paulmillr/encrypted-dns

English | 简体中文 | 繁體中文

encrypted-dns-configs

Configuration profiles for DNS over HTTPS and DNS over TLS. Check out the article for more info: paulmillr.com/posts/encrypted-dns/. To add a new provider, or edit an existing one: see #contributing.

Usage

Install / download profile (.mobileconfig file) from a table below. After that:

iPhones, iPads:

1. Open the file by using Safari (other browsers will just download the file and won't ask for installation)
2. Tap on "Allow" button. The profile should download.
3. Go to System Settings => General => VPN, DNS & Device Management, select downloaded profile and tap the "Install" button.

Mac:

1. Ensure the downloaded file has proper extension: NAME.mobileconfig, not NAME.mobileconfig.txt.
2. Choose Apple menu > System Settings, click Privacy and Security in the sidebar, then click Profiles on the right. You may need to scroll down. You may be asked to supply your password or other information during installation.
3. In the Downloaded section, double-click the profile. Review the profile contents then click Continue, Install or Enroll to install the profile. If an earlier version of a profile is already installed on your Mac, the settings in the updated version replace the previous ones.

Providers

Censorship (also known as "filtering") means the profile will not send true information about hostname=IP relation for some hosts.

Known issues

1. Some apps and protocols will ignore encrypted-dns:
   • Firefox in specific regions, App Store in all regions. More info
   • iCloud Private Relay, VPN clients
   • Little Snitch, LuLu
   • DNS-related CLI tools: host, dig, nslookup etc.
2. Wi-Fi captive portals in cafes, hotels, airports are exempted by Apple from eDNS rules; to simplify authentication - this is ok
3. TLS DNS is easier for providers to block, because it uses non-standard port 853. More info
4. e-dns over TOR could be better privacy-wise, but we don't have this for now.

Contributing

• To add / edit a profile: edit json files in src directory.
• To verify resolver IPs / hostnames: compare mobileconfig files to their original websites (open files in a text editor).
• Check out developer.apple.com for more docs.
• On demand activation: You can optionally exclude some trusted Wi-Fi networks where you don't want to use encrypted DNS. To do so, add your SSIDs in the OnDemandRules section inside the PayloadContent dictionary of a profile.

Scripts

• npm run build - re-build profiles, signed profiles, READMEs

• npm run sign - re-sign all profiles (updates signature field) using an ECC SSL certificate.

  • Signing is done using key-producer
  • Let's Encrypt free certificates are OK, but expire in 45 days.
  • Expects following files to be present in certs subdirectory:

  `privkey.pem`  : the private key for your certificate.
  `fullchain.pem`: the certificate file used in most server software.
  `chain.pem`    : used for OCSP stapling in Nginx >=1.3.7.
  `cert.pem`
  

• npm run new - interactively creates new profile from CLI options. Can also be ran with flags.

  • scripts/new.test.ts includes CLI snapshot tests and a PTY interactive flow test.
  • PTY test runs by default; set NEW_TEST_PTY=0 to opt out.

• src/scripts/sign-single.ts --ca cert.pem --priv_key key.pem [--chain chain.pem] path.mobileconfig - sings single mobileconfig

• src/scripts/sign-single-openssl.ts --ca cert.pem --priv_key key.pem [--chain chain.pem] path.mobileconfig Sign one .mobileconfig using OpenSSL.

  • Uses -nosmimecap to match local CMS signing policy.

• src/scripts/detach.ts signed.mobileconfig - detach CMS signature from signed profile and print PEM to stdout.

• npm run test - Parity check for sign-single.ts vs sign-single-openssl.sh.

  • Generates temporary test root/signer certificates and keys via OpenSSL.
  • Signs the same profile with scripts/sign.ts and scripts/sign_openssl.sh.
  • Verifies detached content and embedded certificate set parity.