Firmware Version:384.11_2 Clear DNS over TLS not working?

[jsmiddleton4]

I tried DNS over TLS and this morning disabled it. I can't connect if turned off. It looks like the DNS alternative server information isn't clearing from the table/setting?

How do I go back to not using DNS-TLS stuff once I test it?

 

[jsmiddleton4]

Found it. Had left Enable DNSSEC support checked. I was telling it to do DNSSEC but then not giving it any servers to use.

 

[dave14305]

Can you post the syslog when you disable it and hit apply? Looking for dnsmasq log entries.

 

[jsmiddleton4]

Glad to. Since I'm fooling around with stuff and have added static DNS servers like Google, OpenDNS, for both IPV4 and IPV6 my log is pretty long. What I see in the time stamp for when I was fooling around the DNS over TLS is a bunch of entries, like a lot of them, that say insecure. Is that what you're looking for?

 

[jsmiddleton4]

Rows of this. Given I didn't give it any upstream DNS to "serve" they make sense. There wasn't any upstream DNS server. Not a big deal but seems like if you turn the option for privacy upstream server to "None", maybe a popup to say turn off DNSSEC or turn it off automatically? Although if you're messing with it probably should already know to turn it off.

Mostly my bad tackling a learning curve.


Jun 2 06:47:00 dnsmasq[2566]: Insecure DS reply received for com, could be bad domain configuration or lack of DNSSEC support from upstream DNS servers
Jun 2 06:47:00 dnsmasq[2566]: Insecure DS reply received for com, could be bad domain configuration or lack of DNSSEC support from upstream DNS servers
Jun 2 06:47:00 dnsmasq[2566]: Insecure DS reply received for com, could be bad domain configuration or lack of DNSSEC support from upstream DNS servers
Jun 2 06:47:00 dnsmasq[2566]: Insecure DS reply received for com, could be bad domain configuration or lack of DNSSEC support from upstream DNS servers
Jun 2 06:47:00 dnsmasq[2566]: Insecure DS reply received for com, could be bad domain configuration or lack of DNSSEC support from upstream DNS servers
Jun 2 06:47:00 dnsmasq[2566]: Insecure DS reply received for com, could be bad domain configuration or lack of DNSSEC support from upstream DNS servers
Jun 2 06:47:00 dnsmasq[2566]: Insecure DS reply received for com, could be bad domain configuration or lack of DNSSEC support from upstream DNS servers
Jun 2 06:47:00 dnsmasq[2566]: Insecure DS reply received for com, could be bad domain configuration or lack of DNSSEC support from upstream DNS servers
Jun 2 06:47:00 dnsmasq[2566]: Insecure DS reply received for com, could be bad domain configuration or lack of DNSSEC support from upstream DNS servers
Jun 2 06:47:00 dnsmasq[2566]: Insecure DS reply received for com, could be bad domain configuration or lack of DNSSEC support from upstream DNS servers
Jun 2 06:47:00 dnsmasq[2566]: Insecure DS reply received for com, could be bad domain configuration or lack of DNSSEC support from upstream DNS servers
Jun 2 06:47:00 dnsmasq[2566]: Insecure DS reply received for com, could be bad domain configuration or lack of DNSSEC support from upstream DNS servers
Jun 2 06:47:00 dnsmasq[2566]: Insecure DS reply received for com, could be bad domain configuration or lack of DNSSEC support from upstream DNS servers
Jun 2 06:47:00 dnsmasq[2566]: Insecure DS reply received for com, could be bad domain configuration or lack of DNSSEC support from upstream DNS servers
Jun 2 06:47:00 dnsmasq[2566]: Insecure DS reply received for com, could be bad domain configuration or lack of DNSSEC support from upstream DNS servers
Jun 2 06:47:00 dnsmasq[2566]: Insecure DS reply received for com, could be bad domain configuration or lack of DNSSEC support from upstream DNS servers
Jun 2 06:47:00 dnsmasq[2566]: Insecure DS reply received for com, could be bad domain configuration or lack of DNSSEC support from upstream DNS servers
Jun 2 06:47:00 dnsmasq[2566]: Insecure DS reply received for com, could be bad domain configuration or lack of DNSSEC support from upstream DNS servers
Jun 2 06:47:01 rc_service: udhcpc 4190:notify_rc start_dhcp6c

 

[bbunge]

Most likely your ISP DNS servers do not support DNSSEC. Try Cloudflare, 1.1.1.1 and 1.0.0.1 with DoT and DNSSEC enabled. This combo seems to work best for me.

 

[jsmiddleton4]

Yes I understand.

It is interesting that even though I hit the minus key for removing the entries and Apply it appears the entries are not actually removed from the internal table.