Android (Pie): Configure DNS over TLS (DoT)

From version 9.x (Pie) Android supports the DNS over TLS (DoT) protocol. This means: All DNS requests and answers are transmitted via a TLS secured connection, which is established between your Android and a DNS server. In contrast to unsecured DNS queries via UDP port 53, DoT protects against spying out DNS queries and man-in-the-middle attacks. DoT therefore improves both privacy and security.

Activation of DoT under Android 9:

✅ Open the system settings and navigate to "Network & Internet" -> "Advanced" -> "Private DNS".

✅ Choose "hostname of the private DNS provider".

✅ In the field below, enter the address of the DNS server that supports DoT.

Example: dismail.com: fdns1.dismail.com

Then all DNS requests sent by your system will be transmitted via TLS-encrypted connection to the selected DNS server and answered.

With dnsleaktest.com you can check if the selected DoT server is used. Go to the page and tap Standard Test - if you have chosen the dismail.de DoT server you should see the result:

IP: 80.241.218.68
Hostname: dismail.de

Interaction with AFWall+, Blokada and NetGuard:

AFWall+: To make DoT work in combination with AFWall+ you have to allow "(root) - Apps running as root".

Blokada: Only from version 4.x Blokada will support DoT.

NetGuard: Also NetGuard does not support DoT yet.

Note:
This is a global setting and applies to all network interfaces (WLAN, mobile, VPN, etc.). If, for example, you are on the road in your provider's mobile network, you will normally be assigned DNS servers by your provider, which will then answer the DNS queries. If you activate DoT, however, the DNS requests will be processed via the DNS server you have selected - the provider DNS servers will be overwritten.

Source and more Info (read in German): 

https://www.kuketz-blog.de/android-pie-dns-over-tls-dot-einstellen/

#Android #Pie #DNS #DoT #TLS #Guide #Kuketz
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES

DNS over TLS Lets Google Serve You More Ads

Like a lot of people, I hate advertisements. In my quest to remove ads as much as possible, I've installed an ad blocker in my browser. To go further, I've installed Pi-Hole to block ads for all devices on my home network. I've even setup firewall rules to re-route all DNS traffic through Pi-Hole. This setup seemed to work pretty well until I noticed I was still seeing ads in an app on my Android phone.

Sometime in the last couple of years Google added a Private DNS feature to Android and enabled it by default. Private DNS is really DNS over TLS (DoT), which is supposed to be a privacy feature that encrypts your DNS so your network operators can't snoop on what sites you're browsing. It sounds nice in theory, but when I'm at home, I am the network operator, and DoT has a side-effect of making my apps and devices ignore my carefully planned DNS settings, and bypass my (actually privacy enhancing) Pi-Hole ad blocker. The (surely coincidental) outcome is that Google can freely serve ads to my Android device.

You can disable the Private DNS feature in Android (for now). The bad news is that Firefox is enabling DNS over HTTPS (DoH), which is a similar system, with similar drawbacks. Now, you have to change settings not only on each device's operating system, but you might have to individually configure every app to disable DoT/DoH. The next thing I'm going to try is blocking all traffic to public DoT/DoH servers at my firewall.

💡 Update 2021-03-22:
I learned that Firefox supports a temporary workaround for disabling DoH. You can setup Pi-Hole to point the "canary domain" use-application-dns.net to any IP address to cause Firefox to use normal DNS.

https://ericlathrop.com/2021/03/dns-over-tls-lets-google-serve-you-more-ads/

#private #dns #tls #google #DeleteGoogle #advertising #smartphones #workaround
📡 @nogoolag @blackbox_archiv