Encrypt your DNS queries on /e/OS system-wide

manish · May 21, 2020, 8:53am

Mission:

Learn to encrypt your DNS queries using DNS-over-TLS client implementation known as Private DNS in your smartphone running latest /e/OS.

Prerequisites:

A smartphone with /e/OS based on Android 9 or newer.
Patience to fiddle around with /e/OS Settings

Let’s roll.

Why should you Encrypt your DNS?
The same reason why we use https to access our favorite websites including this very forum or wiki. To seek privacy, security and integrity of data communication.

1. Goto /e/OS Settings to open Network & Internet settings therein.

2. In Network & Internet settings, navigate to ‘Advanced’ settings therein

Tap PrivateDNS to continue.

Input a DNS hostname of your choice from various options available across the globe.

Popular public domain name resolving services offering DoT or Private DNS support:

Name | Hostname
Nic.cz | odvr.nic.cz (used in this guide)
Quad9 | dns.quad9.net
Cloudflare | 1dot1dot1dot1.cloudflare-dns.com

Enter DNS hostname of your choice and tap ‘Save’ to continue.

Private DNS attempts to connect when connected you see the hostname in settings as seen in the image below.

3. Check DNS settings or leaks in /e/OS’s browser

Open https://dnsleaktest.com in /e/OS’s browser and tap Extended test to continue.

Once the test is complete you should exclusively see the DNS servers that you have set in Private DNS settings of your /e/OS, as seen in the image below.

Troubleshooting

image1080×180 11.2 KB

If you see the error as seen in the image above, it means you have entered wrong DNS hostname or the service you are using is broke. Try another one to check. It should fix the issue.

Thanks for reading!

harvey186 · May 21, 2020, 9:10am

with this, you will kill trackerControl / Netguard and Co, because they can’t read the network address anymore

GaelDuval · May 21, 2020, 9:40am

Also if you force DNS servers in Settings->Network & internet->DNS, like 9.9.9.9, you can set private DNS to automatic and it should use DNS over TLS using this server.

Note that with Quad9, DNS servers tested with dnsleaktest will show up as Woodynet (they have a partnership)

harvey186 · May 21, 2020, 9:46am

Which trackerBlocker do you use ??

I have had some users which where wondering why TrackerControl don’t ‘see’ any Tracker. After disabeling the DNS encryption, TrackerControl works fine

archje · May 21, 2020, 9:51am

»Now all DNS requests sent by my system are transmitted and answered via TLS encrypted connection to the selected DNS server.«

harvey186 · May 21, 2020, 10:24am

Just gotten the confirmation from the Dev of TrackerControl. TrackerControl can’t handle private DNS nor encrypted DNS requests.

TC is moste like Netguard, so I think (but don’t know for sure) that NG will also fail with this setup. So everyone have to decide: Blocking trackers or using private DNS encryption

archje · May 21, 2020, 10:36am

It’s good you’re dealing with it, @harvey186 This information is valuable.

I appreciate the “Select private DNS mode” feature in /e/ OS 9-Pie and use it because with FOSS apps à la Simple Mobile Tools (/from F-Droid Store) and don’t need apps like the very attractive TrackerControl (TC).

harvey186 · May 21, 2020, 10:51am

That’s the best way, but for all other users which are using non-FOSS apps it a needed information that TC isn’t failing with private DNS and I have jus read (in german) that Netguard does have the same issue Blokada seems also onyl AFW+ with root not. But root is not the best for a device

archje · May 21, 2020, 10:57am

I totally agree with you. As I wrote above: »This information is valuable.«

manish · May 22, 2020, 5:24am

Please don’t recommend it, it has been shut down since 30.04.2020.

archje · May 22, 2020, 6:05am

Where did you get this information?

On the website of dismail de are valid as of today:

fdns2.dismail.com | fdns1.dismail.com

harvey186 · May 22, 2020, 6:59am

@GaelDuval Once more my question: what tracker blocker do you use ?? Or do you really only use FOSS aps ??

manish · May 22, 2020, 7:08am

I quoted https://securedns.eu/ It has apparently shut down as per the notice on the homepage itself.

archje · May 22, 2020, 7:27am

Aha, I’ve assumed that dismail.de | Host: fdns1.dismail.de | Server location: Germany and the accompanying picture.

Please note: TLS Hostname: dot.securedns.eu

SecureDNS has been shutdown since the 30th of April 2020. Please do not use SecureDNS anymore.

archje · May 22, 2020, 9:19am

@harvey186 , please remember: 93 Smartphones are supported by /e/. Only 20 of them run with /e/ OS 9-Pie and the DNS over TLS (DoT) feature.

20 devices with /e/ OS 9-Pie

Tracker Control & Co. are and remain an extremely useful tools.

harvey186 · May 22, 2020, 9:21am

But still wait for an answer from GAEL. He is promoting apps with trackers via apps store. So he should also showing a way to block them

manish · May 22, 2020, 9:30am

Did you check the homepage of https://securedns.eu yet?

archje · May 22, 2020, 9:47am

I don’t understand your question!

The quote with link here and here indicates that dot.securedns.eu should no longer be used.

manish · May 22, 2020, 10:37am

I am only trying to tell, stop recommending SecureDNS any more. It is shut down officially even if it still works.

archje · May 22, 2020, 10:48am

And I quote securedns.eu in two postings (here and here) saying “Please do not use SecureDNS anymore.” So that should take care of that point.Or what do you think is necessary in order to be able to consider the subject as clarified?