست کراوە کە لەسەر Rasberry Pi سەرپەرشتی بکرێت ، بەڵام سنووردار نییە بۆ ئەم ڕەقەواڵەیە بە تەنها. نەرمەواڵەکە ڕووکارێکی ڕێک و پێک و ئاسان لە بەکارهێان دەبەخشێت بۆ بینینی تێگەیشتنەکان و بەڕێوەبردنی ناوەڕۆکە قەدەغەکراوەکان.
|
||||||
|
|
||||||
دوای دامەزراندنی شێوەپێدانێکی پڕۆفایل یان کاربەرنامەیەک کە ڕێکخستنەکانی DNS API بەکاردێنێ، دەتوانیت شێوەپێدانی DNS دیاریبکەیت. ئەگەر VPN چالاک بێت، چارەسەری ناو تونێلی VPNـەکە ڕێکخستەنەکانی DNSـی VPNـەکە بەکاردێنیت. نەک ڕێکخستەنە فراوانەکەی سیستەمەکەت.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### پرۆفایلە واژۆکراوەکان
|
</details>
|
||||||
|
|
||||||
Apple ڕووکارێکی بنەچەیی دابین ناکات بۆ دروستکردنی پرۆفایلی DNSـی شفرەکراو. [ دروستکەری پرۆفایلی DNSـی پارێزراو](https://dns.notjakob.com/tool.html) ئامرازێکی نافەرمییە بۆ دروستکردنی پرۆفایلی DNSـی شفرەکراوی تایبەت بەخۆت، بەڵام هەرچۆنێک بێت ئەوان واژۆ ناکرێن. پرۆڤایلی واژۆکراو پەسندن؛ واژۆکە سەرچاوەی پرۆفایلەکە ڕوون دەکاتەوە و یارمەتیدەرە بۆ دڵنیابوون لە ڕاستی پرۆفایلەکان. نیشانەیەکی "پشتڕاستکراو" بە ڕەنگی سەوز دراوە بە پرۆفایلی شێوەپێدانی واژۆکراو. بۆ زانیاری زیاتر لەسەر هێمای واژۆکان، [ دەربارەی هێمای واژۆکان](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html) ببینە. **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
`systemd-resolved`، کە زۆربەی دابەشکراوانی لینوکس بەکاری دێنن بۆ ئەنجامدانی گەرانی DNSـەکەیان. تاوەکو ئێستا [پشتگیری لە DoH ناکات](https://github.com/systemd/systemd/issues/8639). ئەگەر دەتەوێت DoH بەکاربێنی، ئەوا پێویستت بە دابەزاندی چارەسەرکەرێک هەیە وەک [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) هەیە وە [دەستکاری کردنی](https://wiki.archlinux.org/title/Dnscrypt-proxy) بۆ ئەوەی هەموو داواکاریەکانی DNSـەکەت کە لەلایەن سیستەمی چارەسەرکەرەکەت دێت بنێرێدرێت لەڕێگای HTTPSـەوە.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home ڕووکارێکی ڕێک و پێک دەبەخشێتە ماڵپەرەکەی بۆ بینینی تێگەیشتنەکان و بەڕێوەنردنی ناوەڕۆکە قەدەغەکراوەکان.
|
||||||
|
|
||||||
|
[:octicons-home-16: پەڕەی سەرەکی](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="سیاسەتی تایبەتێتی" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=دۆکیمێنتەکان}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="سەرچاوەی کۆد" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Encrypted DNS Proxies
|
## Encrypted DNS Proxies
|
||||||
|
|
||||||
نەرمەواڵەی بریکارانی DNSـی شفرکراو، بریکارێکی ناوخۆیی دابین دەکەن بۆ ئەوەی [چارەسەرکەری DNSـی شفر نەکراو](advanced/dns-overview.md#unencrypted-dns) ڕووی تێ بکات. بەشێوەیەکی گشتی بەکاردەهێنرێت لەسەر ئەو ئامێرانەی، کە لە بنچینەوە پشتگیری لە [DNSـی شفرکراو](advanced/dns-overview.md#what-is-encrypted-dns) ناکەن.
|
نەرمەواڵەی بریکارانی DNSـی شفرکراو، بریکارێکی ناوخۆیی دابین دەکەن بۆ ئەوەی [چارەسەرکەری DNSـی شفر نەکراو](advanced/dns-overview.md#unencrypted-dns) ڕووی تێ بکات. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Apple ڕووکارێکی بنەچەیی دابین ناکات بۆ دروستک
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Self-hosted Solutions
|
## Criteria
|
||||||
|
|
||||||
سەرپەرشتیکردنی-خودی DNS چارەسەرێکی بەسوودە بۆ دابینکردنی پاڵاوتن بۆ ئامێرە سەرپەرشتی کراوەکانی وەک تەلەڤزیۆنی زیرەک و ئامێرە زیرەکەکانی تر، چونکە پێویستی بە هیچ نەرمەواڵەیەکی ڕاژەخواز نیە.
|
**تکایە تێبینی ئەوە بکە کە ئێمە سەر بە هیچ کام لەو پرۆژانە نین کە پێشنیاری دەکەین.** وە جگە لە [ پێوەرە بنچینەییەکانمان](about/criteria.md), ئێمە کۆمەڵێک مەرجی ڕوونمان دامەزراندووە بۆ ئەوەی ڕێگەمان پێبدات پێشنیاری ڕاست بکەین. ئێمە پێشنیاری ئەوە دەکەین کە تۆ خۆت ئاشنا بکەیت لەگەڵ ئەم لیستە پێش هەڵبژاردن و بەکارهێنانی دابینکەرەکە وە لێکۆڵینەوەی خۆت بکەیت بۆ دڵنیابوون لەوەی، کە ئەمە هەڵبژاردنێکی گونجاوە بۆ تۆ.
|
||||||
|
|
||||||
### AdGuard Home
|
### Minimum Requirements
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [بچووکردنەوەی QNAME](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- پەسند کردنی [Anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) یان پشتگیری "ئاڕاستەی-جوگرافی".
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home ڕووکارێکی ڕێک و پێک دەبەخشێتە ماڵپەرەکەی بۆ بینینی تێگەیشتنەکان و بەڕێوەنردنی ناوەڕۆکە قەدەغەکراوەکان.
|
|
||||||
|
|
||||||
[:octicons-home-16: پەڕەی سەرەکی](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="سیاسەتی تایبەتێتی" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=دۆکیمێنتەکان}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="سەرچاوەی کۆد" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole وا دروست کراوە کە لەسەر Rasberry Pi سەرپەرشتی بکرێت ، بەڵام سنووردار نییە بۆ ئەم ڕەقەواڵەیە بە تەنها. نەرمەواڵەکە ڕووکارێکی ڕێک و پێک و ئاسان لە بەکارهێان دەبەخشێت بۆ بینینی تێگەیشتنەکان و بەڕێوەبردنی ناوەڕۆکە قەدەغەکراوەکان.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard توانای ئەرک بەجێهێنانی ڕاژەی DNSـەکانیان کۆ دەکەنەوە، بەتایبەتی ژمارەی داواکاریە تەواوەکان بۆ ڕاژەیەکی دیاریکراو، ژمارەی داواکاریە قەدەغەکراوەکان، و خێرایی وەڵامدانەوەی داواکاریەکان. هەروەها ئەوان ئەو بنکە داتایانە هەڵدەگرن و کۆیدەکەنەوە، کە دۆمەینەکانی لێوە داواکراوە لە ماوەی 24 کاتژمێری ڕابردوو. "پێویستمان بەم زانیاریە هەیە بۆ ناسینەوە و ڕاگرتنی شوێنگران و هەڕەشە نوێیەکان" "هەروەها ئێمە تۆماری دەکەین کە چەند جار ئەم یان ئەو شوێنگرە ڕێگری لێکراوە. ئێمە پێویستمان بەم زانیاریە هەیە بۆ سڕینەوەی یاسای بەرسەرچوو لە پاڵاوتنەکانمان." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard توانای ئەرک بەجێهێنانی ڕاژەی DNSـەکانیان کۆ دەکەنەوە، بەتایبەتی ژمارەی داواکاریە تەواوەکان بۆ ڕاژەیەکی دیاریکراو، ژمارەی داواکاریە قەدەغەکراوەکان، و خێرایی وەڵامدانەوەی داواکاریەکان. هەروەها ئەوان ئەو بنکە داتایانە هەڵدەگرن و کۆیدەکەنەوە، کە دۆمەینەکانی لێوە داواکراوە لە ماوەی 24 کاتژمێری ڕابردوو. "پێویستمان بەم زانیاریە هەیە بۆ ناسینەوە و ڕاگرتنی شوێنگران و هەڕەشە نوێیەکان" "هەروەها ئێمە تۆماری دەکەین کە چەند جار ئەم یان ئەو شوێنگرە ڕێگری لێکراوە. ئێمە پێویستمان بەم زانیاریە هەیە بۆ سڕینەوەی یاسای بەرسەرچوو لە پاڵاوتنەکانمان." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare تەنها ئەو داتایە سنووردارە کۆدەکاتەوە و هەڵیدەگرێت، کە نێردراون لایەن DNS بۆ چارەسەرکەری 1.1.1.1. خزمەتگوزاری چارەسەرکەری 1.1.1.1 داتای کەسی تۆمار ناکات، وە ئەو بەشە داتایە سنووردارە نا-کەسیە ناسراوانە تەنها بۆ ماوەی 25 کاتژمێر هەڵدەگیرێن دەکرێت. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare تەنها ئەو داتایە سنووردارە کۆدەکاتەوە و هەڵیدەگرێت، کە نێردراون لایەن DNS بۆ چارەسەرکەری 1.1.1.1. خزمەتگوزاری چارەسەرکەری 1.1.1.1 داتای کەسی تۆمار ناکات، وە ئەو بەشە داتایە سنووردارە نا-کەسیە ناسراوانە تەنها بۆ ماوەی 25 کاتژمێر هەڵدەگیرێن دەکرێت. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D تەنها داتای ناسینەوە بۆ ئەو کەسانە تۆمار دەکات کە بەژداربووی چارەسەرکانیانن، وە پرۆفایلی DNSـی تایبەتیان هەیە. چارەسەرکەرە بەخۆڕایەکان داتا تۆمار ناکەن. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D تەنها داتای ناسینەوە بۆ ئەو کەسانە تۆمار دەکات کە بەژداربووی چارەسەرکانیانن، وە پرۆفایلی DNSـی تایبەتیان هەیە. چارەسەرکەرە بەخۆڕایەکان داتا تۆمار ناکەن. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: خزمەتگوزاری DNSـی Mullvad بەردەستە بۆ هەردووک لە بەکارهێنەری بەرژداربوو و نابەژداربوو. سیاسەتی تایبەتێتی ئەوان بە ڕوونی بانگەشەی ئەوە دەکات، کە بە هیچ شێوازێک داواکاریەکانی DNSـەکانیان تۆمار ناکەن. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: خزمەتگوزاری DNSـی Mullvad بەردەستە بۆ هەردووک لە بەکارهێنەری بەرژداربوو و نابەژداربوو. سیاسەتی تایبەتێتی ئەوان بە ڕوونی بانگەشەی ئەوە دەکات، کە بە هیچ شێوازێک داواکاریەکانی DNSـەکانیان تۆمار ناکەن. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 هەندێک داتا کۆ دەکاتەوە بۆ مەبەستی ئاگاداربوون لە هەڕەشە و وەڵامدانەوە. ئەو داتایە لەوانەیە دواتر دووبارە ببەسترێتەوە و هاوبەشی پێ بکرێت، بۆ مەبەستی لێکۆڵینەوەی ئاسایشی. Quad9 ناونیشانی IP یان ئەو داتایانەی تر کۆناکاتەوە و تۆماریان ناکات، کە بە داتای ناسینەوەی کەسی دادەنێرن. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 هەندێک داتا کۆ دەکاتەوە بۆ مەبەستی ئاگاداربوون لە هەڕەشە و وەڵامدانەوە. ئەو داتایە لەوانەیە دواتر دووبارە ببەسترێتەوە و هاوبەشی پێ بکرێت، بۆ مەبەستی لێکۆڵینەوەی ئاسایشی. Quad9 ناونیشانی IP یان ئەو داتایانەی تر کۆناکاتەوە و تۆماریان ناکات، کە بە داتای ناسینەوەی کەسی دادەنێرن. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ Versleutelde DNS kan verwijzen naar een van een aantal protocollen, waarvan de m
|
|||||||
|
|
||||||
Native implementatie van DoH dook op in iOS 14, macOS 11, Microsoft Windows, en Android 13 (het zal echter niet standaard worden ingeschakeld [](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). Algemene Linux desktop ondersteuning wacht op de systemd [implementatie](https://github.com/systemd/systemd/issues/8639) dus [het installeren van third-party software is nog steeds vereist](../dns.md#linux).
|
Native implementatie van DoH dook op in iOS 14, macOS 11, Microsoft Windows, en Android 13 (het zal echter niet standaard worden ingeschakeld [](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). Algemene Linux desktop ondersteuning wacht op de systemd [implementatie](https://github.com/systemd/systemd/issues/8639) dus [het installeren van third-party software is nog steeds vereist](../dns.md#linux).
|
||||||
|
|
||||||
|
### Ondersteuning voor besturingssystemen
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9 en hoger ondersteunen DNS over TLS. De instellingen kunnen worden gevonden in: **Instellingen** → **Netwerk & internet** → **Privé-DNS**.
|
||||||
|
|
||||||
|
#### Apple apparaten
|
||||||
|
|
||||||
|
De nieuwste versies van iOS, iPadOS, tvOS en macOS ondersteunen zowel DoT als DoH. Beide protocollen worden ondersteund via [configuratieprofielen](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) of via de [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
Na installatie van een configuratieprofiel of een app die gebruik maakt van de DNS Settings API, kan de DNS-configuratie worden geselecteerd. Als een VPN actief is, zal de resolutie binnen de VPN-tunnel de DNS-instellingen van het VPN gebruiken en niet je systeembrede instellingen.
|
||||||
|
|
||||||
|
Apple biedt geen native interface voor het maken van versleutelde DNS-profielen. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is een onofficiële tool voor het maken van je eigen versleutelde DNS-profielen, echter worden deze niet ondertekend. Ondertekende profielen hebben de voorkeur; ondertekening valideert de oorsprong van een profiel en helpt de integriteit van de profielen te waarborgen. Een groen "Geverifieerd" label wordt gegeven aan ondertekende configuratieprofielen. Voor meer informatie over het ondertekenen van codes, zie [Over het ondertekenen van codes](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## Wat kan een buitenstaander zien?
|
## Wat kan een buitenstaander zien?
|
||||||
|
|
||||||
In dit voorbeeld zullen we vastleggen wat er gebeurt als we een DoH-verzoek doen:
|
In dit voorbeeld zullen we vastleggen wat er gebeurt als we een DoH-verzoek doen:
|
||||||
@ -318,4 +336,27 @@ Het [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is ee
|
|||||||
|
|
||||||
Het is bedoeld om de levering van gegevens te "versnellen" door de client een antwoord te geven dat toebehoort aan een server die zich dicht bij hem bevindt, zoals een [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), die vaak worden gebruikt bij videostreaming en het serveren van JavaScript-webapps.
|
Het is bedoeld om de levering van gegevens te "versnellen" door de client een antwoord te geven dat toebehoort aan een server die zich dicht bij hem bevindt, zoals een [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), die vaak worden gebruikt bij videostreaming en het serveren van JavaScript-webapps.
|
||||||
|
|
||||||
Deze functie gaat wel ten koste van de privacy, aangezien de DNS-server informatie krijgt over de locatie van de client.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/nl/dns.md
183
i18n/nl/dns.md
@ -15,50 +15,126 @@ Versleutelde DNS met servers van derden zou alleen moeten worden gebruikt om sim
|
|||||||
|
|
||||||
## Aanbevolen Providers
|
## Aanbevolen Providers
|
||||||
|
|
||||||
| DNS-provider | Privacybeleid | Protocollen | Loggen | ECS | Filteren |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Beetje[^1] | Yes | Op basis van persoonlijke configuratie. De filterlijst die wordt gebruikt, is hier te vinden. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH/3 <br> DoT | Beetje[^2] | Nee | Op basis van persoonlijke configuratie. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optioneel[^3] | Nee | Op basis van persoonlijke configuratie. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | Geen[^4] | Nee | Op basis van persoonlijke configuratie. De filterlijst die wordt gebruikt, is hier te vinden. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optioneel[^5] | Optioneel | Op basis van persoonlijke configuratie. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Beetje[^6] | Optioneel | Gebaseerd op persoonlijke configuratie, blokkeert Malware. |
|
|
||||||
|
|
||||||
### Criteria
|
| DNS-provider | Privacybeleid | Protocollen | Loggen | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filteren | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Beetje[^1] | Anonymized | Based on server choice. De filterlijst die wordt gebruikt, is hier te vinden. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Beetje[^2] | Nee | Based on server choice. | [Nee](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optioneel[^3] | Nee | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Nee | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | Geen[^4] | Nee | Based on server choice. De filterlijst die wordt gebruikt, is hier te vinden. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optioneel | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Wij zijn niet verbonden aan de projecten die wij aanbevelen.** Naast [onze standaard criteria](about/criteria.md) hebben wij een duidelijke reeks eisen opgesteld om objectieve aanbevelingen te kunnen doen. We raden je aan deze lijst goed door te lezen voordat je een project kiest en je eigen onderzoek te doen om er zeker van te zijn dat het de juiste keuze voor jou is.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Moet [DNSSEC](advanced/dns-overview.md#what-is-dnssec) ondersteunen.
|
Een zelf gehoste DNS-oplossing is handig voor het bieden van filtering op gecontroleerde platforms, zoals Smart TV's en andere IoT-apparaten, omdat er geen client-side software nodig is.
|
||||||
- [QNAME Minimalisatie](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Toestaan dat [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) kan worden uitgeschakeld.
|
|
||||||
- Voorkeur voor [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) ondersteuning of geo-steering ondersteuning.
|
|
||||||
|
|
||||||
## Ondersteuning voor besturingssystemen
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 en hoger ondersteunen DNS over TLS. De instellingen kunnen worden gevonden in: **Instellingen** → **Netwerk & internet** → **Privé-DNS**.
|
{ align=right }
|
||||||
|
|
||||||
### Apple apparaten
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
De nieuwste versies van iOS, iPadOS, tvOS en macOS ondersteunen zowel DoT als DoH. Beide protocollen worden ondersteund via [configuratieprofielen](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) of via de [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
Pi-hole is ontworpen om te worden gehost op een Raspberry Pi, maar het is niet beperkt tot dergelijke hardware. De software beschikt over een vriendelijke webinterface om inzicht te krijgen en geblokkeerde inhoud te beheren.
|
||||||
|
|
||||||
Na installatie van een configuratieprofiel of een app die gebruik maakt van de DNS Settings API, kan de DNS-configuratie worden geselecteerd. Als een VPN actief is, zal de resolutie binnen de VPN-tunnel de DNS-instellingen van het VPN gebruiken en niet je systeembrede instellingen.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### Ondertekende Profielen
|
</details>
|
||||||
|
|
||||||
Apple biedt geen native interface voor het maken van versleutelde DNS-profielen. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is een onofficiële tool voor het maken van je eigen versleutelde DNS-profielen, echter worden deze niet ondertekend. Ondertekende profielen hebben de voorkeur; ondertekening valideert de oorsprong van een profiel en helpt de integriteit van de profielen te waarborgen. Een groen "Geverifieerd" label wordt gegeven aan ondertekende configuratieprofielen. Voor meer informatie over het ondertekenen van codes, zie [Over het ondertekenen van codes](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, die veel Linux-distributies gebruiken om hun DNS lookups te doen, [ondersteunt DoH nog niet](https://github.com/systemd/systemd/issues/8639). Als je DoH wilt gebruiken, moet je een proxy installeren zoals [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) en [configureren](https://wiki.archlinux.org/title/Dnscrypt-proxy) om alle DNS-query's van je systeem-resolver te nemen en ze over HTTPS door te sturen.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home beschikt over een vriendelijke webinterface om inzicht te krijgen en geblokkeerde inhoud te beheren.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacybeleid" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentatie}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Broncode" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Versleutelde DNS-proxy
|
## Versleutelde DNS-proxy
|
||||||
|
|
||||||
Versleutelde DNS-proxy software biedt een lokale proxy voor de [onversleutelde DNS](advanced/dns-overview.md#unencrypted-dns)-resolver om naar door te sturen. Meestal wordt het gebruikt op platformen die [versleutelde DNS](advanced/dns-overview.md#what-is-encrypted-dns)niet ondersteunen.
|
Versleutelde DNS-proxy software biedt een lokale proxy voor de [onversleutelde DNS](advanced/dns-overview.md#unencrypted-dns)-resolver om naar door te sturen. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Versleutelde DNS-proxy software biedt een lokale proxy voor de [onversleutelde D
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Zelf gehoste oplossingen
|
## Criteria
|
||||||
|
|
||||||
Een zelf gehoste DNS-oplossing is handig voor het bieden van filtering op gecontroleerde platforms, zoals Smart TV's en andere IoT-apparaten, omdat er geen client-side software nodig is.
|
**Wij zijn niet verbonden aan de projecten die wij aanbevelen.** Naast [onze standaard criteria](about/criteria.md) hebben wij een duidelijke reeks eisen opgesteld om objectieve aanbevelingen te kunnen doen. We raden je aan deze lijst goed door te lezen voordat je een project kiest en je eigen onderzoek te doen om er zeker van te zijn dat het de juiste keuze voor jou is.
|
||||||
|
|
||||||
### AdGuard Home
|
### Minimale vereisten
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [QNAME Minimalisatie](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Voorkeur voor [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) ondersteuning of geo-steering ondersteuning.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home beschikt over een vriendelijke webinterface om inzicht te krijgen en geblokkeerde inhoud te beheren.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacybeleid" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentatie}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Broncode" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole is ontworpen om te worden gehost op een Raspberry Pi, maar het is niet beperkt tot dergelijke hardware. De software beschikt over een vriendelijke webinterface om inzicht te krijgen en geblokkeerde inhoud te beheren.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard slaat geaggregeerde prestatiecijfers van hun DNS-servers op, namelijk het aantal volledige verzoeken aan een bepaalde server, het aantal geblokkeerde verzoeken, en de snelheid waarmee verzoeken worden verwerkt. Zij houden ook de database bij van domeinen die in de laatste 24 uur zijn aangevraagd. "We hebben deze informatie nodig om nieuwe trackers en bedreigingen te identificeren en te blokkeren." "We houden ook bij hoe vaak bepaalde trackers geblokkeerd zijn. We hebben deze informatie nodig om verouderde regels uit onze filters te verwijderen." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard slaat geaggregeerde prestatiecijfers van hun DNS-servers op, namelijk het aantal volledige verzoeken aan een bepaalde server, het aantal geblokkeerde verzoeken, en de snelheid waarmee verzoeken worden verwerkt. Zij houden ook de database bij van domeinen die in de laatste 24 uur zijn aangevraagd. "We hebben deze informatie nodig om nieuwe trackers en bedreigingen te identificeren en te blokkeren." "We houden ook bij hoe vaak bepaalde trackers geblokkeerd zijn. We hebben deze informatie nodig om verouderde regels uit onze filters te verwijderen." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare verzamelt en bewaart alleen de beperkte DNS-querygegevens die naar de 1.1.1.1 resolver worden gestuurd. De 1.1.1.1 resolver dienst logt geen persoonsgegevens, en het grootste deel van de beperkte niet-persoonlijk identificeerbare query-gegevens wordt slechts 25 uur bewaard. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare verzamelt en bewaart alleen de beperkte DNS-querygegevens die naar de 1.1.1.1 resolver worden gestuurd. De 1.1.1.1 resolver dienst logt geen persoonsgegevens, en het grootste deel van de beperkte niet-persoonlijk identificeerbare query-gegevens wordt slechts 25 uur bewaard. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D logt alleen voor Premium resolvers met aangepaste DNS-profielen. Gratis resolvers loggen geen gegevens. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D logt alleen voor Premium resolvers met aangepaste DNS-profielen. Gratis resolvers loggen geen gegevens. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: De DNS-service van Mullvad is beschikbaar voor zowel abonnees als niet-abonnees van Mullvad VPN. Hun privacybeleid beweert expliciet dat zij op geen enkele manier DNS-verzoeken loggen. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: De DNS-service van Mullvad is beschikbaar voor zowel abonnees als niet-abonnees van Mullvad VPN. Hun privacybeleid beweert expliciet dat zij op geen enkele manier DNS-verzoeken loggen. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 verzamelt sommige gegevens ten behoeve van de monitoring van en reactie op bedreigingen. Die gegevens kunnen vervolgens opnieuw worden gemengd en gedeeld, bijvoorbeeld ten behoeve van veiligheidsonderzoek. Quad9 verzamelt of registreert geen IP-adressen of andere gegevens die zij als persoonlijk identificeerbaar beschouwen. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 verzamelt sommige gegevens ten behoeve van de monitoring van en reactie op bedreigingen. Die gegevens kunnen vervolgens opnieuw worden gemengd en gedeeld, bijvoorbeeld ten behoeve van veiligheidsonderzoek. Quad9 verzamelt of registreert geen IP-adressen of andere gegevens die zij als persoonlijk identificeerbaar beschouwen. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be
|
|||||||
|
|
||||||
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Native Operating System Support
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Najnowsze wersje systemów iOS, iPadOS, tvOS oraz macOS obsługują zarówno DoT oraz DoH. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**.
|
||||||
|
|
||||||
|
#### Apple Devices
|
||||||
|
|
||||||
|
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
||||||
|
|
||||||
|
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## What can an outside party see?
|
## What can an outside party see?
|
||||||
|
|
||||||
In this example we will record what happens when we make a DoH request:
|
In this example we will record what happens when we make a DoH request:
|
||||||
@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a
|
|||||||
|
|
||||||
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
||||||
|
|
||||||
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/pl/dns.md
183
i18n/pl/dns.md
@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [
|
|||||||
|
|
||||||
## Rekomendowani dostawcy
|
## Rekomendowani dostawcy
|
||||||
|
|
||||||
| Dostawca DNS | Polityka prywatności | Protokoły | Rejestrowane dane | ECS | Filtrowanie |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ----------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Niektóre[^1] | Yes | Based on personal configuration. Listę filtrowania możesz znaleźć tutaj: [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH/3 <br> DoT | Niektóre[^2] | Nie | Based on personal configuration. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Do wyboru[^3] | Nie | Based on personal configuration. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | Żadne[^4] | Nie | Based on personal configuration. Listę filtrowania możesz znaleźć tutaj: [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Do wyboru[^5] | Do wyboru | Based on personal configuration. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Niektóre[^6] | Do wyboru | Based on personal configuration, Malware blocking by default. |
|
|
||||||
|
|
||||||
### Criteria
|
| Dostawca DNS | Polityka prywatności | Protokoły | Rejestrowane dane | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtrowanie | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ----------------- | -------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Niektóre[^1] | Anonymized | Based on server choice. Listę filtrowania możesz znaleźć tutaj: [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Niektóre[^2] | Nie | Based on server choice. | [Nie](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Do wyboru[^3] | Nie | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Nie | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | Żadne[^4] | Nie | Based on server choice. Listę filtrowania możesz znaleźć tutaj: [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Do wyboru | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
||||||
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled.
|
|
||||||
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
|
||||||
|
|
||||||
## Native Operating System Support
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Najnowsze wersje systemów iOS, iPadOS, tvOS oraz macOS obsługują zarówno DoT oraz DoH. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**.
|
{ align=right }
|
||||||
|
|
||||||
### Apple Devices
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### Signed Profiles
|
</details>
|
||||||
|
|
||||||
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Encrypted DNS Proxies
|
## Encrypted DNS Proxies
|
||||||
|
|
||||||
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Self-hosted Solutions
|
## Criteria
|
||||||
|
|
||||||
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||||
|
|
||||||
### AdGuard Home
|
### Minimum Requirements
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be
|
|||||||
|
|
||||||
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Native Operating System Support
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9 e superior suportam DNS sobre TLS. As configurações podem ser encontradas em: **Configurações** → **Rede & Internet** → **DNS particular**.
|
||||||
|
|
||||||
|
#### Apple Devices
|
||||||
|
|
||||||
|
As versões mais recentes do iOS, iPadOS, tvOS e macOS, suportam DoT e DoH. Ambos os protocolos são suportados nativamente através dos [perfis de configuração](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) ou através das [configurações de DNS API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
Após a instalação de um perfil de configuração ou de um aplicativo que usa a API de configurações de DNS, a configuração de DNS pode ser selecionada. Se uma VPN estiver ativa, a resolução no túnel VPN usará as configurações de DNS da VPN e não suas configurações gerais do sistema.
|
||||||
|
|
||||||
|
A Apple não fornece uma interface nativa para a criação de perfis DNS criptografados. Info Perfis assinados são preferidos; a assinatura valida a origem de um perfil e ajuda a garantir a integridade dos perfis. Uma marca de "Verificado" na cor verde é dada aos perfis de configuração assinados. Para mais informações sobre assinatura de código, ver [Sobre Assinatura de Código](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## What can an outside party see?
|
## What can an outside party see?
|
||||||
|
|
||||||
In this example we will record what happens when we make a DoH request:
|
In this example we will record what happens when we make a DoH request:
|
||||||
@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a
|
|||||||
|
|
||||||
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
||||||
|
|
||||||
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
@ -15,50 +15,126 @@ DNS criptografado com servidores de terceiros só deve ser usado para contornar
|
|||||||
|
|
||||||
## Provedores Recomendados
|
## Provedores Recomendados
|
||||||
|
|
||||||
| Provedor de DNS | Política de Privacidade | Protocolos | Registro | ECS | Filtragem |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Alguns[^1] | Yes | Based on personal configuration. As listas de filtragem usadas podem ser encontradas aqui. [**DNS over HTTPS**](https://en.wikipedia.org/wiki/DNS_over_HTTPS) as defined in [RFC 8484](https://datatracker.ietf.org/doc/html/rfc8484) packages queries in the [HTTP/2](https://en.wikipedia.org/wiki/HTTP/2) protocol and provides security with HTTPS. Support was first added in web browsers such as Firefox 60 and Chrome 83. |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH/3 <br> DoT | Alguns[^2] | Não | Based on personal configuration. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Opcional[^3] | Não | Based on personal configuration. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | Não[^4] | Não | Based on personal configuration. As listas de filtragem usadas podem ser encontradas aqui. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Opcional[^5] | Opcional | Based on personal configuration. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext <br> DoH/ <br> DoT <br> DNSCrypt | Alguns[^6] | Opcional | Based on personal configuration, Malware blocking by default. |
|
|
||||||
|
|
||||||
### Criteria
|
| Provedor de DNS | Política de Privacidade | Protocolos | Registro | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtragem | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Alguns[^1] | Anonymized | Based on server choice. As listas de filtragem usadas podem ser encontradas aqui. [**DNS over HTTPS**](https://en.wikipedia.org/wiki/DNS_over_HTTPS) as defined in [RFC 8484](https://datatracker.ietf.org/doc/html/rfc8484) packages queries in the [HTTP/2](https://en.wikipedia.org/wiki/HTTP/2) protocol and provides security with HTTPS. Support was first added in web browsers such as Firefox 60 and Chrome 83. | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Alguns[^2] | Não | Based on server choice. | [Não](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Opcional[^3] | Não | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Não | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | Não[^4] | Não | Based on server choice. As listas de filtragem usadas podem ser encontradas aqui. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Opcional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Por favor, note que não somos parceiros de nenhum dos produtos que recomendamos.** Além de [nossos requisitos básicos](about/criteria.md), desenvolvemos um conjunto claro de requisitos para nos permitir fornecer recomendações objetivas. Recomendamos que você se familiarize com esta lista antes de escolher usar um produto, e que faça sua própria pesquisa para garantir que o produto escolhido é o ideal para você.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Deve suportar [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
Uma solução de DNS auto-hospedada é útil para fornecer filtragem em plataformas limitadas como Smart TVs e outros dispositivos IoT, já que não é necessário nenhum “software” do lado do cliente.
|
||||||
- [Minimização QNAME](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Permitir que [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) seja desativado.
|
|
||||||
- Prefira suporte a [Anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) ou suporte a orientação geográfica.
|
|
||||||
|
|
||||||
## Native Operating System Support
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 e superior suportam DNS sobre TLS. As configurações podem ser encontradas em: **Configurações** → **Rede & Internet** → **DNS particular**.
|
{ align=right }
|
||||||
|
|
||||||
### Apple Devices
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
As versões mais recentes do iOS, iPadOS, tvOS e macOS, suportam DoT e DoH. Ambos os protocolos são suportados nativamente através dos [perfis de configuração](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) ou através das [configurações de DNS API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
O Pi-hole foi projetado para ser hospedado em um Raspberry Pi, mas não se limita a esse "hardware". O “software” apresenta uma interface web amigável para visualizar informações e gerenciar conteúdo bloqueado.
|
||||||
|
|
||||||
Após a instalação de um perfil de configuração ou de um aplicativo que usa a API de configurações de DNS, a configuração de DNS pode ser selecionada. Se uma VPN estiver ativa, a resolução no túnel VPN usará as configurações de DNS da VPN e não suas configurações gerais do sistema.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### Signed Profiles
|
</details>
|
||||||
|
|
||||||
A Apple não fornece uma interface nativa para a criação de perfis DNS criptografados. Info Perfis assinados são preferidos; a assinatura valida a origem de um perfil e ajuda a garantir a integridade dos perfis. Uma marca de "Verificado" na cor verde é dada aos perfis de configuração assinados. Para mais informações sobre assinatura de código, ver [Sobre Assinatura de Código](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, que muitas distribuições Linux usam para fazer suas pesquisas de DNS, ainda não [suporta DoH](https://github.com/systemd/systemd/issues/8639). Se você deseja usar o DoH, você precisará instalar um proxy como [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) e [configurá-lo](https://wiki. rchlinux.org/title/Dnscrypt-proxy) para pegar todas as consultas de DNS do resolvedor do sistema e encaminhá-los por HTTPS.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home apresenta um painel web amigável para ver informações e gerenciar conteúdos bloqueados.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Encrypted DNS Proxies
|
## Encrypted DNS Proxies
|
||||||
|
|
||||||
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -111,52 +187,19 @@ obnoxious --> | Yes | encryptedDNS(Use<br> encrypted DNS<br> with
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Soluções auto-hospedadas
|
## Criteria
|
||||||
|
|
||||||
Uma solução de DNS auto-hospedada é útil para fornecer filtragem em plataformas limitadas como Smart TVs e outros dispositivos IoT, já que não é necessário nenhum “software” do lado do cliente.
|
**Por favor, note que não somos parceiros de nenhum dos produtos que recomendamos.** Além de [nossos requisitos básicos](about/criteria.md), desenvolvemos um conjunto claro de requisitos para nos permitir fornecer recomendações objetivas. Recomendamos que você se familiarize com esta lista antes de escolher usar um produto, e que faça sua própria pesquisa para garantir que o produto escolhido é o ideal para você.
|
||||||
|
|
||||||
### AdGuard Home
|
### Minimum Requirements
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [Minimização QNAME](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Prefira suporte a [Anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) ou suporte a orientação geográfica.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home apresenta um painel web amigável para ver informações e gerenciar conteúdos bloqueados.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
O Pi-hole foi projetado para ser hospedado em um Raspberry Pi, mas não se limita a esse "hardware". O “software” apresenta uma interface web amigável para visualizar informações e gerenciar conteúdo bloqueado.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: O AdGuard armazena métricas de desempenho agregadas de seus servidores DNS, ou seja, o número de solicitações completas para um determinado servidor, o número de solicitações bloqueadas, e a velocidade de processamento dos pedidos. Eles também coletam e armazenam a base de dados de domínios solicitados nas últimas 24 horas. "Precisamos desta informação para identificar e bloquear novos rastreadores e ameaças". "Também registramos quantas vezes este ou aquele rastreador foi bloqueado. Precisamos desta informação para remover regras desatualizadas dos nossos filtros". [https://adguard-dns.io/pt_br/privacy.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: O AdGuard armazena métricas de desempenho agregadas de seus servidores DNS, ou seja, o número de solicitações completas para um determinado servidor, o número de solicitações bloqueadas, e a velocidade de processamento dos pedidos. Eles também coletam e armazenam a base de dados de domínios solicitados nas últimas 24 horas. "Precisamos desta informação para identificar e bloquear novos rastreadores e ameaças". "Também registramos quantas vezes este ou aquele rastreador foi bloqueado. Precisamos desta informação para remover regras desatualizadas dos nossos filtros". [https://adguard-dns.io/pt_br/privacy.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: O Cloudflare coleta e armazena apenas os dados limitados de consulta de DNS que são enviados para o resolvedor 1.1.1.1. O serviço de resolução 1.1.1.1 não registra dados pessoais, e a maior parte dos limitados dados de consulta, não pessoalmente identificáveis, é armazenado por apenas 25 horas. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: O Cloudflare coleta e armazena apenas os dados limitados de consulta de DNS que são enviados para o resolvedor 1.1.1.1. O serviço de resolução 1.1.1.1 não registra dados pessoais, e a maior parte dos limitados dados de consulta, não pessoalmente identificáveis, é armazenado por apenas 25 horas. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: ControlD somente coleta e armazena métricas para resolvedores "Premium" com perfis DNS personalizados. Resolvedores gratuitos não registram dados. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: ControlD somente coleta e armazena métricas para resolvedores "Premium" com perfis DNS personalizados. Resolvedores gratuitos não registram dados. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: O serviço DNS do Mullvad está disponível tanto para assinantes quanto para não assinantes do Mullvad VPN. A sua política de privacidade afirma explicitamente que não armazenam as solicitações DNS de maneira nenhuma. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: O serviço DNS do Mullvad está disponível tanto para assinantes quanto para não assinantes do Mullvad VPN. A sua política de privacidade afirma explicitamente que não armazenam as solicitações DNS de maneira nenhuma. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 coleta alguns dados para fins de monitoramento e resposta a ameaças. Esses dados podem então ser misturados e divulgados, por exemplo, para fins de pesquisas de segurança. Quad9 não coleta ou grava endereços IP, ou outros dados que eles considerem pessoalmente identificáveis. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 coleta alguns dados para fins de monitoramento e resposta a ameaças. Esses dados podem então ser misturados e divulgados, por exemplo, para fins de pesquisas de segurança. Quad9 não coleta ou grava endereços IP, ou outros dados que eles considerem pessoalmente identificáveis. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ O [**DNS sobre HTTPS**](https://en.wikipedia.org/wiki/DNS_over_HTTPS), tal como
|
|||||||
|
|
||||||
A implementação nativa do DoH apareceu no iOS 14, macOS 11, Microsoft Windows e Android 13 (no entanto, não será ativado [por predefinição](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). O suporte geral do ambiente de trabalho Linux está à espera da [implementação](https://github.com/systemd/systemd/issues/8639) do systemd, pelo que [ainda é necessário instalar software de terceiros](../dns.md#encrypted-dns-proxies).
|
A implementação nativa do DoH apareceu no iOS 14, macOS 11, Microsoft Windows e Android 13 (no entanto, não será ativado [por predefinição](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). O suporte geral do ambiente de trabalho Linux está à espera da [implementação](https://github.com/systemd/systemd/issues/8639) do systemd, pelo que [ainda é necessário instalar software de terceiros](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Native Operating System Support
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
As últimas versões do iOS, iPadOS, tvOS e macOS, suportam tanto DoT como DoH. Ambos os protocolos são suportados nativamente através de [perfis de configuração](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) ou através de [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
#### Apple Devices
|
||||||
|
|
||||||
|
Após a instalação de um perfil de configuração ou de um aplicativo que utiliza a API de configurações DNS, a configuração DNS pode ser selecionada. Se uma VPN estiver activa, a resolução dentro do túnel VPN utilizará as definições DNS da VPN e não as definições de todo o seu sistema.
|
||||||
|
|
||||||
|
A Apple não fornece uma interface nativa para a criação de perfis DNS criptografados. [Criador de perfil DNS seguro](https://dns.notjakob.com/tool.html) é uma ferramenta não oficial para criar os seus próprios perfis DNS encriptados, no entanto eles não serão assinados.
|
||||||
|
|
||||||
|
Apple does not provide a native interface for creating encrypted DNS profiles. Informações Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## O que é que uma pessoa de fora pode ver?
|
## O que é que uma pessoa de fora pode ver?
|
||||||
|
|
||||||
Neste exemplo, vamos registar o que acontece quando fazemos um pedido ao DoH:
|
Neste exemplo, vamos registar o que acontece quando fazemos um pedido ao DoH:
|
||||||
@ -318,4 +336,27 @@ A sub-rede de cliente [EDNS](https://en.wikipedia.org/wiki/EDNS_Client_Subnet)
|
|||||||
|
|
||||||
Destina-se a "acelerar" a entrega de dados, dando ao cliente uma resposta que pertence a um servidor que está perto dele, como uma rede de entrega de conteúdos [](https://en.wikipedia.org/wiki/Content_delivery_network), que são frequentemente utilizados em streaming de vídeo e no fornecimento de aplicações Web JavaScript.
|
Destina-se a "acelerar" a entrega de dados, dando ao cliente uma resposta que pertence a um servidor que está perto dele, como uma rede de entrega de conteúdos [](https://en.wikipedia.org/wiki/Content_delivery_network), que são frequentemente utilizados em streaming de vídeo e no fornecimento de aplicações Web JavaScript.
|
||||||
|
|
||||||
Esta funcionalidade tem um custo de privacidade, uma vez que fornece ao servidor DNS algumas informações sobre a localização do cliente.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
185
i18n/pt/dns.md
185
i18n/pt/dns.md
@ -15,52 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [
|
|||||||
|
|
||||||
## Provedores recomendados
|
## Provedores recomendados
|
||||||
|
|
||||||
| DNS | Política de Privacidade | Protocolo | Protocolos | Logging | ECS |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| ----------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ----------------------------------------------------------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Yes | Based on personal configuration. Filter list being used can be found here. [**DNS sobre HTTPS**](https://en.wikipedia.org/wiki/DNS_over_HTTPS) como definido em [RFC 8484](https://datatracker.ietf.org/doc/html/rfc8484) consultas de pacotes no protocolo [HTTP/2](https://en.wikipedia.org/wiki/HTTP/2) e fornece segurança com [HTTPS](https://en.wikipedia.org/wiki/HTTPS). |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Comercial | Cleartext <br> DoH <br> DoT | 4 | Based on personal configuration. |
|
|
||||||
| [**ControlID**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Comercial | Cleartext <br> DoH <br> DoT | 4 | Based on personal configuration. |
|
|
||||||
| [**IVPN**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | Comercial | DoH <br> DoT | 4 | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**PróximoDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Comercial | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Opcional[^5] | Based on personal configuration. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Comercial | Some[^6] | Opcional[^5] | Based on personal configuration, Malware blocking by default. |
|
|
||||||
|
|
||||||
### Framadate
|
| DNS | Política de Privacidade | Protocolo | Protocolos | [Logging](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | ECS | Signed Apple Profile |
|
||||||
|
| ----------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ----------------------------------------------------------- | ------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Anonymized | Based on server choice. Filter list being used can be found here. [**DNS sobre HTTPS**](https://en.wikipedia.org/wiki/DNS_over_HTTPS) como definido em [RFC 8484](https://datatracker.ietf.org/doc/html/rfc8484) consultas de pacotes no protocolo [HTTP/2](https://en.wikipedia.org/wiki/HTTP/2) e fornece segurança com [HTTPS](https://en.wikipedia.org/wiki/HTTPS). | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Cleartext <br> DoH <br> DoT | 4 | Based on server choice. | [4](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Cleartext <br> DoH <br> DoT | 4 | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | 4 | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**IVPN**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | DoH <br> DoT | 4 | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Opcional[^5] | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Deve suportar [DNSSEC](technology/dns.md#what-is-dnssec-and-when-is-it-used)
|
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
||||||
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled.
|
|
||||||
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
|
||||||
|
|
||||||
## Native Operating System Support
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
As últimas versões do iOS, iPadOS, tvOS e macOS, suportam tanto DoT como DoH. Ambos os protocolos são suportados nativamente através de [perfis de configuração](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) ou através de [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
{ align=right }
|
||||||
|
|
||||||
### Apple Devices
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
Após a instalação de um perfil de configuração ou de um aplicativo que utiliza a API de configurações DNS, a configuração DNS pode ser selecionada. Se uma VPN estiver activa, a resolução dentro do túnel VPN utilizará as definições DNS da VPN e não as definições de todo o seu sistema.
|
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
A Apple não fornece uma interface nativa para a criação de perfis DNS criptografados. [Criador de perfil DNS seguro](https://dns.notjakob.com/tool.html) é uma ferramenta não oficial para criar os seus próprios perfis DNS encriptados, no entanto eles não serão assinados.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### Signed Profiles
|
</details>
|
||||||
|
|
||||||
Apple does not provide a native interface for creating encrypted DNS profiles. Informações Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**DNSCloak** é um cliente iOS de código aberto que suporta [DNS-over-HTTPS](/dns/#dns-over-https-doh), [DNSCrypt](/dns/#dnscrypt), e [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy/wiki) opções como respostas DNS em cache, consultas DNS de registo local, e listas de blocos personalizadas. Os usuários podem [adicionar resolvedores personalizados por carimbo DNS](https://medium.com/privacyguides/adding-custom-dns-over-https-resolvers-to-dnscloak-20ff5845f4b5).
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### ControlID
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### PróximoDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Proxies DNS encriptados
|
## Proxies DNS encriptados
|
||||||
|
|
||||||
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -113,52 +187,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Soluções auto-hospedadas
|
## Framadate
|
||||||
|
|
||||||
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||||
|
|
||||||
### AdGuard Home
|
### Requisitos mínimos
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: Armazenamos métricas agregadas de desempenho do nosso servidor DNS, nomeadamente o número de pedidos completos para um determinado servidor, o número de pedidos bloqueados, a velocidade de processamento dos pedidos. Nós mantemos e armazenamos a base de dados de domínios solicitados nas últimas 24 horas. Precisamos dessas informações para identificar e bloquear novos rastreadores e ameaças. Também registramos quantas vezes este ou aquele rastreador foi bloqueado. Precisamos desta informação para remover regras desactualizadas dos nossos filtros.[https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: Armazenamos métricas agregadas de desempenho do nosso servidor DNS, nomeadamente o número de pedidos completos para um determinado servidor, o número de pedidos bloqueados, a velocidade de processamento dos pedidos. Nós mantemos e armazenamos a base de dados de domínios solicitados nas últimas 24 horas. Precisamos dessas informações para identificar e bloquear novos rastreadores e ameaças. Também registramos quantas vezes este ou aquele rastreador foi bloqueado. Precisamos desta informação para remover regras desactualizadas dos nossos filtros.[https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: O Cloudflare recolhe e armazena apenas os dados limitados da consulta DNS que são enviados para o resolvedor 1.1.1.1. O serviço resolver 1.1.1.1 não registra dados pessoais, e a maior parte dos dados de consulta limitados não identificáveis pessoalmente é armazenada apenas por 25 horas.[https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: O Cloudflare recolhe e armazena apenas os dados limitados da consulta DNS que são enviados para o resolvedor 1.1.1.1. O serviço resolver 1.1.1.1 não registra dados pessoais, e a maior parte dos dados de consulta limitados não identificáveis pessoalmente é armazenada apenas por 25 horas.[https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ DNS существует с [первых дней](https://en.wikipedia.org/wik
|
|||||||
|
|
||||||
Нативная реализация DoH появилась в iOS 14, macOS 11, Microsoft Windows и Android 13 (однако она не будет включена [по умолчанию](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). Общая поддержка Linux'а ожидает [реализации](https://github.com/systemd/systemd/issues/8639) systemd, поэтому [всё еще требуется установка стороннего программного обеспечения](../dns.md#encrypted-dns-proxies).
|
Нативная реализация DoH появилась в iOS 14, macOS 11, Microsoft Windows и Android 13 (однако она не будет включена [по умолчанию](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). Общая поддержка Linux'а ожидает [реализации](https://github.com/systemd/systemd/issues/8639) systemd, поэтому [всё еще требуется установка стороннего программного обеспечения](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Нативная поддержка в операционных системах
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9 и новее поддерживает DNS over TLS. Его можно включить в **Настройках** → **Сеть и интернет** → **Частный DNS-сервер**.
|
||||||
|
|
||||||
|
#### Устройства Apple
|
||||||
|
|
||||||
|
Последние версии iOS, iPadOS, tvOS и macOS поддерживают протоколы DoT и DoH. Оба протокола можно настроить при помощи [профилей конфигурации](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) или [API настроек DNS](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
После установки профиля конфигурации или приложения, использующего API настроек DNS, можно выбрать конфигурацию DNS. Если включен VPN, будут использоваться настройки DNS вашего VPN-сервиса, а не системные настройки.
|
||||||
|
|
||||||
|
Apple не предоставляет нативного интерфейса для создания профилей зашифрованного DNS. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) — это неофициальный инструмент создания собственных профилей зашифрованного DNS, однако они не будут подписаны. Предпочтительнее использовать подписанные профили, так как подпись подтверждает надёжность источника профиля и помогает обеспечить его целостность. Зеленая метка «Проверено» присваивается подписанным профилям конфигурации. Чтобы получить больше информации о подписанном коде, смотрите статью [«О подписывании кода»](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## Что может увидеть посторонний человек?
|
## Что может увидеть посторонний человек?
|
||||||
|
|
||||||
В этом примере мы запишем, что происходит, когда мы делаем запрос DoH:
|
В этом примере мы запишем, что происходит, когда мы делаем запрос DoH:
|
||||||
@ -318,4 +336,27 @@ While this process can be slightly more inefficient, in this example neither the
|
|||||||
|
|
||||||
Он предназначен для "ускорения" доставки данных путем предоставления клиенту ответа, принадлежащего серверу, который находится рядом, например, [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), которые часто используются при потоковой передаче видео и обслуживании веб-приложений JavaScript.
|
Он предназначен для "ускорения" доставки данных путем предоставления клиенту ответа, принадлежащего серверу, который находится рядом, например, [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), которые часто используются при потоковой передаче видео и обслуживании веб-приложений JavaScript.
|
||||||
|
|
||||||
Эта функция работает в ущерб конфиденциальности, поскольку она сообщает DNS-серверу некоторую информацию о местонахождении клиента.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/ru/dns.md
183
i18n/ru/dns.md
@ -15,50 +15,126 @@ global:
|
|||||||
|
|
||||||
## Рекомендованные провайдеры
|
## Рекомендованные провайдеры
|
||||||
|
|
||||||
| DNS-провайдер | Политика конфиденциальности | Протоколы | Логирование | ECS | Фильтрация |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ---------------- | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Частичное[^1] | Yes | В зависимости от персональной конфигурации. Используемый список фильтрации можно найти здесь. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Без шифрования <br> DoH/3 <br> DoT | Частичное[^2] | Нет | В зависимости от персональной конфигурации. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Без шифрования <br> DoH/3 <br> DoT <br> DoQ | Опциональное[^3] | Нет | В зависимости от персональной конфигурации. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | Нет[^4] | Нет | В зависимости от персональной конфигурации. Используемый список фильтрации можно найти здесь. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Без шифрования <br> DoH/3 <br> DoT <br> DoQ | Опциональное[^5] | Необязательное[^5] | В зависимости от персональной конфигурации. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Без шифрования <br> DoH <br> DoT <br> DNSCrypt | Частичное[^6] | Необязательное[^5] | В зависимости от персональной конфигурации, блокировка вредоносных программ по умолчанию. |
|
|
||||||
|
|
||||||
### Критерии
|
| DNS-провайдер | Политика конфиденциальности | Протоколы | Логирование | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Фильтрация | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ---------------- | -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Частичное[^1] | Anonymized | Based on server choice. Используемый список фильтрации можно найти здесь. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Частичное[^2] | Нет | Based on server choice. | [Нет](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Опциональное[^3] | Нет | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Нет | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | Нет[^4] | Нет | Based on server choice. Используемый список фильтрации можно найти здесь. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Необязательное[^5] | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Обратите внимание, что у нас нет связей ни с одним проектом, которые мы рекомендуем.** В дополнение к [нашим стандартным критериям](about/criteria.md) мы разработали четкий набор требований, позволяющий давать объективные рекомендации. Мы рекомендуем ознакомиться с данным списком перед выбором и провести самостоятельное исследование, чтобы убедиться, что для вас это правильный выбор.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Поддержка [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
DNS с самостоятельным хостингом полезно для обеспечения фильтрации на управляемых платформах, таких как телевизоры Smart TV и устройства IoT (Internet of Things - Интернет вещей), поскольку для этого не требуется клиентское ПО.
|
||||||
- [Минимизация QNAME](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Позволяет отключить [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs).
|
|
||||||
- Предпочтительна поддержка [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) или поддержка гео-позиционирования.
|
|
||||||
|
|
||||||
## Нативная поддержка в операционных системах
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 и новее поддерживает DNS over TLS. Его можно включить в **Настройках** → **Сеть и интернет** → **Частный DNS-сервер**.
|
{ align=right }
|
||||||
|
|
||||||
### Устройства Apple
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
Последние версии iOS, iPadOS, tvOS и macOS поддерживают протоколы DoT и DoH. Оба протокола можно настроить при помощи [профилей конфигурации](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) или [API настроек DNS](https://developer.apple.com/documentation/networkextension/dns_settings).
|
Pi-hole создана для развертывания на Raspberry Pi, но она не требует именно такого специфичного оборудования. Решение предлагает дружелюбный веб-интерфейс для просмотра подробных отчетов и управления блокировкой контента.
|
||||||
|
|
||||||
После установки профиля конфигурации или приложения, использующего API настроек DNS, можно выбрать конфигурацию DNS. Если включен VPN, будут использоваться настройки DNS вашего VPN-сервиса, а не системные настройки.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### Подписанные профили
|
</details>
|
||||||
|
|
||||||
Apple не предоставляет нативного интерфейса для создания профилей зашифрованного DNS. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) — это неофициальный инструмент создания собственных профилей зашифрованного DNS, однако они не будут подписаны. Предпочтительнее использовать подписанные профили, так как подпись подтверждает надёжность источника профиля и помогает обеспечить его целостность. Зеленая метка «Проверено» присваивается подписанным профилям конфигурации. Чтобы получить больше информации о подписанном коде, смотрите статью [«О подписывании кода»](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Инфо.</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, используемый во многих дистрибутивах Linux для DNS-запросов, всё еще [не поддерживает DoH](https://github.com/systemd/systemd/issues/8639). Если вы хотите использовать DoH, вам следует установить [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) и [настроить его](https://wiki.archlinux.org/title/Dnscrypt-proxy) для обработки всех DNS-запросов в системе по протоколу HTTPS.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home предлагает продуманный интерфейс для просмотра развёрнутых отчетов и управления блокировкой контента.
|
||||||
|
|
||||||
|
[:octicons-home-16: Официальный сайт](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Политика конфиденциальности" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Документация}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Исходный код" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Зашифрованные DNS-прокси
|
## Зашифрованные DNS-прокси
|
||||||
|
|
||||||
Зашифрованные DNS-прокси создают локальный прокси-сервер, на который будут перенаправляться запросы с вашего системного [незашифрованного DNS-резолвера](advanced/dns-overview.md#unencrypted-dns). Обычно они подходят для устройств, не поддерживающих [зашифрованный DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
Зашифрованные DNS-прокси создают локальный прокси-сервер, на который будут перенаправляться запросы с вашего системного [незашифрованного DNS-резолвера](advanced/dns-overview.md#unencrypted-dns). Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Apple не предоставляет нативного интерфейса д
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Решения для самостоятельного хостинга
|
## Критерии
|
||||||
|
|
||||||
DNS с самостоятельным хостингом полезно для обеспечения фильтрации на управляемых платформах, таких как телевизоры Smart TV и устройства IoT (Internet of Things - Интернет вещей), поскольку для этого не требуется клиентское ПО.
|
**Обратите внимание, что у нас нет связей ни с одним проектом, которые мы рекомендуем.** В дополнение к [нашим стандартным критериям](about/criteria.md) мы разработали четкий набор требований, позволяющий давать объективные рекомендации. Мы рекомендуем ознакомиться с данным списком перед выбором и провести самостоятельное исследование, чтобы убедиться, что для вас это правильный выбор.
|
||||||
|
|
||||||
### AdGuard Home
|
### Минимальные требования к сервисам
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [Минимизация QNAME](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Предпочтительна поддержка [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) или поддержка гео-позиционирования.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home предлагает продуманный интерфейс для просмотра развёрнутых отчетов и управления блокировкой контента.
|
|
||||||
|
|
||||||
[:octicons-home-16: Официальный сайт](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Политика конфиденциальности" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Документация}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Исходный код" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole создана для развертывания на Raspberry Pi, но она не требует именно такого специфичного оборудования. Решение предлагает дружелюбный веб-интерфейс для просмотра подробных отчетов и управления блокировкой контента.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard хранит показатели производительности их DNS серверов, содержащие в себе количество выполненных запросов к определенному серверу, количество заблокированных запросов и скорость обработки. Они также ведут и хранят базу данных доменов, запрошенных в течение последних 24 часов. "Нам нужна эта информация, чтобы выявлять и блокировать новые трекеры и угрозы." "Также мы храним информацию о том, сколько раз тот или иной трекер был заблокирован. Нам нужна эта информация, чтобы удалять устаревшие правила из наших фильтров." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard хранит показатели производительности их DNS серверов, содержащие в себе количество выполненных запросов к определенному серверу, количество заблокированных запросов и скорость обработки. Они также ведут и хранят базу данных доменов, запрошенных в течение последних 24 часов. "Нам нужна эта информация, чтобы выявлять и блокировать новые трекеры и угрозы." "Также мы храним информацию о том, сколько раз тот или иной трекер был заблокирован. Нам нужна эта информация, чтобы удалять устаревшие правила из наших фильтров." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare собирает и хранит только DNS-запросы, направленные на 1.1.1.1. Сервис не хранит персональные данные; большая часть неперсональных данных хранится только в течение 25 часов. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare собирает и хранит только DNS-запросы, направленные на 1.1.1.1. Сервис не хранит персональные данные; большая часть неперсональных данных хранится только в течение 25 часов. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D ведет логи только на Premium-серверах с пользовательскими DNS-профилями. Бесплатные сервера не ведут логов. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D ведет логи только на Premium-серверах с пользовательскими DNS-профилями. Бесплатные сервера не ведут логов. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: DNS-сервера Mullvad доступны и для пользователей Mullvad VPN, и для остальных пользователей Интернета. Их политика конфиденциальности утверждает, что они ни в каком виде не сохраняют DNS-запросы. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: DNS-сервера Mullvad доступны и для пользователей Mullvad VPN, и для остальных пользователей Интернета. Их политика конфиденциальности утверждает, что они ни в каком виде не сохраняют DNS-запросы. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 собирает некоторые данные в целях обнаружения угроз и реагирования на них. Эти данные могут быть изменены и переданы, например, в целях исследования безопасности. Quad9 не собирает и не хранит IP-адреса и другую информацию, которую они считают идентифицирующей пользователя. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 собирает некоторые данные в целях обнаружения угроз и реагирования на них. Эти данные могут быть изменены и переданы, например, в целях исследования безопасности. Quad9 не собирает и не хранит IP-адреса и другую информацию, которую они считают идентифицирующей пользователя. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be
|
|||||||
|
|
||||||
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Native Operating System Support
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**.
|
||||||
|
|
||||||
|
#### Apple Devices
|
||||||
|
|
||||||
|
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
||||||
|
|
||||||
|
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## What can an outside party see?
|
## What can an outside party see?
|
||||||
|
|
||||||
In this example we will record what happens when we make a DoH request:
|
In this example we will record what happens when we make a DoH request:
|
||||||
@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a
|
|||||||
|
|
||||||
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
||||||
|
|
||||||
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/sv/dns.md
183
i18n/sv/dns.md
@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [
|
|||||||
|
|
||||||
## Recommended Providers
|
## Recommended Providers
|
||||||
|
|
||||||
| DNS Provider | Integritetspolicy | Protocols | Logging | ECS | Filtering |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Some[^1] | Ja | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH/3 <br> DoT | Some[^2] | No | Based on personal configuration. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^3] | No | Based on personal configuration. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | No[^4] | No | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^5] | Optional | Based on personal configuration. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^6] | Optional | Based on personal configuration, Malware blocking by default. |
|
|
||||||
|
|
||||||
### Kriterier
|
| DNS Provider | Integritetspolicy | Protocols | Logging | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Ja](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | No | Based on server choice. | [Ja](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Ja](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Ja](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optional | Based on server choice, malware blocking by default. | [Ja](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Observera att vi inte är knutna till något av de projekt som vi rekommenderar.** Förutom [våra standardkriterier](about/criteria.md)har vi utvecklat en tydlig uppsättning krav som gör det möjligt för oss att ge objektiva rekommendationer. Vi föreslår att du bekantar dig med den här listan innan du väljer att använda ett projekt, och att du gör din egen forskning för att se till att det är rätt val för dig.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
||||||
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled.
|
|
||||||
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
|
||||||
|
|
||||||
## Native Operating System Support
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**.
|
{ align=right }
|
||||||
|
|
||||||
### Apple Devices
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### Signed Profiles
|
</details>
|
||||||
|
|
||||||
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Krypterade DNS-proxyservrar
|
## Krypterade DNS-proxyservrar
|
||||||
|
|
||||||
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Egenstyrda lösningar
|
## Kriterier
|
||||||
|
|
||||||
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
**Observera att vi inte är knutna till något av de projekt som vi rekommenderar.** Förutom [våra standardkriterier](about/criteria.md)har vi utvecklat en tydlig uppsättning krav som gör det möjligt för oss att ge objektiva rekommendationer. Vi föreslår att du bekantar dig med den här listan innan du väljer att använda ett projekt, och att du gör din egen forskning för att se till att det är rätt val för dig.
|
||||||
|
|
||||||
### AdGuard Home
|
### Minimikrav
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be
|
|||||||
|
|
||||||
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### İşletim Sistemi Desteği
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9 ve üstü, TLS üzerinden DNS'yi destekler. Ayarlar şurada bulunabilir: **Ayarlar** → **Ağ & İnternet** → **Özel DNS**.
|
||||||
|
|
||||||
|
#### Apple Cihazlar
|
||||||
|
|
||||||
|
iOS, iPadOS, tvOS ve macOS'in en son sürümleri hem DoT hem de DoH'yi desteklemektedir. Her iki protokol de [yapılandırma profilleri](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) veya [DNS Ayarları API'si](https://developer.apple.com/documentation/networkextension/dns_settings)aracılığıyla doğal olarak desteklenmektedir.
|
||||||
|
|
||||||
|
Bir yapılandırma profili veya DNS Ayarları API'sini kullanan bir uygulama yüklendikten sonra DNS yapılandırması seçilebilir. Bir VPN etkinse, VPN tüneli içindeki çözünürlük, sistem genelindeki ayarlarınızı değil VPN'in DNS ayarlarını kullanacaktır.
|
||||||
|
|
||||||
|
Apple şifrelenmiş DNS profilleri oluşturmak için yerel bir arayüz sağlamaz. [Güvenli DNS profil oluşturucu](https://dns.notjakob.com/tool.html) kendi şifreli DNS profillerinizi oluşturmak için resmi olmayan bir araçtır, ancak bunlar imzalanmayacaktır. İmzalanmış profiller tercih edilir; imzalama profilin kaynağını doğrular ve profillerin bütünlüğünü sağlamaya yardımcı olur. İmzalanmış yapılandırma profillerine yeşil bir "Doğrulandı" etiketi verilir. Kod imzalama hakkında daha fazla bilgi için bkz. [Kod İmzalama Hakkında](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## What can an outside party see?
|
## What can an outside party see?
|
||||||
|
|
||||||
In this example we will record what happens when we make a DoH request:
|
In this example we will record what happens when we make a DoH request:
|
||||||
@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a
|
|||||||
|
|
||||||
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
||||||
|
|
||||||
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/tr/dns.md
183
i18n/tr/dns.md
@ -15,50 +15,126 @@ global:
|
|||||||
|
|
||||||
## Önerilen Sağlayıcılar
|
## Önerilen Sağlayıcılar
|
||||||
|
|
||||||
| DNS Sağlayıcısı | Gizlilik Politikası | Protokoller | Günlük kaydı | ECS | Filtreleme |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ---------------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Bazı[^1] | Yes | Kişisel yapılandırmaya göre. Kullanılan filtre listesine buradan ulaşabilirsiniz. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH/3 <br> DoT | Bazı[^2] | Hayır | Kişisel yapılandırmaya göre. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | İsteğe bağlı[^3] | Hayır | Kişisel yapılandırmaya göre. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | Hayır[^4] | Hayır | Kişisel yapılandırmaya göre. Kullanılan filtre listesine buradan ulaşabilirsiniz. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | İsteğe bağlı[^5] | İsteğe bağlı | Kişisel yapılandırmaya göre. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Bazı[^6] | İsteğe bağlı | Kişisel yapılandırmaya göre, varsayılan olarak Kötü Amaçlı Yazılım engelleme. |
|
|
||||||
|
|
||||||
### Kriterler
|
| DNS Sağlayıcısı | Gizlilik Politikası | Protokoller | Günlük kaydı | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtreleme | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ---------------- | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Bazı[^1] | Anonymized | Based on server choice. Kullanılan filtre listesine buradan ulaşabilirsiniz. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Bazı[^2] | Hayır | Based on server choice. | [Hayır](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | İsteğe bağlı[^3] | Hayır | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Hayır | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | Hayır[^4] | Hayır | Based on server choice. Kullanılan filtre listesine buradan ulaşabilirsiniz. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | İsteğe bağlı | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Lütfen önerdiğimiz projelerin hiçbirine bağlı olmadığımızı unutmayın.** [standart kriterlerimize](about/criteria.md)ek olarak, objektif tavsiyelerde bulunabilmemiz için bir dizi gereklilik geliştirdik. Bir projeyi kullanmayı seçmeden önce bu listeye aşina olmanızı ve sizin için doğru seçim olduğundan emin olmak için kendi araştırmanızı yapmanızı öneririz.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec) desteklemelidir.
|
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
||||||
- [QNAME Minimizasyonu](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) adresinin devre dışı bırakılmasına izin verilmelidir.
|
|
||||||
- [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) desteği veya coğrafi yönlendirme desteği tercih edilmelidir.
|
|
||||||
|
|
||||||
## İşletim Sistemi Desteği
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 ve üstü, TLS üzerinden DNS'yi destekler. Ayarlar şurada bulunabilir: **Ayarlar** → **Ağ & İnternet** → **Özel DNS**.
|
{ align=right }
|
||||||
|
|
||||||
### Apple Cihazlar
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
iOS, iPadOS, tvOS ve macOS'in en son sürümleri hem DoT hem de DoH'yi desteklemektedir. Her iki protokol de [yapılandırma profilleri](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) veya [DNS Ayarları API'si](https://developer.apple.com/documentation/networkextension/dns_settings)aracılığıyla doğal olarak desteklenmektedir.
|
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
Bir yapılandırma profili veya DNS Ayarları API'sini kullanan bir uygulama yüklendikten sonra DNS yapılandırması seçilebilir. Bir VPN etkinse, VPN tüneli içindeki çözünürlük, sistem genelindeki ayarlarınızı değil VPN'in DNS ayarlarını kullanacaktır.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### İmzalı Profiller
|
</details>
|
||||||
|
|
||||||
Apple şifrelenmiş DNS profilleri oluşturmak için yerel bir arayüz sağlamaz. [Güvenli DNS profil oluşturucu](https://dns.notjakob.com/tool.html) kendi şifreli DNS profillerinizi oluşturmak için resmi olmayan bir araçtır, ancak bunlar imzalanmayacaktır. İmzalanmış profiller tercih edilir; imzalama profilin kaynağını doğrular ve profillerin bütünlüğünü sağlamaya yardımcı olur. İmzalanmış yapılandırma profillerine yeşil bir "Doğrulandı" etiketi verilir. Kod imzalama hakkında daha fazla bilgi için bkz. [Kod İmzalama Hakkında](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
Birçok Linux dağıtımının DNS aramalarını yapmak için kullandığı `systemd-resolved` henüz [DoH'u desteklemiyor] (https://github.com/systemd/systemd/issues/8639). DoH kullanmak istiyorsanız, sistem çözümleyicinizden tüm DNS sorgularını almak ve HTTPS üzerinden iletmek için [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) gibi bir proxy yüklemeniz ve [yapılandırmanız] (https://wiki.archlinux.org/title/Dnscrypt-proxy) gerekir.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Şifrelenmiş DNS Proxy'leri
|
## Şifrelenmiş DNS Proxy'leri
|
||||||
|
|
||||||
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Self-hosted Solutions
|
## Kriterler
|
||||||
|
|
||||||
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
**Lütfen önerdiğimiz projelerin hiçbirine bağlı olmadığımızı unutmayın.** [standart kriterlerimize](about/criteria.md)ek olarak, objektif tavsiyelerde bulunabilmemiz için bir dizi gereklilik geliştirdik. Bir projeyi kullanmayı seçmeden önce bu listeye aşina olmanızı ve sizin için doğru seçim olduğundan emin olmak için kendi araştırmanızı yapmanızı öneririz.
|
||||||
|
|
||||||
### AdGuard Home
|
### Minimum Requirements
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [QNAME Minimizasyonu](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) desteği veya coğrafi yönlendirme desteği tercih edilmelidir.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be
|
|||||||
|
|
||||||
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Native Operating System Support
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9 і вище підтримує DNS через TLS. Налаштування можна знайти тут: **Налаштування** → **Мережа & Інтернет** → **Приватний DNS**.
|
||||||
|
|
||||||
|
#### Apple Devices
|
||||||
|
|
||||||
|
Останні версії iOS, iPadOS, tvOS та macOS підтримують як DoT, так і DoH. Обидва протоколи підтримуються нативно через [профілі конфігурації](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) або через [API налаштувань DNS](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
Після встановлення профілю конфігурації або програми, яка використовує API налаштувань DNS, можна вибрати конфігурацію DNS. Якщо VPN активна, при вирішенні в тунелі VPN будуть використовуватися налаштування DNS VPN, а не ваші загальносистемні налаштування.
|
||||||
|
|
||||||
|
Apple не надає власного інтерфейсу для створення зашифрованих профілів DNS. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) — неофіційний інструмент для створення власних зашифрованих DNS профілів, які, однак, не будуть підписані. Підписаним профілям надається перевага; підпис підтверджує походження профілю і допомагає забезпечити цілісність профілів. Підписаним профілям конфігурації присвоюється зелена мітка "Перевірено". Для отримання додаткової інформації про підписання коду див. [Про підписання коду](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## What can an outside party see?
|
## What can an outside party see?
|
||||||
|
|
||||||
In this example we will record what happens when we make a DoH request:
|
In this example we will record what happens when we make a DoH request:
|
||||||
@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a
|
|||||||
|
|
||||||
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
||||||
|
|
||||||
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/uk/dns.md
183
i18n/uk/dns.md
@ -15,50 +15,126 @@ global:
|
|||||||
|
|
||||||
## Рекомендовані DNS-провайдери
|
## Рекомендовані DNS-провайдери
|
||||||
|
|
||||||
| DNS-провайдер | Політика конфіденційності | Протоколи | Логування | ECS | Фільтрація |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | --------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Деяке[^1] | Yes | Based on personal configuration. Список використовуваних фільтрів можна знайти тут. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Незашифрований текст <br> DoH/3 <br> DoT | Деяке[^2] | Ні | Based on personal configuration. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Незашифрований текст <br> DoH/3 <br> DoT <br> DoQ | Опціонально[^3] | Ні | Based on personal configuration. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | Немає[^4] | Ні | Based on personal configuration. Список використовуваних фільтрів можна знайти тут. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Незашифрований текст <br> DoH/3 <br> DoT <br> DoQ | Опціонально[^5] | Опціонально | Based on personal configuration. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Незашифрований текст <br> DoH <br> DoT <br> DNSCrypt | Деяке[^6] | Опціонально | Based on personal configuration, Malware blocking by default. |
|
|
||||||
|
|
||||||
### Criteria
|
| DNS-провайдер | Політика конфіденційності | Протоколи | Логування | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Фільтрація | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | --------------- | -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Деяке[^1] | Anonymized | Based on server choice. Список використовуваних фільтрів можна знайти тут. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Деяке[^2] | Ні | Based on server choice. | [Ні](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Опціонально[^3] | Ні | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | Ні | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | Немає[^4] | Ні | Based on server choice. Список використовуваних фільтрів можна знайти тут. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Опціонально | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Зверніть увагу, що ми не пов'язані з жодним з проектів, які ми рекомендуємо.** На додаток до [наших стандартних критеріїв](about/criteria.md), ми розробили чіткий набір вимог, які дозволяють нам надавати об'єктивні рекомендації. Ми пропонуємо вам ознайомитися з цим списком перед тим, як вибрати проект, і провести власне дослідження, щоб переконатися, що це правильний вибір для вас.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Повинен підтримувати [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
Самостійно розміщене рішення DNS корисно для забезпечення фільтрації на контрольованих платформах, таких як Smart TV та інші пристрої IoT, оскільки не потрібно клієнтське програмне забезпечення.
|
||||||
- [Мінімізація QNAME](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Дозвіл відключити [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs).
|
|
||||||
- Віддавайте перевагу підтримці [anycast,](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) або підтримці геонавігації.
|
|
||||||
|
|
||||||
## Native Operating System Support
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 і вище підтримує DNS через TLS. Налаштування можна знайти тут: **Налаштування** → **Мережа & Інтернет** → **Приватний DNS**.
|
{ align=right }
|
||||||
|
|
||||||
### Apple Devices
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
Останні версії iOS, iPadOS, tvOS та macOS підтримують як DoT, так і DoH. Обидва протоколи підтримуються нативно через [профілі конфігурації](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) або через [API налаштувань DNS](https://developer.apple.com/documentation/networkextension/dns_settings).
|
Pi-hole розроблений для розміщення на Raspberry Pi, але він не обмежується цим обладнанням. Програмне забезпечення має зручний веб-інтерфейс для перегляду аналітики та управління заблокованим контентом.
|
||||||
|
|
||||||
Після встановлення профілю конфігурації або програми, яка використовує API налаштувань DNS, можна вибрати конфігурацію DNS. Якщо VPN активна, при вирішенні в тунелі VPN будуть використовуватися налаштування DNS VPN, а не ваші загальносистемні налаштування.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### Підписані профілі
|
</details>
|
||||||
|
|
||||||
Apple не надає власного інтерфейсу для створення зашифрованих профілів DNS. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) — неофіційний інструмент для створення власних зашифрованих DNS профілів, які, однак, не будуть підписані. Підписаним профілям надається перевага; підпис підтверджує походження профілю і допомагає забезпечити цілісність профілів. Підписаним профілям конфігурації присвоюється зелена мітка "Перевірено". Для отримання додаткової інформації про підписання коду див. [Про підписання коду](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, за якою багато дистрибутивів Linux здійснюють вирішення своїх DNS-пошуків, поки що не [підтримують DoH](https://github.com/systemd/systemd/issues/8639). Якщо ви хочете використовувати DoH, вам потрібно встановити проксі на кшталт [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) і [налаштувати його] (https://wiki.archlinux.org/title/Dnscrypt-proxy), щоб він приймав усі DNS-запити від вашого системного розв'язувача і перенаправляв їх через HTTPS.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home має відшліфований веб-інтерфейс для перегляду аналітики та керування заблокованим контентом.
|
||||||
|
|
||||||
|
[:octicons-home-16: Домашня сторінка](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Політика конфіденційності" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Документація}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Вихідний код" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Encrypted DNS Proxies
|
## Encrypted DNS Proxies
|
||||||
|
|
||||||
Програмне забезпечення для проксі-серверів із зашифрованим DNS надає локальний проксі-сервер для перенаправлення на [незашифрованого DNS](advanced/dns-overview.md#unencrypted-dns). Зазвичай він використовується на платформах, які не підтримують [зашифрований DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
Програмне забезпечення для проксі-серверів із зашифрованим DNS надає локальний проксі-сервер для перенаправлення на [незашифрованого DNS](advanced/dns-overview.md#unencrypted-dns). Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Apple не надає власного інтерфейсу для створе
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Self-hosted Solutions
|
## Criteria
|
||||||
|
|
||||||
Самостійно розміщене рішення DNS корисно для забезпечення фільтрації на контрольованих платформах, таких як Smart TV та інші пристрої IoT, оскільки не потрібно клієнтське програмне забезпечення.
|
**Зверніть увагу, що ми не пов'язані з жодним з проектів, які ми рекомендуємо.** На додаток до [наших стандартних критеріїв](about/criteria.md), ми розробили чіткий набір вимог, які дозволяють нам надавати об'єктивні рекомендації. Ми пропонуємо вам ознайомитися з цим списком перед тим, як вибрати проект, і провести власне дослідження, щоб переконатися, що це правильний вибір для вас.
|
||||||
|
|
||||||
### AdGuard Home
|
### Minimum Requirements
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [Мінімізація QNAME](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Віддавайте перевагу підтримці [anycast,](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) або підтримці геонавігації.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home має відшліфований веб-інтерфейс для перегляду аналітики та керування заблокованим контентом.
|
|
||||||
|
|
||||||
[:octicons-home-16: Домашня сторінка](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Політика конфіденційності" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Документація}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Вихідний код" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole розроблений для розміщення на Raspberry Pi, але він не обмежується цим обладнанням. Програмне забезпечення має зручний веб-інтерфейс для перегляду аналітики та управління заблокованим контентом.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard зберігає агреговані показники продуктивності своїх DNS-серверів, а саме: кількість завершених запитів до певного сервера, кількість заблокованих запитів і швидкість обробки запитів. Вони також ведуть і зберігають базу даних доменів, до яких надходили запити протягом останніх 24 годин. "Нам потрібна ця інформація, щоб виявляти та блокувати нові трекери та загрози". "Ми також фіксуємо, скільки разів той чи інший трекер був заблокований. Нам потрібна ця інформація, щоб видалити застарілі правила з наших фільтрів". [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard зберігає агреговані показники продуктивності своїх DNS-серверів, а саме: кількість завершених запитів до певного сервера, кількість заблокованих запитів і швидкість обробки запитів. Вони також ведуть і зберігають базу даних доменів, до яких надходили запити протягом останніх 24 годин. "Нам потрібна ця інформація, щоб виявляти та блокувати нові трекери та загрози". "Ми також фіксуємо, скільки разів той чи інший трекер був заблокований. Нам потрібна ця інформація, щоб видалити застарілі правила з наших фільтрів". [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare збирає та зберігає лише обмежену кількість даних DNS-запитів, які надсилаються до вирішувача 1.1.1.1. Сервіс 1.1.1.1 не реєструє особисті дані, а основна частина обмежених неперсоніфікованих даних запитів зберігається лише протягом 25 годин. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare збирає та зберігає лише обмежену кількість даних DNS-запитів, які надсилаються до вирішувача 1.1.1.1. Сервіс 1.1.1.1 не реєструє особисті дані, а основна частина обмежених неперсоніфікованих даних запитів зберігається лише протягом 25 годин. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D веде журнали лише для преміум-вирішувачів зі спеціальними профілями DNS. Безкоштовні розв'язувачі не логують дані. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D веде журнали лише для преміум-вирішувачів зі спеціальними профілями DNS. Безкоштовні розв'язувачі не логують дані. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: DNS-сервіс Mullvad доступний обом підписникам та не підписникам Mullvad VPN. У їхній політиці конфіденційності чітко зазначено, що вони не реєструють DNS-запити жодним чином. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: DNS-сервіс Mullvad доступний обом підписникам та не підписникам Mullvad VPN. У їхній політиці конфіденційності чітко зазначено, що вони не реєструють DNS-запити жодним чином. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 збирає деякі дані з метою моніторингу загроз та реагування на них. Потім ці дані можуть бути змішані та поширені, наприклад, з метою дослідження безпеки. Quad9 не збирає і не записує IP-адреси або інші дані, які вони вважають особистими. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 збирає деякі дані з метою моніторингу загроз та реагування на них. Потім ці дані можуть бути змішані та поширені, наприклад, з метою дослідження безпеки. Quad9 не збирає і не записує IP-адреси або інші дані, які вони вважають особистими. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ Encrypted DNS can refer to one of a number of protocols, the most common ones be
|
|||||||
|
|
||||||
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
|
||||||
|
|
||||||
|
### Native Operating System Support
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**.
|
||||||
|
|
||||||
|
#### Apple Devices
|
||||||
|
|
||||||
|
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
||||||
|
|
||||||
|
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
||||||
|
|
||||||
|
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html).
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## What can an outside party see?
|
## What can an outside party see?
|
||||||
|
|
||||||
In this example we will record what happens when we make a DoH request:
|
In this example we will record what happens when we make a DoH request:
|
||||||
@ -318,4 +336,27 @@ The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a
|
|||||||
|
|
||||||
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
|
||||||
|
|
||||||
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location.
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/vi/dns.md
183
i18n/vi/dns.md
@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [
|
|||||||
|
|
||||||
## Recommended Providers
|
## Recommended Providers
|
||||||
|
|
||||||
| DNS Provider | Chính Sách Bảo Mật | Protocols | Logging | ECS | Filtering |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | Some[^1] | Yes | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH/3 <br> DoT | Some[^2] | No | Based on personal configuration. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^3] | No | Based on personal configuration. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | No[^4] | No | Based on personal configuration. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | Optional[^5] | Optional | Based on personal configuration. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | Some[^6] | Optional | Based on personal configuration, Malware blocking by default. |
|
|
||||||
|
|
||||||
### Framadate
|
| DNS Provider | Chính Sách Bảo Mật | Protocols | Logging | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | Filtering | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | Some[^1] | Anonymized | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | Some[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | Optional[^3] | No | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. Filter list being used can be found here. [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | Optional | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- Must support [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
||||||
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- Allow for [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) to be disabled.
|
|
||||||
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
|
||||||
|
|
||||||
## Native Operating System Support
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 and above support DNS over TLS. The settings can be found in: **Settings** → **Network & Internet** → **Private DNS**.
|
{ align=right }
|
||||||
|
|
||||||
### Apple Devices
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
The latest versions of iOS, iPadOS, tvOS, and macOS, support both DoT and DoH. Both protocols are supported natively via [configuration profiles](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) or through the [DNS Settings API](https://developer.apple.com/documentation/networkextension/dns_settings).
|
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
After installation of either a configuration profile or an app that uses the DNS Settings API, the DNS configuration can be selected. If a VPN is active, resolution within the VPN tunnel will use the VPN's DNS settings and not your system-wide settings.
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### Signed Profiles
|
</details>
|
||||||
|
|
||||||
Apple does not provide a native interface for creating encrypted DNS profiles. [Secure DNS profile creator](https://dns.notjakob.com/tool.html) is an unofficial tool for creating your own encrypted DNS profiles, however they will not be signed. Signed profiles are preferred; signing validates a profile's origin and helps to ensure the integrity of the profiles. A green "Verified" label is given to signed configuration profiles. For more information on code signing, see [About Code Signing](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html). **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">Info</p>
|
|
||||||
|
|
||||||
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Encrypted DNS Proxies
|
## Encrypted DNS Proxies
|
||||||
|
|
||||||
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](advanced/dns-overview.md#unencrypted-dns) resolver to forward to. Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Encrypted DNS proxy software provides a local proxy for the [unencrypted DNS](ad
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Self-hosted Solutions
|
## Framadate
|
||||||
|
|
||||||
A self-hosted DNS solution is useful for providing filtering on controlled platforms, such as Smart TVs and other IoT devices, as no client-side software is needed.
|
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||||
|
|
||||||
### AdGuard Home
|
### Minimum Requirements
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [QNAME Minimization](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- Prefer [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) support or geo-steering support.
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home features a polished web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole is designed to be hosted on a Raspberry Pi, but it is not limited to such hardware. The software features a friendly web interface to view insights and manage blocked content.
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard stores aggregated performance metrics of their DNS servers, namely the number of complete requests to a particular server, the number of blocked requests, and the speed of processing requests. They also keep and store the database of domains requested in within last 24 hours. "We need this information to identify and block new trackers and threats." "We also log how many times this or that tracker has been blocked. We need this information to remove outdated rules from our filters." [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare collects and stores only the limited DNS query data that is sent to the 1.1.1.1 resolver. The 1.1.1.1 resolver service does not log personal data, and the bulk of the limited non-personally identifiable query data is stored only for 25 hours. [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D only logs for Premium resolvers with custom DNS profiles. Free resolvers do not log data. [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: Mullvad's DNS service is available to both subscribers and non-subscribers of Mullvad VPN. Their privacy policy explicitly claims they do not log DNS requests in any way. [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9 collects some data for the purposes of threat monitoring and response. That data may then be remixed and shared, such as for the purpose of security research. Quad9 does not collect or record IP addresses or other data they deem personally identifiable. [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ DNS 從網際網路的 [早期](https://en.wikipedia.org/wiki/Domain_Name_System
|
|||||||
|
|
||||||
DoH 原生執行出現在 iOS 14, macOS 11, Microsoft Windows, 與 Android 13 (不過其並未[預設啟動 ](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144))。 一般 Linux 桌面支援仍待 systemd [實現](https://github.com/systemd/systemd/issues/8639)， 所以 [還是得安裝第三方軟體](../dns.md#encrypted-dns-proxies)。
|
DoH 原生執行出現在 iOS 14, macOS 11, Microsoft Windows, 與 Android 13 (不過其並未[預設啟動 ](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144))。 一般 Linux 桌面支援仍待 systemd [實現](https://github.com/systemd/systemd/issues/8639)， 所以 [還是得安裝第三方軟體](../dns.md#encrypted-dns-proxies)。
|
||||||
|
|
||||||
|
### 原生作業系統支援
|
||||||
|
|
||||||
|
#### Android
|
||||||
|
|
||||||
|
Android 9 以上版本支持 DoT (DNS over TLS)。 設定方式可以在以下位置找到： **設定** → **網路 & 網際網路** → **私人 DNS**。
|
||||||
|
|
||||||
|
#### Apple裝置
|
||||||
|
|
||||||
|
最新版本的 iOS、iPadOS、tvOS 和 macOS 都支持 DoT 和 DoH。 這兩個通訊協議都透過 [組態檔](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) 或透過 [DNS 設定 API ](https://developer.apple.com/documentation/networkextension/dns_settings)獲得原生支援。
|
||||||
|
|
||||||
|
安裝設定設定檔或使用 DNS 設定API 的應用程式後，即可選擇 DNS 設定。 如果啟用 VPN， 隧道內的解析將使用 VPN 的 DNS 設置，而不是設備系統的設置。
|
||||||
|
|
||||||
|
Apple不提供用於建立加密DNS設定檔的原生介面。 [Secure DNS profile creator](https://dns.notjakob.com/tool.html) 是一款非正式工具用以建立您自己的加密 DNS 設定檔。不過這個軟體並未得到簽署。 最好是簽署過個人資設定檔；簽署會驗證個人資料的來源，並有助於確保個人資料的完整性。 綠色的「已驗證」標籤會提供給已簽署的配置文件。 代碼簽名的詳細資訊，請參閱 [關於代碼簽名](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html)。
|
||||||
|
|
||||||
|
#### Linux
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## 外部人士可以看到什麼？
|
## 外部人士可以看到什麼？
|
||||||
|
|
||||||
在此範例中，我們將記錄當我們提出 DoH 請求時發生的事情：
|
在此範例中，我們將記錄當我們提出 DoH 請求時發生的事情：
|
||||||
@ -160,9 +178,7 @@ DoH 原生執行出現在 iOS 14, macOS 11, Microsoft Windows, 與 Android 13 (
|
|||||||
|
|
||||||
即便使用「加密 DNS」伺服器，網域也可能會透過 SNI 披露。 [TLS v1.3](https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.3) 協議帶來 [加密的 Client Hello](https://blog.cloudflare。com /encrypted-client-hello)，可防止這種洩漏。
|
即便使用「加密 DNS」伺服器，網域也可能會透過 SNI 披露。 [TLS v1.3](https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.3) 協議帶來 [加密的 Client Hello](https://blog.cloudflare。com /encrypted-client-hello)，可防止這種洩漏。
|
||||||
|
|
||||||
各國政府，特別是
|
各國政府，特別是中國< /a> 和[俄羅斯](https://zdnet.com/article/ Russia-wants-to-ban-the-use-of-secure-protocols-such-as-tls-1-3-doh- dot -esni)，已經[開始阻止](https://en.wikipedia.org/wiki/Server_Name_Inspiration#Encrypted_Client_Hello)它，或表達出企圖這樣做的想法。 近來俄羅斯 開始屏蔽使用 [HTTP/3](https://en.wikipedia.org/wiki/HTTP/3)的外國網站。 這是因為作為HTTP/3的一部分的 [QUIC](https://en.wikipedia.org/wiki/QUIC) 協議要求 `ClientHello` 也被加密。</p>
|
||||||
|
|
||||||
中國< /a> 和[俄羅斯](https://zdnet.com/article/ Russia-wants-to-ban-the-use-of-secure-protocols-such-as-tls-1-3-doh- dot -esni)，已經[開始阻止](https://en.wikipedia.org/wiki/Server_Name_Inspiration#Encrypted_Client_Hello)它，或表達出企圖這樣做的想法。 近來俄羅斯 開始屏蔽使用 [HTTP/3](https://en.wikipedia.org/wiki/HTTP/3)的外國網站。 這是因為作為HTTP/3的一部分的 [QUIC](https://en.wikipedia.org/wiki/QUIC) 協議要求 `ClientHello` 也被加密。</p>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -355,7 +371,7 @@ QNAME 指 "合格域名"，例如 `discuss.privacyguides.net`. 過去，在解
|
|||||||
| 根伺服器 | 什麼是 .net 域名伺服器? | *提供 .net 伺服器* |
|
| 根伺服器 | 什麼是 .net 域名伺服器? | *提供 .net 伺服器* |
|
||||||
| .net 伺服器 | Privacyguides.net 的域名伺服器是什麼? | *提供 Privacy Guides 伺服器* |
|
| .net 伺服器 | Privacyguides.net 的域名伺服器是什麼? | *提供 Privacy Guides 伺服器* |
|
||||||
| Privacy Guides 伺服器 | discuss.privacyguides.net 的域名伺服器是什麼? | 此伺服器 |
|
| Privacy Guides 伺服器 | discuss.privacyguides.net 的域名伺服器是什麼? | 此伺服器 |
|
||||||
| Privacy Guides 伺服器 | discuss.privacyguides.net 的 IP 是多少? | 5.161.195.190 |
|
| Privacy Guides 伺服器 | Discuss.privacyguides.net 的 IP 是多少? | 5.161.195.190 |
|
||||||
|
|
||||||
|
|
||||||
雖然此過程可能稍減低效率低，但中央根網域伺服器和 TLD 網域伺服器都不會收到有關您的*完整*查詢的資訊，從而減少了資訊量傳輸您瀏覽習慣。 進一步的技術描述在 [RFC 7816](https://datatracker.ietf.org/doc/html/rfc7816)。
|
雖然此過程可能稍減低效率低，但中央根網域伺服器和 TLD 網域伺服器都不會收到有關您的*完整*查詢的資訊，從而減少了資訊量傳輸您瀏覽習慣。 進一步的技術描述在 [RFC 7816](https://datatracker.ietf.org/doc/html/rfc7816)。
|
||||||
@ -368,4 +384,35 @@ QNAME 指 "合格域名"，例如 `discuss.privacyguides.net`. 過去，在解
|
|||||||
|
|
||||||
它的目的是回答客戶端距離最靠近的伺服器以“加快”資料的傳遞，類似[內容傳遞網絡](https://en.wikipedia.org/wiki/Content_delivery_network)，後者通常用於視頻串流和 JavaScript Web 應用程序。
|
它的目的是回答客戶端距離最靠近的伺服器以“加快”資料的傳遞，類似[內容傳遞網絡](https://en.wikipedia.org/wiki/Content_delivery_network)，後者通常用於視頻串流和 JavaScript Web 應用程序。
|
||||||
|
|
||||||
此功能確實以隱私為代價，因為它會告訴 DNS伺服器一些有關客戶端位置的資訊。
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
@ -15,50 +15,126 @@ global:
|
|||||||
|
|
||||||
## 推薦的 DNS 提供商
|
## 推薦的 DNS 提供商
|
||||||
|
|
||||||
| DNS 提供者 | 隐私政策 | 協議 | 日誌記錄 | ECS | 篩選 |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------- | ------ | --- | ------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | 明文 <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | 一些[^1] | 是 | 根據個人配置。 使用的過濾器列表可以在這裡找到。 [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | 明文 <br> DoH/3 <br> DoT | 一些[^2] | 不是 | 根據個人配置。 |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | 明文 <br> DoH/3 <br> DoT <br> DoQ | 可選[^3] | 不是 | 根據個人配置。 |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | 否[^4] | 不是 | 根據個人配置。 正在使用的過濾器列表可以在這裡找到。 [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | 明文 <br> DoH/3 <br> DoT <br> DoQ | 可選[^5] | 可選的 | 根據個人配置。 |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | 明文 <br> DoH <br> DoT <br> DNSCrypt | 一些[^6] | 可選的 | 根據個人設定，預設會封鎖惡意軟體。 |
|
|
||||||
|
|
||||||
### 標準
|
| DNS 提供者 | 隐私政策 | 協議 | 日誌記錄 | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | 篩選 | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | -------- | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | 一些[^1] | Anonymized | Based on server choice. 使用的過濾器列表可以在這裡找到。 [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [是](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | 一些[^2] | 不是 | Based on server choice. | [不是](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | 可選[^3] | 不是 | Based on server choice. | [是](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | 不是 | Anonymized | Based on server choice. | [是](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | 否[^4] | 不是 | Based on server choice. 正在使用的過濾器列表可以在這裡找到。 [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [是](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | 可選的 | Based on server choice, malware blocking by default. | [是](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**請注意，我們這裏所推薦專案沒有任何牽扯。 ** 除了 [我們的標準準則](about/criteria.md)外，還有一套明確要求以提出客觀建議。 我們建議您在選擇使用任何項目之前先熟悉此列表，並進行自己的研究，以確保您的正確選擇。
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- 必須支援 [ DNSSEC ](advanced/dns-overview.md#what-is-dnssec)。
|
在被控制平臺，自主託管 DNS 可提供有用的過濾，例如智能電視和其他物聯網設備，因為不需要客戶端軟件。
|
||||||
- [QNAME 最小化](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- 可讓 [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs)禁用 。
|
|
||||||
- 首選 [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) 支援或地理轉向支援。
|
|
||||||
|
|
||||||
## 原生作業系統支援
|
### Pi-hole
|
||||||
|
|
||||||
### Android
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
Android 9 以上版本支持 DoT (DNS over TLS)。 設定方式可以在以下位置找到： **設定** → **網路 & 網際網路** → **私人 DNS**。
|
{ align=right }
|
||||||
|
|
||||||
### Apple裝置
|
**Pi-hole** 是一個開源的 [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) ，它使用 [DNS 篩選](https://cloudflare.com/learning/access-management/what-is-dns-filtering/)來阻止不需要的網頁內容，例如廣告。
|
||||||
|
|
||||||
最新版本的 iOS、iPadOS、tvOS 和 macOS 都支持 DoT 和 DoH。 這兩個通訊協議都透過 [組態檔](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) 或透過 [DNS 設定 API ](https://developer.apple.com/documentation/networkextension/dns_settings)獲得原生支援。
|
Pi-hole 設計應用在 Raspberry Pi ，但它不限於這種硬體。 該軟體良好的 Web 界面，可查看有用資訊和管理被阻止的內容。
|
||||||
|
|
||||||
安裝設定設定檔或使用 DNS 設定API 的應用程式後，即可選擇 DNS 設定。 如果啟用 VPN， 隧道內的解析將使用 VPN 的 DNS 設置，而不是設備系統的設置。
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### 已簽署的設定檔
|
</details>
|
||||||
|
|
||||||
Apple不提供用於建立加密DNS設定檔的原生介面。 [Secure DNS profile creator](https://dns.notjakob.com/tool.html) 是一款非正式工具用以建立您自己的加密 DNS 設定檔。不過這個軟體並未得到簽署。 最好是簽署過個人資設定檔；簽署會驗證個人資料的來源，並有助於確保個人資料的完整性。 綠色的「已驗證」標籤會提供給已簽署的配置文件。 代碼簽名的詳細資訊，請參閱 [關於代碼簽名](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html)。 **簽署過的設定資料**是由 [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io)與 [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles)所提供。
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">資訊</p>
|
|
||||||
|
|
||||||
許多 Linux 發行版用來進行DNS查詢的`systemd-resolved` 還不[支援 DoH](https://github.com/systemd/systemd/issues/8639)。 如果要使用 DoH ，您需要安裝一個類似 [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy)的代理，並[設定](https://wiki.archlinux.org/title/Dnscrypt-proxy) 讓系統解析器獲取所有 DNS 查詢，並透過 HTTPS 轉發。
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard首頁
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard** 是一個開源的 [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) ，使用[DNS 過濾](https://cloudflare.com/learning/access-management/what-is-dns-filtering/) 來封鎖不需要的網頁內容，例如廣告。
|
||||||
|
|
||||||
|
AdGuard 首頁提供精美的網頁介面，可查看有用資訊並管理被封鎖的內容。
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
與帳戶一起使用時，NextDNS 將預設啟用洞察和日誌記錄功能（因為某些功能需求）。 可選擇保留日誌的存留時間和儲存位置，或完全停用日誌。
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## 加密的DNS代理
|
## 加密的DNS代理
|
||||||
|
|
||||||
加密DNS代理軟體提供了一個本地代理，用於將 [個未加密的DNS](advanced/dns-overview.md#unencrypted-dns) 解析器轉發到。 通常，它用於原本不支持 [加密 DNS ](advanced/dns-overview.md#what-is-encrypted-dns)的平臺。
|
加密DNS代理軟體提供了一個本地代理，用於將 [個未加密的DNS](advanced/dns-overview.md#unencrypted-dns) 解析器轉發到。 Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Apple不提供用於建立加密DNS設定檔的原生介面。 [Secure DNS profi
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## 自主託管方案
|
## 標準
|
||||||
|
|
||||||
在被控制平臺，自主託管 DNS 可提供有用的過濾，例如智能電視和其他物聯網設備，因為不需要客戶端軟件。
|
**請注意，我們這裏所推薦專案沒有任何牽扯。 ** 除了 [我們的標準準則](about/criteria.md)外，還有一套明確要求以提出客觀建議。 我們建議您在選擇使用任何項目之前先熟悉此列表，並進行自己的研究，以確保您的正確選擇。
|
||||||
|
|
||||||
### AdGuard首頁
|
### 最低合格要求
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [QNAME 最小化](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- 首選 [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) 支援或地理轉向支援。
|
||||||
**AdGuard** 是一個開源的 [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) ，使用[DNS 過濾](https://cloudflare.com/learning/access-management/what-is-dns-filtering/) 來封鎖不需要的網頁內容，例如廣告。
|
|
||||||
|
|
||||||
AdGuard 首頁提供精美的網頁介面，可查看有用資訊並管理被封鎖的內容。
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="Source Code" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** 是一個開源的 [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) ，它使用 [DNS 篩選](https://cloudflare.com/learning/access-management/what-is-dns-filtering/)來阻止不需要的網頁內容，例如廣告。
|
|
||||||
|
|
||||||
Pi-hole 設計應用在 Raspberry Pi ，但它不限於這種硬體。 該軟體良好的 Web 界面，可查看有用資訊和管理被阻止的內容。
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard 儲存其 DNS 伺服器的總和效能指標，即對特定伺服器的全部請求數量、被封鎖的請求數量，以及處理請求的速度。 他們還會保存和儲存過去24小時內所請求的網域資料庫。 我們需要這些資訊來識別和阻止新的追蹤器和威脅。 我們還記錄了這些追蹤器被封鎖的次數。 我們需要這些資訊以便在過濾器中刪除過時的規則。 [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard 儲存其 DNS 伺服器的總和效能指標，即對特定伺服器的全部請求數量、被封鎖的請求數量，以及處理請求的速度。 他們還會保存和儲存過去24小時內所請求的網域資料庫。 我們需要這些資訊來識別和阻止新的追蹤器和威脅。 我們還記錄了這些追蹤器被封鎖的次數。 我們需要這些資訊以便在過濾器中刪除過時的規則。 [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare 僅收集並儲存發送至 1.1.1.1解析器的有限 DNS 查詢資料。 1.1.1.1解析器服務不會記錄個人資料，且大部分有限的非個人識別查詢資料僅存儲25小時。 [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare 僅收集並儲存發送至 1.1.1.1解析器的有限 DNS 查詢資料。 1.1.1.1解析器服務不會記錄個人資料，且大部分有限的非個人識別查詢資料僅存儲25小時。 [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D 只有記錄使用自定義 DNS 配置的高級解析器。 免費解析器不記錄數據。 [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D 只有記錄使用自定義 DNS 配置的高級解析器。 免費解析器不記錄數據。 [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: Mullvad 的 DNS 服務可供 Mullvad VPN 的訂閱者和非訂閱者使用。 他們的隱私政策明確聲稱他們不會以任何方式記錄 DNS 請求。 [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: Mullvad 的 DNS 服務可供 Mullvad VPN 的訂閱者和非訂閱者使用。 他們的隱私政策明確聲稱他們不會以任何方式記錄 DNS 請求。 [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: 與帳戶一起使用時，NextDNS 將預設啟用洞察和日誌記錄功能（因為某些功能需求）。 可選擇保留日誌的存留時間和儲存位置，或完全停用日誌。 如果沒有使用帳戶，則不會記錄任何資料。 [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9會收集一些資料，以進行威脅監控和回應。 然後這些資料會被重新混合與共享，例如用於安全研究。 Quad9 不會收集或記錄 IP 位址或其他他們認為可識別個人身份的資料。 [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9會收集一些資料，以進行威脅監控和回應。 然後這些資料會被重新混合與共享，例如用於安全研究。 Quad9 不會收集或記錄 IP 位址或其他他們認為可識別個人身份的資料。 [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
@ -82,6 +82,24 @@ DNS自互联网的 [早期](https://en.wikipedia.org/wiki/Domain_Name_System#His
|
|||||||
|
|
||||||
DoH的原生实现出现在iOS 14、macOS 11、微软Windows和Android 13中（然而，它不会被默认启用 [](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)）。 一般的Linux桌面支持还在等待systemd [实现](https://github.com/systemd/systemd/issues/8639) ，所以 [目前依然需要安装第三方软件](../dns.md#linux)。
|
DoH的原生实现出现在iOS 14、macOS 11、微软Windows和Android 13中（然而，它不会被默认启用 [](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)）。 一般的Linux桌面支持还在等待systemd [实现](https://github.com/systemd/systemd/issues/8639) ，所以 [目前依然需要安装第三方软件](../dns.md#linux)。
|
||||||
|
|
||||||
|
### Native Operating System Support
|
||||||
|
|
||||||
|
#### 安卓
|
||||||
|
|
||||||
|
安卓9及以上系统支持通过TLS的DNS。 这些设置可以在下面找到。 **设置** → **网络 & 互联网** → **私人DNS**。
|
||||||
|
|
||||||
|
#### Apple Devices
|
||||||
|
|
||||||
|
最新版本的iOS、iPadOS、tvOS和macOS，同时支持DoT和DoH。 通过 [配置文件](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) ，或通过 [DNS设置API](https://developer.apple.com/documentation/networkextension/dns_settings)，这两种协议都得到了本地支持。
|
||||||
|
|
||||||
|
在安装配置文件或使用DNS设置API的应用程序后，可以选择DNS配置。 如果VPN处于激活状态，在VPN隧道内的解析将使用VPN的DNS设置，而不是你整个系统的设置。
|
||||||
|
|
||||||
|
苹果公司没有为创建加密的DNS配置文件提供本地接口。 [安全DNS配置文件创建者](https://dns.notjakob.com/tool.html) 是一个非官方的工具，用于创建你自己的加密DNS配置文件，然而它们将不会被签署。 签名的档案是首选；签名验证了档案的来源，有助于确保档案的完整性。 绿色的 "已验证 "标签被赋予已签署的配置文件。 关于代码签名的更多信息，见 [关于代码签名](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html)。
|
||||||
|
|
||||||
|
#### Linux系统
|
||||||
|
|
||||||
|
`systemd-resolved`, which many Linux distributions use to do their DNS lookups, doesn't yet [support DoH](https://github.com/systemd/systemd/issues/8639). If you want to use DoH, you'll need to install a proxy like [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy) and [configure it](https://wiki.archlinux.org/title/Dnscrypt-proxy) to take all the DNS queries from your system resolver and forward them over HTTPS.
|
||||||
|
|
||||||
## 外部一方能看到什么？
|
## 外部一方能看到什么？
|
||||||
|
|
||||||
在本示例中，我们将记录当我们提出DoH请求时会发生什么：
|
在本示例中，我们将记录当我们提出DoH请求时会发生什么：
|
||||||
@ -318,4 +336,27 @@ DNSSEC在DNS的所有层面上实现了分层的数字签名政策。 例如，
|
|||||||
|
|
||||||
它的目的是 "加快 "数据的交付，给客户一个属于离他们很近的服务器的答案，如 [内容交付网络](https://en.wikipedia.org/wiki/Content_delivery_network)，这通常用于视频流和服务JavaScript网络应用。
|
它的目的是 "加快 "数据的交付，给客户一个属于离他们很近的服务器的答案，如 [内容交付网络](https://en.wikipedia.org/wiki/Content_delivery_network)，这通常用于视频流和服务JavaScript网络应用。
|
||||||
|
|
||||||
这项功能确实是以隐私为代价的，因为它告诉DNS服务器一些关于客户端位置的信息。
|
This feature does come at a privacy cost, as it tells the DNS server some information about the client's location, generally your IP network. For example, if your IP address is `198.51.100.32` the DNS provider might share `198.51.100.0/24` with the authoritative server. Some DNS providers anonymize this data by providing another IP address which is approximately near your location.
|
||||||
|
|
||||||
|
If you have `dig` installed you can test whether your DNS provider gives EDNS information out to DNS nameservers with the following command:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that this command will contact Google for the test, and return your IP as well as EDNS client subnet information. If you want to test another DNS resolver you can specify their IP, to test `9.9.9.11` for example:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dig +nocmd @9.9.9.11 -t txt o-o.myaddr.l.google.com +nocomments +noall +answer +stats
|
||||||
|
```
|
||||||
|
|
||||||
|
If the results include a second edns0-client-subnet TXT record (like shown below), then your DNS server is passing along EDNS information. The IP or network shown after is the precise information which was shared with Google by your DNS provider.
|
||||||
|
|
||||||
|
```text
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "198.51.100.32"
|
||||||
|
o-o.myaddr.l.google.com. 60 IN TXT "edns0-client-subnet 198.51.100.0/24"
|
||||||
|
;; Query time: 64 msec
|
||||||
|
;; SERVER: 9.9.9.11#53(9.9.9.11)
|
||||||
|
;; WHEN: Wed Mar 13 10:23:08 CDT 2024
|
||||||
|
;; MSG SIZE rcvd: 130
|
||||||
|
```
|
||||||
|
|||||||
183
i18n/zh/dns.md
183
i18n/zh/dns.md
@ -15,50 +15,126 @@ Encrypted DNS with third-party servers should only be used to get around basic [
|
|||||||
|
|
||||||
## 推荐的供应商
|
## 推荐的供应商
|
||||||
|
|
||||||
| DNS供应商 | 隐私政策 | 协议 | 日志记录 | ECS | 筛选 |
|
These are our favorite public DNS resolvers based on their privacy and security characteristics, and their worldwide performance. Some of these services offer basic DNS-level blocking of malware or trackers depending on the server you choose, but if you want to be able to see and customize what is blocked you should use a dedicated DNS filtering product instead.
|
||||||
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------ | --- | ---------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| [**AdGuard**](https://adguard.com/en/adguard-dns/overview.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext <br> DoH/3 <br> DoT <br> DoQ <br> DNSCrypt | 一些[^1] | Yes | Based on personal configuration. 正在使用的过滤器列表可以在这里找到。 [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) |
|
|
||||||
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext <br> DoH/3 <br> DoT | 一些[^2] | No | Based on personal configuration. |
|
|
||||||
| [**Control D**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | 可选[^3] | No | Based on personal configuration. |
|
|
||||||
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH <br> DoT | No[^4] | No | Based on personal configuration. 正在使用的过滤器列表可以在这里找到。 [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) |
|
|
||||||
| [**NextDNS**](https://nextdns.io) | [:octicons-link-external-24:](https://nextdns.io/privacy) | Cleartext <br> DoH/3 <br> DoT <br> DoQ | 可选[^5] | 可选 | Based on personal configuration. |
|
|
||||||
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext <br> DoH <br> DoT <br> DNSCrypt | 一些[^6] | 可选 | Based on personal configuration, Malware blocking by default. |
|
|
||||||
|
|
||||||
### Criteria
|
| DNS供应商 | 隐私政策 | 协议 | 日志记录 | [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) | 筛选 | Signed Apple Profile |
|
||||||
|
| -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------- | -------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
|
||||||
|
| [**AdGuard Public DNS**](https://adguard-dns.io/en/public-dns.html) | [:octicons-link-external-24:](https://adguard.com/en/privacy/dns.html) | Cleartext DoH/3 DoT DoQ DNSCrypt | 一些[^1] | Anonymized | Based on server choice. 正在使用的过滤器列表可以在这里找到。 [:octicons-link-external-24:](https://github.com/AdguardTeam/AdGuardDNS) | [Yes](https://adguard.com/en/blog/encrypted-dns-ios-14.html) |
|
||||||
|
| [**Cloudflare**](https://developers.cloudflare.com/1.1.1.1/setup) | [:octicons-link-external-24:](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver) | Cleartext DoH/3 DoT | 一些[^2] | No | Based on server choice. | [No](https://community.cloudflare.com/t/requesting-1-1-1-1-signed-profiles-for-apple/571846/) |
|
||||||
|
| [**Control D Free DNS**](https://controld.com/free-dns) | [:octicons-link-external-24:](https://controld.com/privacy) | Cleartext DoH/3 DoT DoQ | 可选[^3] | No | Based on server choice. | [Yes](https://docs.controld.com/docs/macos-platform) |
|
||||||
|
| [**dns0.eu**](https://dns0.eu) | [:octicons-link-external-24:](https://dns0.eu/privacy) | Cleartext DoH/3 DoH DoT DoQ | No | Anonymized | Based on server choice. | [Yes](https://www.dns0.eu/zero.dns0.eu.mobileconfig) |
|
||||||
|
| [**Mullvad**](https://mullvad.net/en/help/dns-over-https-and-dns-over-tls) | [:octicons-link-external-24:](https://mullvad.net/en/help/no-logging-data-policy) | DoH DoT | No[^4] | No | Based on server choice. 正在使用的过滤器列表可以在这里找到。 [:octicons-link-external-24:](https://github.com/mullvad/dns-adblock) | [Yes](https://mullvad.net/en/blog/profiles-to-configure-our-encrypted-dns-on-apple-devices) |
|
||||||
|
| [**Quad9**](https://quad9.net) | [:octicons-link-external-24:](https://quad9.net/privacy/policy) | Cleartext DoH DoT DNSCrypt | Some[^5] | 可选 | Based on server choice, malware blocking by default. | [Yes](https://quad9.net/news/blog/ios-mobile-provisioning-profiles) |
|
||||||
|
|
||||||
**请注意，我们与我们推荐的任何项目都没有关系。** 除了 [我们的标准标准](about/criteria.md)，我们还制定了一套明确的要求，使我们能够提供客观的建议。 我们建议你在选择使用一个项目之前熟悉这个清单，并进行自己的研究以确保它是你的正确选择。
|
## Self-Hosted DNS Filtering
|
||||||
|
|
||||||
- 必须支持 [DNSSEC](advanced/dns-overview.md#what-is-dnssec)。
|
自我托管的DNS解决方案对于在智能电视和其他物联网设备等受控平台上提供过滤非常有用，因为不需要客户端软件。
|
||||||
- [QNAME最小化](advanced/dns-overview.md#what-is-qname-minimization).
|
|
||||||
- 允许 [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) 被禁用。
|
|
||||||
- 倾向于 [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) 支持或地理转向支持。
|
|
||||||
|
|
||||||
## Native Operating System Support
|
### Pi-hole
|
||||||
|
|
||||||
### 安卓
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
安卓9及以上系统支持通过TLS的DNS。 这些设置可以在下面找到。 **设置** → **网络 & 互联网** → **私人DNS**。
|
{ align=right }
|
||||||
|
|
||||||
### Apple Devices
|
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
最新版本的iOS、iPadOS、tvOS和macOS，同时支持DoT和DoH。 通过 [配置文件](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) ，或通过 [DNS设置API](https://developer.apple.com/documentation/networkextension/dns_settings)，这两种协议都得到了本地支持。
|
Pi-hole被设计为在Raspberry Pi上托管，但它并不局限于这种硬件。 该软件具有一个友好的网络界面，可以查看洞察力和管理封锁的内容。
|
||||||
|
|
||||||
在安装配置文件或使用DNS设置API的应用程序后，可以选择DNS配置。 如果VPN处于激活状态，在VPN隧道内的解析将使用VPN的DNS设置，而不是你整个系统的设置。
|
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
||||||
|
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
||||||
|
|
||||||
#### 已签名的配置文件
|
</details>
|
||||||
|
|
||||||
苹果公司没有为创建加密的DNS配置文件提供本地接口。 [安全DNS配置文件创建者](https://dns.notjakob.com/tool.html) 是一个非官方的工具，用于创建你自己的加密DNS配置文件，然而它们将不会被签署。 签名的档案是首选；签名验证了档案的来源，有助于确保档案的完整性。 绿色的 "已验证 "标签被赋予已签署的配置文件。 关于代码签名的更多信息，见 [关于代码签名](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html)。 **Signed profiles** are offered by [AdGuard](https://adguard.com/en/blog/encrypted-dns-ios-14.html), [NextDNS](https://apple.nextdns.io), and [Quad9](https://quad9.net/news/blog/ios-mobile-provisioning-profiles).
|
|
||||||
|
|
||||||
<div class="admonition info" markdown>
|
|
||||||
<p class="admonition-title">信息</p>
|
|
||||||
|
|
||||||
`systemd-resolved`，许多Linux发行版使用它来进行DNS查询，但还不[支持DoH](https://github.com/systemd/systemd/issues/8639)。 如果你想使用DoH，你需要安装一个代理，如 [dnscrypt-proxy](https://github.com/DNSCrypt/dnscrypt-proxy)和[配置它](https://wiki.archlinux.org/title/Dnscrypt-proxy)，从你的系统解析器接收所有的DNS查询并通过HTTPS转发。
|
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
### AdGuard Home
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
||||||
|
|
||||||
|
AdGuard Home有一个精致的网络界面，可以查看洞察力和管理被阻止的内容。
|
||||||
|
|
||||||
|
[:octicons-home-16: 主页](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="隐私政策" }
|
||||||
|
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=文档}
|
||||||
|
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="源代码" }
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
## Cloud-Based DNS Filtering
|
||||||
|
|
||||||
|
These DNS filtering solutions offer a web dashboard where you can customize the blocklists to your exact needs, similarly to a Pi-hole. These services are usually easier to set up and configure than self-hosted services like the ones above, and can be used more easily across multiple networks (self-hosted solutions are typically restricted to your home/local network unless you set up a more advanced configuration).
|
||||||
|
|
||||||
|
### Control D
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**Control D** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. In addition to their paid plans, they offer a number of preconfigured DNS resolvers you can use for free.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://controld.com){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://controld.com/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://docs.controld.com/docs/getting-started){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/Control-D-Inc/ctrld){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-apple: macOS](https://docs.controld.com/docs/gui-setup-utility)
|
||||||
|
- [:simple-linux: Linux](https://docs.controld.com/docs/ctrld)
|
||||||
|
- [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=com.controld.setuputility)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/1518799460)
|
||||||
|
- [:simple-github: GitHub](https://github.com/Control-D-Inc/ctrld/releases/tag/v1.3.5)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### NextDNS
|
||||||
|
|
||||||
|
<div class="admonition recommendation" markdown>
|
||||||
|
|
||||||
|
{ align=right }
|
||||||
|
|
||||||
|
**NextDNS** is a customizable DNS service which lets you block security threats, unwanted content, and advertisements on a DNS level. They offer a fully functional free plan for limited use.
|
||||||
|
|
||||||
|
[:octicons-home-16: Homepage](https://nextdns.io){ .md-button .md-button--primary }
|
||||||
|
[:octicons-eye-16:](https://nextdns.io/privacy){ .card-link title="Privacy Policy" }
|
||||||
|
[:octicons-info-16:](https://help.nextdns.io){ .card-link title=Documentation}
|
||||||
|
[:octicons-code-16:](https://github.com/nextdns/nextdns){ .card-link title="Source Code" }
|
||||||
|
|
||||||
|
<details class="downloads" markdown>
|
||||||
|
<summary>Downloads</summary>
|
||||||
|
|
||||||
|
- [:simple-windows11: Windows](https://github.com/nextdns/nextdns/wiki/Windows)
|
||||||
|
- [:simple-apple: macOS](https://apps.apple.com/us/app/nextdns/id1464122853)
|
||||||
|
- [:simple-linux: Linux](https://github.com/nextdns/nextdns/wiki)
|
||||||
|
- [:simple-appstore: App Store](https://apps.apple.com/app/nextdns/id1463342498)
|
||||||
|
- [:simple-github: GitHub](https://github.com/nextdns/nextdns/releases)
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.
|
||||||
|
|
||||||
|
NextDNS's free plan is fully functional, but should not be relied upon for security or other critical filtering applications, because after 300,000 DNS queries in a month all filtering, logging, and other account-based functionality is disabled. It can still be used as a regular DNS provider after that point, so your devices will continue to function and make secure queries via DNS-over-HTTPS, just without your filter lists.
|
||||||
|
|
||||||
|
NextDNS also offers public DNS-over-HTTPS service at `https://dns.nextdns.io` and DNS-over-TLS/QUIC at `dns.nextdns.io`, which are available by default in Firefox and Chromium, and subject to their default no-logging [privacy policy](https://nextdns.io/privacy).
|
||||||
|
|
||||||
## Encrypted DNS Proxies
|
## Encrypted DNS Proxies
|
||||||
|
|
||||||
加密的DNS代理软件为 [未加密的DNS](advanced/dns-overview.md#unencrypted-dns) 解析器提供一个本地代理转发。 通常情况下，它被用于那些不支持 [加密DNS的平台](advanced/dns-overview.md#what-is-encrypted-dns)。
|
加密的DNS代理软件为 [未加密的DNS](advanced/dns-overview.md#unencrypted-dns) 解析器提供一个本地代理转发。 Typically, it is used on platforms that don't natively support [encrypted DNS](advanced/dns-overview.md#what-is-encrypted-dns).
|
||||||
|
|
||||||
### RethinkDNS
|
### RethinkDNS
|
||||||
|
|
||||||
@ -112,52 +188,19 @@ Encrypted DNS with third-party servers should only be used to get around basic [
|
|||||||
|
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
## Self-hosted Solutions
|
## Criteria
|
||||||
|
|
||||||
自我托管的DNS解决方案对于在智能电视和其他物联网设备等受控平台上提供过滤非常有用，因为不需要客户端软件。
|
**请注意，我们与我们推荐的任何项目都没有关系。** 除了 [我们的标准标准](about/criteria.md)，我们还制定了一套明确的要求，使我们能够提供客观的建议。 我们建议你在选择使用一个项目之前熟悉这个清单，并进行自己的研究以确保它是你的正确选择。
|
||||||
|
|
||||||
### AdGuard Home
|
### Minimum Requirements
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
- [DNSSEC](advanced/dns-overview.md#what-is-dnssec).
|
||||||
|
- [QNAME最小化](advanced/dns-overview.md#what-is-qname-minimization).
|
||||||
{ align=right }
|
- Anonymize [ECS](advanced/dns-overview.md#what-is-edns-client-subnet-ecs) or disable it by default.
|
||||||
|
- 倾向于 [anycast](https://en.wikipedia.org/wiki/Anycast#Addressing_methods) 支持或地理转向支持。
|
||||||
**AdGuard Home** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
AdGuard Home有一个精致的网络界面，可以查看洞察力和管理被阻止的内容。
|
|
||||||
|
|
||||||
[:octicons-home-16: 主页](https://adguard.com/adguard-home/overview.html){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://adguard.com/privacy/home.html){ .card-link title="隐私政策" }
|
|
||||||
[:octicons-info-16:](https://github.com/AdguardTeam/AdGuardHome/wiki){ .card-link title=文档}
|
|
||||||
[:octicons-code-16:](https://github.com/AdguardTeam/AdGuardHome){ .card-link title="源代码" }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
### Pi-hole
|
|
||||||
|
|
||||||
<div class="admonition recommendation" markdown>
|
|
||||||
|
|
||||||
{ align=right }
|
|
||||||
|
|
||||||
**Pi-hole** is an open-source [DNS-sinkhole](https://en.wikipedia.org/wiki/DNS_sinkhole) which uses [DNS filtering](https://cloudflare.com/learning/access-management/what-is-dns-filtering) to block unwanted web content, such as advertisements.
|
|
||||||
|
|
||||||
Pi-hole被设计为在Raspberry Pi上托管，但它并不局限于这种硬件。 该软件具有一个友好的网络界面，可以查看洞察力和管理封锁的内容。
|
|
||||||
|
|
||||||
[:octicons-home-16: Homepage](https://pi-hole.net){ .md-button .md-button--primary }
|
|
||||||
[:octicons-eye-16:](https://pi-hole.net/privacy){ .card-link title="Privacy Policy" }
|
|
||||||
[:octicons-info-16:](https://docs.pi-hole.net){ .card-link title=Documentation}
|
|
||||||
[:octicons-code-16:](https://github.com/pi-hole/pi-hole){ .card-link title="Source Code" }
|
|
||||||
[:octicons-heart-16:](https://pi-hole.net/donate){ .card-link title=Contribute }
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
[^1]: AdGuard存储其DNS服务器的汇总性能指标，即对特定服务器的完整请求数、被阻止的请求数和处理请求的速度。 他们还保留并存储了过去24小时内请求的域名数据库。 "我们需要这些信息来识别和阻止新的追踪者和威胁。" "我们还记录了这个或那个追踪器被封锁的次数。 我们需要这些信息来从我们的过滤器中删除过时的规则"。 [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
[^1]: AdGuard存储其DNS服务器的汇总性能指标，即对特定服务器的完整请求数、被阻止的请求数和处理请求的速度。 他们还保留并存储了过去24小时内请求的域名数据库。 "我们需要这些信息来识别和阻止新的追踪者和威胁。" "我们还记录了这个或那个追踪器被封锁的次数。 我们需要这些信息来从我们的过滤器中删除过时的规则"。 [https://adguard.com/en/privacy/dns.html](https://adguard.com/en/privacy/dns.html)
|
||||||
[^2]: Cloudflare只收集和存储发送到1.1.1.1解析器的有限DNS查询数据。 1.1.1.1解析器服务不记录个人数据，而且大部分有限的非个人识别的查询数据只存储25小时。 [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
[^2]: Cloudflare只收集和存储发送到1.1.1.1解析器的有限DNS查询数据。 1.1.1.1解析器服务不记录个人数据，而且大部分有限的非个人识别的查询数据只存储25小时。 [https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/](https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver)
|
||||||
[^3]: Control D只记录具有自定义DNS配置文件的高级解析器。 自由解析器不记录数据。 [https://controld.com/privacy](https://controld.com/privacy)
|
[^3]: Control D只记录具有自定义DNS配置文件的高级解析器。 自由解析器不记录数据。 [https://controld.com/privacy](https://controld.com/privacy)
|
||||||
[^4]: Mullvad的DNS服务对Mullvad VPN的订阅者和非订阅者都适用。 他们的隐私政策明确声称他们不会以任何方式记录DNS请求。 [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
[^4]: Mullvad的DNS服务对Mullvad VPN的订阅者和非订阅者都适用。 他们的隐私政策明确声称他们不会以任何方式记录DNS请求。 [https://mullvad.net/en/help/no-logging-data-policy/](https://mullvad.net/en/help/no-logging-data-policy)
|
||||||
[^5]: When used with an account, NextDNS will enable insights and logging features by default (as some features require it). You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether. If used without an account, no data is logged. [https://nextdns.io/privacy](https://nextdns.io/privacy)
|
[^5]: Quad9收集了一些数据，用于威胁监测和应对。 然后，这些数据可能被重新混合和共享，例如为了安全研究的目的。 Quad9不会收集或记录IP地址或其他他们认为可以识别个人身份的数据。 [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
||||||
[^6]: Quad9收集了一些数据，用于威胁监测和应对。 然后，这些数据可能被重新混合和共享，例如为了安全研究的目的。 Quad9不会收集或记录IP地址或其他他们认为可以识别个人身份的数据。 [https://quad9.net/privacy/policy](https://quad9.net/privacy/policy)
|
|
||||||
|
|||||||
Reference in New Issue
Block a user