DNS-over-TLS (DoT) - A security protocol for encrypted DNS on a dedicated port 853. Some providers support port 443 which generally works everywhere while port 853 is often blocked by restrictive firewalls.
+
DNS-over-HTTPS (DoH) - Similar to DoT, but uses HTTPS instead, being indistinguishable from "normal" HTTPS traffic on port 443.
+
DNSCrypt - An older yet robust method of encrypting DNS.
+
Note: Using an encrypted DNS resolver will not make you anonymous, nor hide your internet traffic from your Internet Service Provider. But, it will prevent DNS hijacking, and make your DNS requests harder for third parties to eavesdrop on and tamper with. If you are currently using Google's DNS resolver, you should pick an alternative here.
diff --git a/assets/img/png/3rd-party/dnscloak.png b/assets/img/png/3rd-party/dnscloak.png
new file mode 100644
index 00000000..ecb9ca87
Binary files /dev/null and b/assets/img/png/3rd-party/dnscloak.png differ
diff --git a/assets/img/png/3rd-party/nebulo.png b/assets/img/png/3rd-party/nebulo.png
new file mode 100644
index 00000000..4fa9af09
Binary files /dev/null and b/assets/img/png/3rd-party/nebulo.png differ
diff --git a/assets/img/svg/3rd-party/unbound.svg b/assets/img/svg/3rd-party/unbound.svg
new file mode 100644
index 00000000..0d0a5a19
--- /dev/null
+++ b/assets/img/svg/3rd-party/unbound.svg
@@ -0,0 +1,3 @@
+
+
+
\ No newline at end of file
diff --git a/pages/providers/dns.html b/pages/providers/dns.html
index db65a9d9..710cf167 100644
--- a/pages/providers/dns.html
+++ b/pages/providers/dns.html
@@ -8,81 +8,82 @@ breadcrumb: "DNS"
{% include sections/dns.html %}
-
Terms
+
+
+
+ Encrypted DNS Client Recommendations for Desktop
+
-
-
DNS-over-TLS (DoT) - A security protocol for encrypted DNS on a dedicated port 853. Some providers support port 443 which generally works everywhere while port 853 is often blocked by restrictive firewalls. DoT has two modes:
-
-
Oppurtunistic mode: the client attempts to form a DNS-over-TLS connection to the server on port 853 without performing certificate validation. If it fails, it will use unencrypted DNS.
-
Strict mode: the client connects to a specific hostname and performs certificate validation for it. If it fails, no DNS queries are made until it succeeds.
-
-
DNS-over-HTTPS (DoH) - Similar to DoT, but uses HTTPS instead, being indistinguishable from "normal" HTTPS traffic on port 443.
-
DNSCrypt - An older yet robust method of encrypting DNS.
-
+{%
+ include cardv2.html
+ title="Firefox's built-in DNS-over-HTTPS resolver"
+ image="/assets/img/svg/3rd-party/firefox_browser.svg"
+ description='Firefox comes with built-in DoH support with Cloudflare set as the default resolver, but can be configured to use any DoH resolver.'
+ labels="warning:Warning:Cloudflare has agreed to collect only a limited amount of data about the DNS requests that are sent to the Cloudflare Resolver for Firefox via the Firefox browser."
+ website="//support.mozilla.org/en-US/kb/firefox-dns-over-https#w_about-dns-over-https"
+ privacy-policy="//wiki.mozilla.org/Security/DOH-resolver-policy"
+ forum="TBD"
+%}
-
How to verify DNS is encrypted
+{%
+ include cardv2.html
+ title="dnscrypt-proxy"
+ image="/assets/img/svg/3rd-party/dnscrypt-proxy.svg"
+ description='A flexible DNS proxy, with support for modern encrypted DNS protocols such as DNSCrypt v2, DNS-over-HTTPS and Anonymized DNSCrypt.'
+ website="//dnscrypt.info/"
+ forum="TBD"
+ github="//github.com/DNSCrypt/dnscrypt-proxy"
+%}
-
Check the website of your DNS provider. They may have a page for telling "you are using our DNS." Examples include AdGuard and Cloudflare.
-
If using Firefox's trusted recursive resolver (TRR), navigate to about:networking#dns. If the TRR column says "true" for some fields, you are using DoH.
QNAME Minimization - Run dig +short txt qnamemintest.internet.nl from the command-line (taken from this NLnet Labs presentation). If you are on Windows 10, run Resolve-DnsName -Type TXT -Name qnamemintest.internet.nl from the PowerShell. You should see this display: "HOORAY - QNAME minimisation is enabled on your resolver :)!"
-
+{%
+ include cardv2.html
+ title="Unbound"
+ image="/assets/img/svg/3rd-party/unbound.svg"
+ description='Unbound is a validating, recursive, caching DNS resolver, supporting DNS-over-TLS, and has been independently audited.'
+ website="//nlnetlabs.nl/projects/unbound/about/"
+ forum="TBD"
+ github="//github.com/NLnetLabs/unbound"
+%}
-
Software suggestions and Additional Information
+
+
+
+ Encrypted DNS Client Recommendations for Android
+
-
-
Encrypted DNS clients for desktop:
-
-
Firefox comes with built-in DoH support with Cloudflare set as the default resolver, but can be configured to use any DoH resolver. Currently Mozilla is conducting studies before enabling DoH by default for all US-based Firefox users.
-
-
DNS over HTTPS can be enabled in Menu -> Preferences (about:preferences) -> Network Settings -> Enable DNS over HTTPS. Set "Use Provider" to "Custom", and enter your DoH provider's address.
-
Advanced users may enable it in about:config by setting network.trr.custom_uri and network.trr.uri as the address you find from the documentation of your DoH provider and network.trr.mode as 2. It may also be desirable to set network.security.esni.enabled to True in order to enable encrypted SNI and make sites supporting ESNI a bit more difficult to track.
We recommend selecting Private DNS provider hostname and entering the DoT address from documentation of your DoT provider to enable strict mode (see Terms above).
-
+{%
+ include cardv2.html
+ title="Android 9's built-in DNS-over-TLS resolver"
+ image=""
+ description='Android 9 (Pie) comes with built-in DNS-over-TLS support.'
+ labels="warning:Warning:However, apps that perform their own DNS queries, instead of using the system's APIs, must ensure that they do not send insecure DNS queries when the system has a secure connection."
+%}
+
+{%
+ include cardv2.html
+ title="Nebulo"
+ image="/assets/img/png/3rd-party/nebulo.png"
+ description='An open-source application for Android supporting DNS-over-HTTPS and DNS-over-TLS. It also supports caching DNS responses and locally logging DNS queries.'
+ website="//git.frostnerd.com/PublicAndroidApps/smokescreen/-/blob/master/README.md"
+ privacy-policy="//smokescreen.app/privacypolicy"
+ forum="TBD"
+ source="//git.frostnerd.com/PublicAndroidApps/smokescreen"
+%}
+
+
+
+
+ Encrypted DNS Client Recommendations for iOS
+
+
+{%
+ include cardv2.html
+ title="DNSCloak"
+ image="/assets/img/png/3rd-party/dnscloak.png"
+ description='An open-source DNSCrypt and DNS-over-HTTPS client by the Center for the Cultivation of Technology gemeinnuetzige GmbH. Can be described as dnscrypt-proxy for iOS.'
+ website="https://github.com/s-s/dnscloak/blob/master/README.md"
+ privacy-policy="//drive.google.com/file/d/1050No_pU74CAWUS5-BwQWyO2x_aiMzWc/view"
+ github="//github.com/s-s/dnscloak"
+%}
+
+