Ytdyklly

Folks,

I was trying to enable DNS over TLS via systemd-resolved. I changed /etc/systemd/resolved.conf as follows:

[Resolve]

DNS=1.1.1.1

#FallbackDNS=

Domains=~.

#LLMNR=no

#MulticastDNS=no

#DNSSEC=no

DNSOverTLS=opportunistic

#Cache=yes

#DNSStubListener=yes

while monitoring the network (with tcpdump) to see if the resulting behavior was the intended one, it seems a TLS session is established with the target server, but then the server closes the connection. I got the same results with 1.1.1.1, 8.8.8.8 and others.

Any clues?

P.S.: systemd-resolved ends up doing parallel resolution with traditional DNS (despite the setting of "Domains" above). But my main question for this post is what may be going wrong with the TLS one.

Thanks,
Fernando

DNS-over-TLS in Ubuntu 18.04

based on my experience it will not work the way mentioned above on Ubuntu 18.04+ (i.e. U19).

Since Ubuntu 18+ uses Netplan in parallel with NetworkManager things have changed drastically:
No more manual config in the traditional ways ;-(
Documentation is .... sparse.

snap may bring further changes. It establishes additional resolved.conf files. However, the following actually worked (/w good performance).

For Info about Netplan look here:
https://www.techrepublic.com/article/how-to-set-dns-nameservers-in-ubuntu-server-18-04/

What DNS-over-TLS was working successful (works4me):

1)
In /etc/systemd/resolved.conf
ONLY change the DNSOverTLS= into

DNSOverTLS=opportunistic

There is NO other option (see explanation here
https://wiki.archlinux.org/index.php/Systemd-resolved#DNS_over_TLS

2)
use a capable DNS Server.
I prefer Digitalcourage servers

46.182.19.48 resp. 2a02:2970:1002::18

Why? Privacy!!

2a) this should be done in Network-Manager via GUI!

Enter the DNS server address in the GUI field for your connection under
IPv4 Settings / DNS Servers
and v6 respectively.

The entries will NOT show up in /etc/resolv.conf !! Which is correct. Instead you will see nameserver 127.0.0.53

This is new Ubuntu .... no longer suitable for hobby-admins.

2b) Not recommended but possible alternative

setting appropriate DNS Servers can be done directly in /etc/resolv.conf in the usual format, remove the 127.0.0.53 or something else.

Problem: Gets overwritten by Network-Manager in Ubuntu!

Remedy: As true root (!) chattr the file /etc/resolv.conf

chattr +i /etc/resolv.conf

This is brute force and may disable automatic DNS caching via resolved.

Courtesy the brilliant boys at Arch:
https://wiki.archlinux.org/index.php/Domain_name_resolution

However, works fine ;-) but needs manual maintenance as true root!

Tipp:

You are well advised to make resolv.conf a link. This is required by resolved to work properly. As sudo-root move away the old file then

sudo ln -s /run/resolvconf/resolv.conf /etc/resolv.conf

I do not like this way but is inherently working proper.

.

Then reboot. Or restart network.

.

#
How to check

3) some basic checks

check
the DNS actually used by systemd-resolved:

resolvectl status

check
if DNS resolves with resolvectl:

resolvectl query archlinux.org 

(try some examples)

check
what DNS is actually used, check for leaks in VPN:

https://dnsleaktest.com/

.
4)
Start Wireshark and filter for "port 53" and make web traffic.

This should not show connects on port 53 any longer.
Then filter for port 853. Here should a lot go on.

Important: If all traffic uses port 853 and no traffic uses 53 you did it successfully!!!

Wireshark examples here:
https://www.linuxbabe.com/ubuntu/ubuntu-stubby-dns-over-tls

#
Remark:
I tried stubby. stubby does not integrate well in Ubuntu but you can get it working even with NetworkManager.
There is one manual to do it successful:
https://www.techrepublic.com/article/how-to-use-dns-over-tls-on-ubuntu-linux/
Problem: performance was a pain in the arse. Something is weired and I didnot find out the cause.

Enabling DNSSEC=yes in /etc/systemd/resolved.conf should be possible now.

Important:

This solution improves privacy a lot.

BUT is NOT sufficient if your personal integrity depends on data privacy and security!! See caveats in resolvd description. It is NOT sufficient to have opportunistic mode. Then better watch out for Tails Linux.
A sad greeting to all political prisoners around the world.