DoT w/ DNSSEC

[Volfi]

When I try to use DoT with DNSSEC, https://1.1.1.1/help reports I am not using DoT.
Switching off DNSSEC makes DoT test as "ON".
Did not dig deeper, but is this test error, my setup error, or firmware error / feature?

 

[JJohnson1988]

From RMerl's website wiki:

NOTE: There is currently an issue with the popular DoT/DoH test site provided by Cloudflare where it will fail to use properly signed DNSSEC hostnames during the test, causing the test to fail to correctly detect that you are using DoT. This does not indicate that your setup doesn't work, and is something that will hopefully eventually be fixed by Cloudflare. You can avoid this by temporarily disabling validation of unsigned records, however it is recommended to re-enable that option afterward.

 

[Volfi]

Thank you, so my config is correct and I shall continue using it, right?

 

[bbunge]

Thank you, so my config is correct and I shall continue using it, right?

Right

 

[Mutzli]

Thank you, so my config is correct and I shall continue using it, right?

If you want to make sure your configuration is working use tcpdump on your SSH console to follow your connection:

tcpdump -ni eth0 -p port 53 or port 853

All secure connections should be made using port 853. Your log should look like this:

13:15:30.647085 IP Your.IP.Address.48415 > 1.1.1.2.853: Flags [P.], seq 1:275, ack 1, win 229, length 274
13:15:30.664337 IP 1.1.1.2.853 > Your.IP.Address.48415: Flags [.], ack 275, win 66, length 0
13:15:30.667557 IP 1.1.1.2.853 > Your.IP.Address.48415: Flags [.], seq 1:1461, ack 275, win 66, length 1460
13:15:30.667610 IP Your.IP.Address.48415 > 1.1.1.2.853: Flags [.], ack 1461, win 251, length 0

You can install tcpdump with the following command:

opkg install tcpdump

 

[bbunge]

If you want to make sure your configuration is working use tcpdump on your SSH console to follow your connection:

tcpdump -ni eth0 -p port 53 or port 853

All secure connections should be made using port 853. Your log should look like this:

13:15:30.647085 IP Your.IP.Address.48415 > 1.1.1.2.853: Flags [P.], seq 1:275, ack 1, win 229, length 274
13:15:30.664337 IP 1.1.1.2.853 > Your.IP.Address.48415: Flags [.], ack 275, win 66, length 0
13:15:30.667557 IP 1.1.1.2.853 > Your.IP.Address.48415: Flags [.], seq 1:1461, ack 275, win 66, length 1460
13:15:30.667610 IP Your.IP.Address.48415 > 1.1.1.2.853: Flags [.], ack 1461, win 251, length 0

You can install tcpdump with the following command:

opkg install tcpdump

Still does not test DNSSEC. Use Dig to do that.