1---
2layout: post
3title: Setting DoT on mobile and desktop
4subtitle: Enhancing your personal privacy by setting custom DoT servers on all your devices
5description: Enhancing your personal privacy by setting custom DoT servers on all your devices
6cover: /assets/pages/dns.png
7date: 2019-07-20 19:09 -0400
8---
9Changing your default DNS servers to ones that use DNS-over-TLS can do a lot to make your systems more secure and private. DNS is also a serious tool for censorship and tracking if used foolishly. Before choosing a provider, make ***sure*** you actually read their privacy policy and terms of service. There are some good recommendations [here](https://wiki.lelux.fi/dns/resolvers/) (I'm partial to UncensoredDNS) and of course I have to shill [my own](/dns/). Once you've chosen a provider, you'll need to get set up.
10
11# Basic Information
12For the *very* basics, I recommend reading sections 1 - 2 of a [previous post](/blog/dns-and-root-certificates-what-you-need-to-know/#1-what-is-dns-and-why-does-it-concern-you). It has good information and sets you up for this article.
13
14Another useful term to know is [Anycast](https://en.wikipedia.org/wiki/Anycast). A lot of servers (including mine) have it set up so you only have to set and remember one IP address or hostname and you automatically use the server geographically nearest to you, the one with the lowest latency.
15
16DoT stands for [DNS-over-TLS](https://en.wikipedia.org/wiki/DNS_over_TLS). It's a protocol that wraps DNS queries and responses in the [TLS](https://en.wikipedia.org/wiki/Transport_Layer_Security) protocol. By default, most systems use plaintext DNS and this is very insecure. Plaintext is . . . plaintext; anyone can snoop on your connection and see what websites you're visiting. If you're using DNS-over-TLS, the only parties that know where you're going is you and the DNS server itself. This article focuses on that because it's more secure and private. DNS-over-HTTPS ([DoH](https://en.wikipedia.org/wiki/DNS_over_HTTPS)) is another option but far fewer clients support it, it's more difficult to set up, and there are far fewer DoH providers.
17
18# Setup
19Linux and Android are all fairly simple to set up but I couldn't find anything for Windows other than DNS-over-HTTPS (DoH). I couldn't find anything at all for iOS but there are instructions for macOS.
20
21## Linux
22[Unbound](https://wiki.archlinux.org/index.php/Unbound) is what I use for DNS on all of my systems. It's wonderfully easy to use and works very well. Once you've used it for a while and have built up a cache, it's much faster than third-party resolvers.
23
24*(stolen from [here](https://wiki.lelux.fi/dns-over-tls/unbound/linux/))*
25
26Filename: `/etc/unbound/unbound.conf`
27
28
29### Debian
30
31```
32server:
33 tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
34
35forward-zone:
36 name: "."
37 forward-tls-upstream: yes
38
39 forward-addr: 198.251.90.114@853#uncensored.any.nixnet.xyz
40 forward-addr: 104.244.79.229@853#resolver2.lelux.fi
41 forward-addr: 91.239.100.100@853#anycast.censurfridns.dk
42 forward-addr: 185.95.218.42@853#dns.digitale-gesellschaft.ch
43```
44
45### Arch
46
47```
48server:
49 use-syslog: yes
50 do-daemonize: no
51 username: "unbound"
52 directory: "/etc/unbound"
53 # TODO: fix DNSSEC check
54 # trust-anchor-file: trusted-key.key
55 tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
56
57forward-zone:
58 name: "."
59 forward-tls-upstream: yes
60
61 forward-addr: 198.251.90.114@853#uncensored.any.nixnet.xyz
62 forward-addr: 104.244.79.229@853#resolver2.lelux.fi
63 forward-addr: 91.239.100.100@853#anycast.censurfridns.dk
64 forward-addr: 185.95.218.42@853#dns.digitale-gesellschaft.ch
65```
66
67### Using Unbound as a local resolver
68```bash
69echo "nameserver 127.0.0.1" | sudo tee /etc/resolv.conf && sudo chattr +i /etc/resolv.conf
70```
71This sets `127.0.0.1` as your nameserver and locks the file by adding the *immutable* flag (`chattr +i`). To remove the flag and make it editable again, run `chattr -i /etc/resolv.conf`.
72
73## Windows
74I know the title is for DNS-over-TLS but, from what I've found, DoT on Windows is **incredibly** difficult and I can't find much on it. This tell you how to change your plaintext DNS configuration so you can at least use a private resolver.
751. Open the **Control Panel**
762. Click **Network and Internet**
773. Click **Network and Sharing Center**
784. Click **Change adapter settings** in the left pane
795. Right-click the network interface connected to the internet, and select the **Properties** option
806. Select and check the **Internet Protocol Version 4 (TCP/IPv4)** option
817. Click the **Properties** button
828. Click **Use the following DNS server addresses**
839. Enter your primary and secondary DNS addresses. If you're using mine, the primary would be `198.251.90.114` and secondary would be from some other provider (such as [UncensoredDNS's](https://blog.uncensoreddns.org/dns-servers/) `91.239.100.100`)
8410. Click **OK**
8511. As with all things Windows, **reboot** to finish applying the changes.
86
87**EDIT:** It was pointed out that you can use DoH on Windows using something like [Simple DNSCrypt](https://simplednscrypt.org/). After installing and getting it set up, it looks like you would just go to the **Resolvers** tab, disable **Automatic Mode**, then add whatever custom resolvers you want. I don't offer DoH *yet* but there are some providers listed on a friend's [wiki](https://wiki.lelux.fi/dns/resolvers/).
88
89## macOS
90I got this tutorial from [phiffer.org](https://phiffer.org/writing/dns-over-tls-on-macos/). I don't have anything from Apple so I can't test it but a friend of mine did and said it works.
91
921. Use [Homebrew](https://brew.sh/) to install `knot-resolver` then set up a service so it runs on startup with `sudo brew services start knot-resolver`
932. Use your favourite text editor to modify `/usr/local/etc/kresd/config` and add this to the very end of the file: `{% raw %}policy.add(policy.all(policy.TLS_FORWARD({{'198.251.90.114', hostname='uncensored.any.dns.nixnet.xyz'}}))){% endraw %}`
943. Restart `kresd` with `sudo brew services restart knot-resolver`
954. At this point, you should check what DNS server you're currently using to make sure it actually changes. You can do that with `kdig nixnet.xyz`
965. Go to **Apple Menu** > **System Preferences** > **Advanced** > **DNS** then add `127.0.0.1`
976. Test again with `kdig nixnet.xyz`. This time, one of the last couple IP addresses you see should show up something like `127.0.0.1@53(UDP)`.
98
99That's it!
100
101## Android
102Note that DoT is only available on Android Pie and up. For other versions, try [Nebulo](https://smokescreen.app). I go over the process of installing and using it in my last [post](/blog/blocking-ads-on-mobile-and-desktop/#non-rooted-phones). Once you've gone through that, you're pretty much good to. If you want to add additional servers tap the <i class="fa fa-server"></i> server icon, then the plus at the bottom, and add whatever IP addresses or hostnames you'd like. Mine is included by default as **NixNet Uncensored** so all you have to do is select it.
103
104# iOS
105As far as I've been able to find, you can't set custom DNS server on iOS, much less DoT or DoH. I'm sorry ¯\\\_(ツ)\_/¯