Google DoT DNS

[Rando]

Hello,

I'm not sure what I have wrong...but I have DHCP settings set to give out default gateway for DNS to the clients. In the WAN section of my RT-AC3100 I have DoT and DNSSEC enabled. I have google's dns servers set as the DoT servers, yet the DoT tests all fail with dnssec enabled or disabled.

Secure transports for DNS | Public DNS | Google Developers

developers.google.com

Any idea what i'm doing wrong? Thanks

 

[Tech9]

Your DoT to Google is working properly.

Cloudflare test page works with Cloudflare servers only. The other test (Tenta?) is not working.

Set everything above Prevent client auto DOH to default No - not needed.

Remove port 853 in DoT settings - not needed. You have Google servers in Preset servers drop down menu.

 

[drinkingbird]

Also DNSSEC to a recursive DNS server is pretty useless other than slowing things down a bit.

Honestly the whole DoT thing is also somewhat pointless, your ISP can see that you send an encrypted packet to a DNS server then all they have to do is see what IP you hit next to determine what sites you're visiting.

 

[sfx2000]

And once one has done that...

dnscheck.tools - check your dns resolvers

A tool to test for DNS leaks, DNSSEC validation, and more

dnscheck.tools

 

[Tech9]

The whole DoT to Google is not needed unless one has ISP or someone else MITM concerns. Now the ISP and Google both have the browsing history.

 

[drinkingbird]

The whole DoT to Google is not needed unless one has ISP or someone else MITM concerns. Now the ISP and Google both have the browsing history.

If you're going to do DoT (which is mostly for privacy concerns) at least pick a provider other than GOOGLE for god's sake.

And use a browser not based on chrome, which pretty much leaves Firefox.

 

[sfx2000]

And use a browser not based on chrome, which pretty much leaves Firefox.

Yes, and Safari on Mac...