<div dir="ltr">great to know this.<div>how can we configure the application to use DNS over TLS by default?</div><div><br></div><div>thanks.</div></div><div class="gmail_extra"><br><div class="gmail_quote">2016-08-04 1:33 GMT+08:00 Keith Mitchell <span dir="ltr"><<a href="mailto:keith@dns-oarc.net" target="_blank">keith@dns-oarc.net</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">OARC is pleased to offer open DNS Privacy resolvers that anyone can use<br>
to experiment with secured DNS over TLS services (see RFC 7858 [1]).<br>
These listen for DNS queries over TLS on TCP port 853.<br>
<br>
Detailed information about this testbed service is available at:<br>
<br>
<a href="https://www.dns-oarc.net/oarc/services/dnsprivacy" rel="noreferrer" target="_blank">https://www.dns-oarc.net/oarc/services/dnsprivacy</a><br>
<br>
Two instances are available - one uses the ISI ANT T-DNS [2] server<br>
proxy, with a back-end hooked into OARC's existing BIND-based ODVR [3]<br>
server to provide packet capture as well as some modicum of logging. The<br>
second server uses Unbound [4] as the front-end, which then forwards<br>
queries to the Unbound-based version of the ODVR service.<br>
<br>
Please note this service is *experimental*, and makes *no* guarantees of<br>
availability, data privacy, RFC compliance/interoperability, or<br>
suitability for live, production use. We do however aim to contribute to<br>
the understanding of operating these services, seeking to improve their<br>
deployment towards these aims. Feedback as to how well or whether they<br>
actually work would be appreciated.<br>
<br>
The IP addresses for the DNS Privacy name-servers are:<br>
<br>
Instance Name IP addresses<br>
<br>
T-DNS <a href="http://tls-dns.odvr.dns-oarc.net" rel="noreferrer" target="_blank">tls-dns.odvr.dns-oarc.net</a> 184.105.193.7<br>
No current IPv6 support<br>
<br>
Unbound <a href="http://tls-dns-u.odvr.dns-oarc.net" rel="noreferrer" target="_blank">tls-dns-u.odvr.dns-oarc.net</a> 184.105.193.78<br>
2620:ff:c000:0:1::64:25<br>
<br>
In line with OARC's mission, query data from these DNS Privacy and our<br>
other testbed name-servers is collected and made available for<br>
non-commercial, public benefit research purposes. Users of the service<br>
should be aware this may include personally identifiable information.<br>
<br>
If your DNS query data is sensitive, you should probably *not* be<br>
trusting it to an experimental 3rd-party research testbed. Depending on<br>
experience gathered from operating these testbeds, user uptake/demand<br>
and/or Member feedback, OARC may or may not in future decide to add<br>
anonymization of data gathered on these servers, or offer a choice for<br>
this on different server(s). Note that it may also be necessary to limit<br>
access to these open resolvers in the event of abuse.<br>
<br>
If you are interested in analyzing data from any of OARC's testbed<br>
tools, information about becoming an OARC member is available at<br>
<<a href="https://www.dns-oarc.net/oarc/agreements" rel="noreferrer" target="_blank">https://www.dns-oarc.net/oarc/agreements</a>>, or please contact us at<br>
<<a href="mailto:admin@dns-oarc.net">admin@dns-oarc.net</a>> if you have any questions/feedback about this service.<br>
<br>
Keith Mitchell<br>
DNS-OARC<br>
<br>
--------<br>
<br>
[1] <a href="https://datatracker.ietf.org/doc/rfc7858/" rel="noreferrer" target="_blank">https://datatracker.ietf.org/doc/rfc7858/</a><br>
[2] <a href="https://ant.isi.edu/software/tdns/tdns-server-proxy/index.html" rel="noreferrer" target="_blank">https://ant.isi.edu/software/tdns/tdns-server-proxy/index.html</a><br>
[3] <a href="https://www.dns-oarc.net/oarc/services/odvr" rel="noreferrer" target="_blank">https://www.dns-oarc.net/oarc/services/odvr</a><br>
[4] <a href="http://www.unbound.net/" rel="noreferrer" target="_blank">http://www.unbound.net/</a><br>
_______________________________________________<br>
dns-operations mailing list<br>
<a href="mailto:dns-operations@lists.dns-oarc.net">dns-operations@lists.dns-oarc.net</a><br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations
dns-operations" rel="noreferrer" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations<br>
dns-operations</a> mailing list<br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" rel="noreferrer" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br>
</blockquote></div><br></div>