Skip to content

Instantly share code, notes, and snippets.

@tianhuil
Forked from uraimo/dnsovertls.md
Created September 20, 2021 13:11
Show Gist options
  • Save tianhuil/1df0d70576fedfc06948aafc9310662d to your computer and use it in GitHub Desktop.
Save tianhuil/1df0d70576fedfc06948aafc9310662d to your computer and use it in GitHub Desktop.
Configure your Mac to use DNS over TLS

Switching to DNS over TLS on macOS

How to configure your Mac to use DNS over TLS in five easy steps:

  1. Install Stubby with Homebrew (https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Daemon+-+Stubby):

     brew install stubby
    
  2. Edit the configuration file:

     vim /usr/local/etc/stubby/stubby.yml
    
  3. Remove the default DNSes an replace them with Quad9 and Cloudflare:

     upstream_recursive_servers:
     # IPv4 addresses
     # Quad9 with EDNS
     - address_data: 9.9.9.11
       tls_auth_name: "dns.quad9.net"
       tls_pubkey_pinset:
       - digest: "sha256"
         value: /SlsviBkb05Y/8XiKF9+CZsgCtrqPQk5bh47o0R3/Cg=
     # Cloudflare
     - address_data: 1.1.1.1
       tls_auth_name: "cloudflare-dns.com"
       tls_pubkey_pinset:
       - digest: "sha256"
         value: V6zes8hHBVwUECsHf7uV5xGM7dj3uMXIS9//7qC8+jU=
     # Quad9 with EDNS
     - address_data: 149.112.112.11
       tls_auth_name: "dns.quad9.net"
       tls_pubkey_pinset:
       - digest: "sha256"
         value: /SlsviBkb05Y/8XiKF9+CZsgCtrqPQk5bh47o0R3/Cg=
     # Cloudflare
     - address_data: 1.0.0.1
       tls_auth_name: "cloudflare-dns.com"
       tls_pubkey_pinset:
       - digest: "sha256"
         value: V6zes8hHBVwUECsHf7uV5xGM7dj3uMXIS9//7qC8+jU=
    

    And also verify that Stubby is configured to use DNS over TLS:

     dns_transport_list:
       - GETDNS_TRANSPORT_TLS
       
     tls_authentication: GETDNS_AUTHENTICATION_REQUIRED  
    
  4. Start the stubby service using the daemon plist provided by Homebrew:

     sudo brew services start stubby
    
  5. Replace the current DNS configuration to use 127.0.0.1:

     sudo /usr/local/opt/stubby/sbin/stubby-setdns-macos.sh
    
  6. Verify that everything is working as expected (use dig or nslookup):

    dig www.google.com
    
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment