Android (Pie): Configure DNS over TLS (DoT)

From version 9.x (Pie) Android supports the DNS over TLS (DoT) protocol. This means: All DNS requests and answers are transmitted via a TLS secured connection, which is established between your Android and a DNS server. In contrast to unsecured DNS queries via UDP port 53, DoT protects against spying out DNS queries and man-in-the-middle attacks. DoT therefore improves both privacy and security.

Activation of DoT under Android 9:

✅ Open the system settings and navigate to "Network & Internet" -> "Advanced" -> "Private DNS".

✅ Choose "hostname of the private DNS provider".

✅ In the field below, enter the address of the DNS server that supports DoT.

Example: dismail.com: fdns1.dismail.com

Then all DNS requests sent by your system will be transmitted via TLS-encrypted connection to the selected DNS server and answered.

With dnsleaktest.com you can check if the selected DoT server is used. Go to the page and tap Standard Test - if you have chosen the dismail.de DoT server you should see the result:

IP: 80.241.218.68
Hostname: dismail.de

Interaction with AFWall+, Blokada and NetGuard:

AFWall+: To make DoT work in combination with AFWall+ you have to allow "(root) - Apps running as root".

Blokada: Only from version 4.x Blokada will support DoT.

NetGuard: Also NetGuard does not support DoT yet.

Note:
This is a global setting and applies to all network interfaces (WLAN, mobile, VPN, etc.). If, for example, you are on the road in your provider's mobile network, you will normally be assigned DNS servers by your provider, which will then answer the DNS queries. If you activate DoT, however, the DNS requests will be processed via the DNS server you have selected - the provider DNS servers will be overwritten.

Source and more Info (read in German): 

https://www.kuketz-blog.de/android-pie-dns-over-tls-dot-einstellen/

#Android #Pie #DNS #DoT #TLS #Guide #Kuketz
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES

As a DNS-over-TLS (DoT) client, use:

▶️ ANDROID

- Private DNS feature in Android 9+
(Settings > Network & internet > Advanced > Private DNS)
- Personal DNS filter
- Nebulo

▶️ LINUX
Stubby
Unbound
Knot
Bind
Personal DNS filter

▶ Windows
Stubby
Personal DNS filter
Download Full Package of personal DNS filter and read the 'README-Windows-Setup.txt' under 'Windows-Scripts' folder.

https://dnsprivacy.org/dns_privacy_clients/

HERE SOME NON-PROFIT RESOLVERS, RUN BY INTERNET ACTIVIST ORGANIZATIONS OR PRIVATE PERSONS ADVOCATING PRIVACY:

✅neutopia*
TLS Hostname:

dns.neutopia.org

TCP port: 853 or 443
IPv4 Address:

89.234.186.112

IPv6 Address:

2a00:5884:8209::2

🇫🇷, EU

✅getdns*★(by getdns/stubby developers)
TLS Hostname: getdnsapi.net
TCP port: 853
IPv4 Address: 185.49.141.37
IPv6 Address: 2a04:b900:0:100::37
🇳🇱, EU

✅cmrg* (by Daniel Kahn Gillmore)
TLS Hostname: dns.cmrg.net
TCP port: 853 or 443
IPv4 Address: 199.58.81.218
IPv6 Address: 2001:470:1c:76d::53
🇨🇦, Canada, CA

✅ AppliedPrivacy**
TLS Hostname: dot1.appliedprivacy.net
TCP port: 853 or 443
IPv4 Address: 146.255.56.98
IPv6 Address: 2a02:1b8:10:234::2
🇩🇪 and 🇦🇹 , EU

✅ Digitale Gesellschaft
TLS Hostname:

dns.digitale-gesellschaft.ch

TCP port: 853
IPv4 Address: 185.95.218.42,

185.95.218.43

IPv6 Address: 2a05:fc84::42,

2a05:fc84::43

🇨🇭 Switzerland, CH

✅ DNS.SB
TLS HOSTNAME: dot.sb
TCP port: 853
IPv4 Address: 45.11.45.11
IPv6 Address 1: 2a09::
IPv6 Address 2: 2a11::
🇩🇪, EU

* - highly recommended based on dnsprivacy-monitoring test

** - logs aggregated data for improving their service. Read its privacy policy

★ - Logs traffic volume only

⚠️ Using plaintext DNS isn't recommended as anyone on the wire (your ISP, governments, hackers, Wi-Fi network/coffee shop you're in, etc.) can see what DNS requests you're making and even manipulate them to forward to malicious sites.

⚠️ Do not use Cloudflare, Quad9, Google or your ISP's DNS, as they're run by big corporations | SOURCE

⚠️ Don't use spyware by @TorstenJahnke and nor his DNS (Keweon DNS) | READ CAREFULLY


#dns #DoT