<div dir="ltr"><div class="gmail_quote"><div dir="ltr">On Sat, Jan 21, 2017 at 3:46 PM John Kristoff <<a href="mailto:jtk@depaul.edu">jtk@depaul.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">This might be best directed at Google, but I'd welcome unofficial<br class="gmail_msg">
insight as well. It doesn't strictly apply just to Google, but they<br class="gmail_msg">
are often the de facto resolver choice for many systems.<br class="gmail_msg">
<br class="gmail_msg">
I'm interested in the current state of access (DNS client queries)<br class="gmail_msg">
to Google DNS resolvers (8.8.8.8, 8.8.4.4 and IPv6 equivalent) from<br class="gmail_msg">
within mainland China. Particularly availability and trustworthiness.<br class="gmail_msg">
Keyword triggering by the GFW is not a big concern, but the just idea<br class="gmail_msg">
that something may be tampered with is not reassuring.<br class="gmail_msg">
<br class="gmail_msg">
I'm considering whether it would be OK to utilize a traditional<br class="gmail_msg">
resolv.conf that points to Google DNS for some systems or if I should<br class="gmail_msg">
just start getting used to implementing something like dnscrypt or DNS<br class="gmail_msg">
over TLS to try avoid potential problems.<br class="gmail_msg"></blockquote><div><br></div><div>As the DPRIVE (<a href="https://datatracker.ietf.org/wg/dprive/charter/">https://datatracker.ietf.org/wg/dprive/charter/</a>) co-chair, I'd suggest going the DNS over TLS route -- <a href="https://datatracker.ietf.org/doc/rfc7858/">https://datatracker.ietf.org/doc/rfc7858/</a> </div><div><br></div><div>There are a number of implementations, and some good documentation -- <a href="https://portal.sinodun.com/wiki/display/TDNS">https://portal.sinodun.com/wiki/display/TDNS</a> is a good place to start.</div><div>There is also a quick tutorial / background video here: <a href="https://www.youtube.com/watch?v=2JeYIecfwdc">https://www.youtube.com/watch?v=2JeYIecfwdc</a></div><div><br></div><div>If you just want to get started and want to run your own server, I have a docker container which implements RFC7858 by running NGINX as a TLS proxy in front of BIND here: <a href="https://github.com/wkumari/dprive-nginx-bind">https://github.com/wkumari/dprive-nginx-bind</a></div><div><br></div><div>For the client side, stubby (part of the getdns project) -- <a href="https://portal.sinodun.com/wiki/display/TDNS/DNS+Privacy+daemon+-+Stubby">https://portal.sinodun.com/wiki/display/TDNS/DNS+Privacy+daemon+-+Stubby</a></div><div>'tis a daemon which encrypts DNS queries sent from a client machine to a DNS Privacy resolver. Basically you run it locally and then add 127.0.0.1 to resolv.conf and it ships your queries over TLS to a DNS over TLS server. </div><div>It is simple and jsut works...</div><div><br></div><div>W</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br class="gmail_msg">
I've searched around the net a bit and have seen some of the GFW papers<br class="gmail_msg">
in the past, but a current and clear status of the situation I couldn't<br class="gmail_msg">
find. Thoughts and experience welcome. Thanks in advance.<br class="gmail_msg">
<br class="gmail_msg">
John<br class="gmail_msg">
_______________________________________________<br class="gmail_msg">
dns-operations mailing list<br class="gmail_msg">
<a href="mailto:dns-operations@lists.dns-oarc.net" class="gmail_msg" target="_blank">dns-operations@lists.dns-oarc.net</a><br class="gmail_msg">
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" rel="noreferrer" class="gmail_msg" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br class="gmail_msg">
dns-operations mailing list<br class="gmail_msg">
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" rel="noreferrer" class="gmail_msg" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br class="gmail_msg">
</blockquote></div></div>