Using DOT DNS breaks ECS

[tnpapa]

I noticed that if I use the DOT version of Google DNS servers in the WAN settings, that ECS data is not being passed to Google. If I turn off DOT and just use unencrypted 8.8.8.8 then ECS data is properly sent to Google.

Is this a limitation of DOT in general or the implementation of DOT in Merlin?

 

[dave14305]

In Merlin, using stubby for DoT, the firmware enables EDNS privacy, since it’s all about privacy. edns_client_subnet_private is the option enabled.

 

[tnpapa]

Any way to disable that?

 

[dave14305]

Only using a custom script.

Customize stubby.yml

I understand the privacy implication, but I'd like to send the subnet EDNS in the DoT queries. I'm using Quad9 9.9.9.11 (ECS enabled). It seems that is controlled by this line in /etc/stubby/stubby.yml edns_client_subnet_private: 1 How do I permanently either remove this line, or set it...

www.snbforums.com

 

[tnpapa]

Perfect, I will add this and give it a shot. I find my streaming services are much more reliable when ECS is passed. Yes I know the evils of Google, but at least I can stop my ISP from getting in the middle of DNS requests and injecting their own data.

 

[bbunge]

Perfect, I will add this and give it a shot. I find my streaming services are much more reliable when ECS is passed. Yes I know the evils of Google, but at least I can stop my ISP from getting in the middle of DNS requests and injecting their own data.

Cloudflare Security works very well for me. 1.1.1.2 and 1.0.0.2. It is a manual entry in DoT.

 

[sfx2000]

I noticed that if I use the DOT version of Google DNS servers in the WAN settings, that ECS data is not being passed to Google. If I turn off DOT and just use unencrypted 8.8.8.8 then ECS data is properly sent to Google.

Is this a limitation of DOT in general or the implementation of DOT in Merlin?

One probably doesn't want ECS for privacy and security reasons...

 

[tnpapa]

Script is working. I have ECS now over DOT. Thanks

 

[Justinh]

What is ECS and EDNS?

 

[ColinTaylor]

What is ECS and EDNS?

Try Google search.

Extension Mechanisms for DNS - Wikipedia

en.wikipedia.org

EDNS Client Subnet - Wikipedia

en.wikipedia.org