Behold - the CIRA Canadian Shield

[RMerlin]

Looks like Canada's central registry is now offering a DNS-based filtering service.

https://www.cira.ca/cybersecurity-services/canadian-shield

I wonder from whom they get their blocking data.

 

[RMerlin]

There's my answer:

Where do you get your threat intelligence?

CIRA works with Akamai, a global provider of internet technology. They are responsible for over 30% of all traffic in the internet and 4% of all global DNS queries (yes that is billions and billions of queries). Anytime a DNS lookup is performed for the very first time anywhere it is automatically quarantined and inspected. If it is determined to be malicious then it is added globally to the block list. Machine learning and AI is also used to detect patterns in seemingly unrelated DNS lookups to detect and block malicious activity. Many botnets use algorithmically generated domain names to function and many have been reverse engineered so that the malicious domains are automatically on the list. And finally, the service incorporates 3rd party feeds from both commercial cybersecurity vendors and the open source community.

Notably, while the threat detection is global, the service is only delivered from servers located in Canada and managed by CIRA.

EDIT:
And color me impressed:

Does CIRA support DNS over TLS (DoT) and DNS over HTTPs (DoH)?


Yes. Both DNS encryption standards are supported.

 

[OzarkEdge]

>>Built by Canadians for Canadians

Finally! That should keep all that Canadian data from clogging up our Internet!

OE

 

[L&LD]

So... anybody tried it yet?

 

[Gar]

So... anybody tried it yet?

Yeah, briefly. It didn't return very good rootcanary.org results, whatever that really means. 9.9.9.11 gives me best results.

 

[dave14305]

9.9.9.11 gives me best results.

Somehow I never knew that Quad9 had a .11 service with EDNS Client Subnet. Thanks!

 

[dosborne]

I set it up a month or more ago. No issues that I am aware of. Didn't notice anything being blocked so far either, not that I've tried any specific tests.

 

[Goobi]

There's my answer:



EDIT:
And color me impressed:

Anyone set this up with DoT or even DoH?

I cannot seem to find any info on their website with instructions on how to set up.

 

[RMerlin]

Anyone set this up with DoT or even DoH?

I cannot seem to find any info on their website with instructions on how to set up.

Set it up where?

The link I posted does contain instructions for multiple platforms.

 

[Goobi]

Set it up where?

The link I posted does contain instructions for multiple platforms.

On a 86u running 394.19. There does not appear to be any instructions on setting up DoT. Just platform specific instructions for setting up their non-encrypted dns.

 

[dave14305]

On a 86u running 394.19. There does not appear to be any instructions on setting up DoT. Just platform specific instructions for setting up their non-encrypted dns.

See the “Summary of CIRA Canadian Shield DNS resolver addresses” table here:

CIRA Canadian Shield set-up guide – CIRA

Our CIRA Canadian Shield setup and configuration guide takes away the stress of setting up the product and gives you improved online security.

www.cira.ca

Use the IP addresses and the DoT name.

 

[Goobi]

See the “Summary of CIRA Canadian Shield DNS resolver addresses” table here:

CIRA Canadian Shield set-up guide – CIRA

Our CIRA Canadian Shield setup and configuration guide takes away the stress of setting up the product and gives you improved online security.

www.cira.ca

Use the IP addresses and the DoT name.

Thank you Sir! Was browsing from my phone and did not realize I could scroll that table to the right for the DoT specific info. Works like a charm.

 

[heysoundude]

Thank you Sir! Was browsing from my phone and did not realize I could scroll that table to the right for the DoT specific info. Works like a charm.

if you like that, you should consider setting up unbound, which makes you your own DNS...assuming you're running Merlin's firmware

 

[coxhaus]

I would rather someone else own the DNS like QUAD9. When problems happen with DNS I don't want to be exposed until someone can write a fix for me which may take weeks. I will never run unbound as I don't want that much responsibility.

 

[heysoundude]

I would rather someone else own the DNS like QUAD9. When problems happen with DNS I don't want to be exposed until someone can write a fix for me which may take weeks. I will never run unbound as I don't want that much responsibility.

if unbound fails, there is a fallback where you can set CIRA, google, quad9, cloudflare...otherwise your network wouldn't resolve anything

 

[New2This]

Free DNS Servers | CIRA

Canadian Shield is a free DNS firewall service provided by CIRA that protects your devices from malware, phishing, and other cyber threats. Learn how Canadian Shield can help keep you safe online and get started today.

www.cira.ca

Wondering if anyone has tired using this dns service, Im currently using the alpha(386.1) firmware and I see there are more options now to pick from (DoT)

Any thoughts??

 

[dosborne]

I've been using the "family" level DNS filtering since it was announced and have not experienced any issues. It has performed as expected.

 

[Samir]

Nice! It's good to see some countries taking cybersecurity seriously.

 

[cptnoblivious]

Good Canadian Kids!

In all seriousness, I may us this for some of my family.

 

[cptnoblivious]

I've been testing the "protected" dns servers for the last day and things are running well.

Part of it was that when I ran the test for SAD DNS and the previous DNS servers I'd configured didn't pass, but these did

Thanks again for the note about these @RMerlin !