Skip to content

Instantly share code, notes, and snippets.

@Cherisea
Forked from uraimo/dnsovertls.md
Created May 23, 2020 14:21
Show Gist options
  • Save Cherisea/f4e0f836e1e1454994852c665d46de1d to your computer and use it in GitHub Desktop.
Save Cherisea/f4e0f836e1e1454994852c665d46de1d to your computer and use it in GitHub Desktop.
Configure your Mac to use DNS over TLS

Switching to DNS over TLS on macOS

How to configure your Mac to use DNS over TLS in five easy steps:

  1. Install Stubby with Homebrew (https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Daemon+-+Stubby):

     brew install stubby
    
  2. Edit the configuration file:

     vim /usr/local/etc/stubby/stubby.yml
    
  3. Remove the default DNSes an replace them with Quad9 and Cloudflare:

     upstream_recursive_servers:
     # IPv4 addresses
     # Quad9 with EDNS
     - address_data: 9.9.9.11
       tls_auth_name: "dns.quad9.net"
       tls_pubkey_pinset:
       - digest: "sha256"
         value: /SlsviBkb05Y/8XiKF9+CZsgCtrqPQk5bh47o0R3/Cg=
     # Cloudflare
     - address_data: 1.1.1.1
       tls_auth_name: "cloudflare-dns.com"
       tls_pubkey_pinset:
       - digest: "sha256"
         value: V6zes8hHBVwUECsHf7uV5xGM7dj3uMXIS9//7qC8+jU=
     # Quad9 with EDNS
     - address_data: 149.112.112.11
       tls_auth_name: "dns.quad9.net"
       tls_pubkey_pinset:
       - digest: "sha256"
         value: /SlsviBkb05Y/8XiKF9+CZsgCtrqPQk5bh47o0R3/Cg=
     # Cloudflare
     - address_data: 1.0.0.1
       tls_auth_name: "cloudflare-dns.com"
       tls_pubkey_pinset:
       - digest: "sha256"
         value: V6zes8hHBVwUECsHf7uV5xGM7dj3uMXIS9//7qC8+jU=
    

    And also verify that Stubby is configured to use DNS over TLS:

     dns_transport_list:
       - GETDNS_TRANSPORT_TLS
       
     tls_authentication: GETDNS_AUTHENTICATION_REQUIRED  
    
  4. Start the stubby service using the daemon plist provided by Homebrew:

     sudo brew services start stubby
    
  5. Replace the current DNS configuration to use 127.0.0.1:

     sudo /usr/local/opt/stubby/sbin/stubby-setdns-macos.sh
    
  6. Verify that everything is working as expected (use dig or nslookup):

    dig www.google.com
    
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment