Handle DNS over TLS #636

Mikilio commented 2025年04月28日 01:36:22 +02:00

So it seems my Uni is not operating eduVPN with the ability to handle DNS over TLS. It was a quite the journey to learn that this was even an issue. I do not know if my Uni is at fault here as I couldn't find anything on this on any issue here. As such, I'd like to propose two alternatives that could avoid this problem.

1. Require a certain DNS over TLS setting from VPN providers and add a dns-over-tls line to the connections section.
2. Somehow check the capabilities of the peer before setting the dns-over-tls line.

Currently, dns-over-tls is not handled at all. However, programs like systemd-resolved may cause dns-over-tls to be the default in some systems.

So it seems my Uni is not operating eduVPN with the ability to handle DNS over TLS. It was a quite the journey to learn that this was even an issue. I do not know if my Uni is at fault here as I couldn't find anything on this on any issue here. As such, I'd like to propose two alternatives that could avoid this problem. 1. Require a certain DNS over TLS setting from VPN providers and add a `dns-over-tls` line to the connections section. 2. Somehow check the capabilities of the peer before setting the `dns-over-tls` line. Currently, `dns-over-tls` is not handled at all. However, programs like systemd-resolved may cause `dns-over-tls` to be the default in some systems.

jwijenbergh commented 2025年04月30日 09:23:06 +02:00

Hi, I am not sure I understand. What is the use case? When you're connected to a VPN the DNS traffic is already encrypted

Hi, I am not sure I understand. What is the use case? When you're connected to a VPN the DNS traffic is already encrypted

Mikilio commented 2025年04月30日 10:41:52 +02:00

I didn't really want to start a discussion on whether DoT is usefull on VPN networks.
What I wanted to point out is that eduVPN may not work when DoT is globally enabled (which for some people it is, since we are not always connected to a VPN).
In my case, the workaround was to turn off DoT for the eduVPN interface only, which is not trivial (not achievable via nm-applet e.g.)
Using one of my proposed solutions or just setting dns-over-tls=0 for the connection would already be enough to reduce frustration for many users without really hurting anyone.

I didn't really want to start a discussion on whether DoT is usefull on VPN networks. What I wanted to point out is that eduVPN may not work when DoT is globally enabled (which for some people it is, since we are not always connected to a VPN). In my case, the workaround was to turn off DoT for the eduVPN interface only, which is not trivial (not achievable via nm-applet e.g.) Using one of my proposed solutions or just setting `dns-over-tls=0` for the connection would already be enough to reduce frustration for many users without really hurting anyone.

fkooman commented 2025年04月30日 11:52:01 +02:00

DoT is globally enabled

This seems unfortunate, as whether or not DoT is available depends very much on the DNS server you configured. It seems globally enabling that is a configuration mistake.

Which Linux distributions do you know that out of the box enable DoT globally for all DNS servers?

If you configure DoT yourself, it may be much better to configure it per link and not globally:

In addition to this global DNSOverTLS= setting systemd-networkd.service(8) also maintains per-link DNSOverTLS= settings. For system DNS servers (see above), only the global DNSOverTLS= setting is in effect. For per-link DNS servers the per-link setting is in effect, unless it is unset in which case the global setting is used instead.

If you enable DoT "globally" and you "roam" with your laptop to various different locations I guess DNS will be broken most of the time anyway?

> DoT is globally enabled This seems unfortunate, as whether or not DoT is available depends very much on the DNS server you configured. It seems globally enabling that is a configuration mistake. Which Linux distributions do you know that out of the box enable DoT globally for all DNS servers? If you configure DoT yourself, it may be much better to configure it [per link](https://www.freedesktop.org/software/systemd/man/latest/resolved.conf.html#DNSOverTLS=) and not globally: > In addition to this global DNSOverTLS= setting systemd-networkd.service(8) also maintains per-link DNSOverTLS= settings. For system DNS servers (see above), only the global DNSOverTLS= setting is in effect. For per-link DNS servers the per-link setting is in effect, unless it is unset in which case the global setting is used instead. If you enable DoT "globally" and you "roam" with your laptop to various different locations I guess DNS will be broken most of the time anyway?

Mikilio commented 2025年04月30日 12:00:12 +02:00

I do not experience a lot of issues with "roaming".

As mentioned before, I do actually end up configuring per link, but rather to turn DoT off.
I believe I am not the only person that turns on privacy preserving settings "just in case".

Even if you feel like this configuration shouldn't be accommodated for, it would be nice to keep this issue open for discoverability and see if there will be another instance of it.

I do not experience a lot of issues with "roaming". As mentioned before, I do actually end up configuring per link, but rather to turn DoT off. I believe I am not the only person that turns on privacy preserving settings "just in case". Even if you feel like this configuration shouldn't be accommodated for, it would be nice to keep this issue open for discoverability and see if there will be another instance of it.

jwijenbergh commented 2025年10月29日 09:52:26 +01:00

Honestly, I am not sure what to exactly do here. Let me know what the client could do better

Honestly, I am not sure what to exactly do here. Let me know what the client could do better

Kevinjil commented 2026年01月29日 16:06:42 +01:00

Honestly, I am not sure what to exactly do here. Let me know what the client could do better

@jwijenbergh For me personally, an option Ignore DNS settings provided by VPN would be appreciated. I'm using DoT globally, and do not trust DNS settings provided by any connection, e.g. DHCP over ethernet / wifi. I neither want nor need the DNS settings of the VPN and now I have to manually strip it after connecting using nmcli or resolvectl as the forced insertion breaks connectivity.

> Honestly, I am not sure what to exactly do here. Let me know what the client could do better @jwijenbergh For me personally, an option `Ignore DNS settings provided by VPN` would be appreciated. I'm using DoT globally, and do not trust DNS settings provided by any connection, e.g. DHCP over ethernet / wifi. I neither want nor need the DNS settings of the VPN and now I have to manually strip it after connecting using `nmcli` or `resolvectl` as the forced insertion breaks connectivity.