Adguardhome: Add DNSSEC support
I think adding full DNSSEC validation will making all queries more reliable unless clients explicitly opt out.
KrasnayaPloshchad
All 41 comments
It makes sense, thank you for the feature request!
ameshkov
on 19 Oct 2016
I came here to make this same request.
To test if DNSSEC is enabled opening sigfail.verteiltesysteme.net you should get an error. If you test sigok.verteilesysteme.net you should see a blank page.
Itsnothectic
on 10 Apr 2017
Unfortunately, another DNSSEC resolver test fails so far.
sergeevabc
on 27 Jun 2017
Not yet, guys. I am sorry for the delays, we're a bit limited in resources, and I'd like not to switch to DNS tasks until we can really focus on them.
ameshkov
on 10 Sep 2017
No worries! Just figuring, since DNSCrypt got done, perhaps this got some love as well. Keep on 🚚ing! 📣
TPS
on 10 Sep 2017
Any update on this?
evilvibes
on 1 Jan 2018
@evilvibes we don't want to touch the current installation until the updated version is ready. That's why this issue is still open.
ameshkov
on 3 Jan 2018
So, does that mean there's ß version someplace? Will it be accessible to play with test sometime?
TPS
on 3 Jan 2018
So, does that mean there's ß version someplace? Will it be accessible to play with test sometime?
I'd say it's more of a "demo" at the moment. The old code was tossed out, and the new version is basically a patched Unbound DNS server. Not yet available publicly.
ameshkov
on 4 Jan 2018
Yes. Will wait for DNSSEC support. Most important thing in modern Russia.
Corsten56
on 23 Feb 2018
Hi there, any news about dnssec?
and do you think hheres a opinion do start a server in central europe example frankfurt or zurich?
greets
ibksturm
on 20 Mar 2018
Central Europe Server would be great, yes 👍
jonathanmmm
on 22 Mar 2018
jupp, would be great, so my route don't have to go over the half of the world as i wrote months ago ^^
ibksturm
on 15 Apr 2018
Any updates on this issue? DNSSEC is very important and has been receiving increased attention lately, including as a part of Cloudflare's Crypto Week 2018 (https://blog.cloudflare.com/automatically-provision-and-maintain-dnssec/).
Ryan-Goldstein
on 21 Sep 2018
I was planning to open also a DNSSEC Request but since there is already one, one more who wishes this option
Who-42
on 18 Oct 2018
We'll prioritize this issue, guys, thank you!
ameshkov
on 18 Oct 2018
news? i looks as the way i'm running AGH dnssec looks like running
ibksturm
on 7 Dec 2018
Do you have any news ? it's a big feature now for a DNS server. Thanks !
Mikiya83
on 14 Jan 2019
No news on this yet, sorry
ameshkov
on 15 Jan 2019
How far are you from implement this?
Is the only thing keeping me in pihole, together with https://github.com/AdguardTeam/AdGuardHome/issues/922 and a few other things of milestone 0.101
lordraiden
on 30 Nov 2019
Just to keep in mind: it should be possible to mark some domains and zones as "unsecure", not to try verification at all.
Revertron
on 10 Mar 2020
ьолшо сьасибо 👍
ibksturm
on 18 Mar 2020
Recently, I enabled the dnsmasq's DNSSEC on my openwrt router and it works as a dns proxy just working the same as the normal router, AGH on my laptop. I set to use AGH as local dns and CF (DoT) as upstream. However, when dnsmasq's DNSSEC enabled, the AGH failed to dispatch any valid DNS response. According to the verbose log of AGH, it seems that AGH just got connection error from upstream and then returned error(But I'm not so sure about that, my internet connectivity is working properly). I tried to switch off the dnsmasq's DNSSEC, AGH works properly.
Any suggestion?
kmahyyg
on 11 Apr 2020
@kmahyyg have you tried checking what exactly dnsmasq returns for these queries?
ameshkov
on 13 Apr 2020
Yes, I tried. works perfectly.
Send from Evangeline's Android
From: Andrey Meshkov notifications@github.com
Sent: Monday, April 13, 2020 9:16:41 PM
To: AdguardTeam/AdGuardHome AdGuardHome@noreply.github.com
Cc: Patrick Young kmahyygyyg@gmail.com; Mention mention@noreply.github.com
Subject: Re: [AdguardTeam/AdGuardHome] Add DNSSEC support (#66)
@kmahyyghttps://github.com/kmahyyg have you tried checking what exactly dnsmasq returns for these queries?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/AdguardTeam/AdGuardHome/issues/66#issuecomment-612893513, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AD6V3Y43LGAXCKHXZFSUD3LRMMGDTANCNFSM4CTGHHYA.
kmahyyg
on 13 Apr 2020
Weird, what kind of connection error does AGH receives?
ameshkov
on 13 Apr 2020
Weird, what kind of connection error does AGH receives?
I don't know. I turned on verbose , all logging seems perfect, just get response from upstream as NORESPONSE FROM UPSTREAM. Then dns request timed out. but those domains really exists. I tried to use kdig and set the upstream correctly, the domain is exists.
After I turned off DNSSEC on my router, all things get working. BTW, I'm in china mainland, which has serious network censorship.
kmahyyg
on 13 Apr 2020
Could you please post a part of the log with these requests and responses? Maybe I'll notice something there
ameshkov
on 13 Apr 2020
Could you please post a part of the log with these requests and responses? Maybe I'll notice something there
Here's the full log after I enabled DNSSEC on my router. Since I've configured the upstream as log shown, it shouldn't be failed to response.
1579 might be related to this issue.
At the same time when AGH failed,
kmahyyg
on 16 Apr 2020
@kmahyyg Can you disable SafeBrowsing ?
In your logs I only see SafeBrowsing: checking... but no sign of the results of SB check. That's very strange considering 3sec timeout for those operations.
Looks like a global dead lock to me: no goroutine has woken up from SB check.
szolin
on 17 Apr 2020
@kmahyyg Can you disable SafeBrowsing ?
In your logs I only seeSafeBrowsing: checking...but no sign of the results of SB check. That's very strange considering 3sec timeout for those operations.
Looks like a global dead lock to me: no goroutine has woken up from SB check.
I will try later... But I think dnssec shouldn't have affiliate with SB?
kmahyyg
on 17 Apr 2020
@szolin
Here's why it happens:
2020/04/16 10:40:18 17356#55 [debug] github.com/AdguardTeam/dnsproxy/upstream.lookup(): successfully finished lookup for dns-family.adguard.com in 59 milliseconds using 176.103.130.131. Result : []
2020/04/16 10:40:18 17356#54 [debug] github.com/AdguardTeam/dnsproxy/upstream.lookup(): successfully finished lookup for dns-family.adguard.com in 78 milliseconds using 176.103.130.130. Result : []
@kmahyyg
Could it be that your router intercepts plain DNS queries and does some additional filtering? Because it seems that when DNSSEC is enabled, we cannot resolve dns-family.adguard.com address (empty "Result: []" in the log)
ameshkov
on 17 Apr 2020
@szolin
Here's why it happens:
2020/04/16 10:40:18 17356#55 [debug] github.com/AdguardTeam/dnsproxy/upstream.lookup(): successfully finished lookup for dns-family.adguard.com in 59 milliseconds using 176.103.130.131. Result : [] 2020/04/16 10:40:18 17356#54 [debug] github.com/AdguardTeam/dnsproxy/upstream.lookup(): successfully finished lookup for dns-family.adguard.com in 78 milliseconds using 176.103.130.130. Result : []@kmahyyg
Could it be that your router intercepts plain DNS queries and does some additional filtering? Because it seems that when DNSSEC is enabled, we cannot resolvedns-family.adguard.comaddress (empty "Result: []" in the log)
pretty weird......
kmahyyg
on 17 Apr 2020
Okay, I see the problem. The last photo is DNSSEC disabled.
This is enabled. Problem is SERVFAIL. But even so, this should not happen. Why does DNSSEC use my router's DNS instead of using the upstream DNSs I specified in the AGH setting?
kmahyyg
on 17 Apr 2020
Why does DNSSEC use my router's DNS instead of using the upstream DNSs I specified in the AGH setting?
We use it just one time - when we resolve dns-family.adguard.com address for the first time.
ameshkov
on 19 Apr 2020
Why does DNSSEC use my router's DNS instead of using the upstream DNSs I specified in the AGH setting?
We use it just one time - when we resolve
dns-family.adguard.comaddress for the first time.
maybe thats the problem... theres a circle
look (example):
routerdns (dnsmasq) 127.0.0.1:53 forwards to AGH on 127.0.0.1:55
AGH ask router onfirst time „hey whats dns-family.adguard...“. router ask back... we‘ve got a circle
possible solution is, if AGH do allways the first request to quad9 or $upstreamresolvers
ibksturm
on 22 Apr 2020
AGH ask router onfirst time „hey whats dns-family.adguard...“
Are you sure? Can you show the packets AGH sends to your router?
AGH uses these 2 IP addresses "176.103.130.130", "176.103.130.131" to resolve dns-family.adguard.com.
szolin
on 23 Apr 2020
@szolin I suppose that the router may be intercepting plain DNS queries.
ameshkov
on 23 Apr 2020
I suppose that the router may be intercepting plain DNS queries.
In this case there's nothing wrong with AGH - it's this particular router's configuration problem.
szolin
on 23 Apr 2020
In this case there's nothing wrong with AGH - it's this particular router's configuration problem.
Sure, but we shouldn't be stuck in the case when we cannot resolve that address, the safe browsing check should simply quickly fail
ameshkov
on 23 Apr 2020
1612
szolin
on 23 Apr 2020
Related issues
xenio
·
4Comments
TXC
·
3Comments
ammnt
·
3Comments
s-timm
·
4Comments
ajongsma
·
3Comments
Most helpful comment
We'll prioritize this issue, guys, thank you!