{"id":429,"date":"2019-09-23T15:05:04","date_gmt":"2019-09-23T13:05:04","guid":{"rendered":"https:\/\/ripe79.ripe.net\/?page_id=429"},"modified":"2019-09-23T15:05:04","modified_gmt":"2019-09-23T13:05:04","slug":"dns-over-tls-resolvers","status":"publish","type":"page","link":"https:\/\/ripe79.ripe.net\/on-site\/tech-info\/dns-over-tls-resolvers\/","title":{"rendered":"DNS-over-TLS Resolvers"},"content":{"rendered":"<p>DNS-over-TLS Resolvers are available at RIPE 79 on a best-effort basis. They are available on TCP port 853, on the same IPv4 \/ IPv6 addresses as the regular DNS resolvers:<\/p>\n<ul>\n<li>2001:67c:64:53::53:1<\/li>\n<li>2001:67c:64:53::53:2<\/li>\n<li>193.0.31.237<\/li>\n<li>193.0.31.238<\/li>\n<\/ul>\n<p>These experimental resolvers are using\u00a0<a href=\"https:\/\/www.knot-resolver.cz\/\" data-wpel-link=\"external\" target=\"_blank\" rel=\"nofollow external noopener noreferrer\" class=\"wpel-icon-right\">Knot-resolver<span class=\"wpel-icon wpel-image wpel-icon-13\"><\/span><\/a> and provide the following security and privacy-related features:<\/p>\n<ul>\n<li>DNS-over-TLS<\/li>\n<li>DNSSEC validation<\/li>\n<li>Aggressive Use of DNSSEC-Validated Cache<\/li>\n<li>Qname Minimisation<\/li>\n<\/ul>\n<p>To use them, you need client software such as Unbound or Stubby, configured to forward upstream queries to these resolvers over TLS. They use a LetsEncrypt certificate, with a TLS hostname of:<\/p>\n<pre>nscache.mtg.ripe.net<\/pre>\n<p>For strict verification, your client should use CA-based verification for this hostname. Do not configure an SPKI pinset, as we may change the certificate at any time.<\/p>\n<p>An example Stubby config:<\/p>\n<pre>upstream_recursive_servers:\r\n  - address_data: 2001:67c:64:53::53:1\r\n    tls_auth_name: \"nscache.mtg.ripe.net\"\r\n  - address_data: 2001:67c:64:53::53:2\r\n    tls_auth_name: \"nscache.mtg.ripe.net\"<\/pre>\n<p>For more information about configuring clients, you can visit:<br \/>\n<a href=\"https:\/\/dnsprivacy.org\/wiki\/display\/DP\/DNS+Privacy+Clients\" data-wpel-link=\"external\" target=\"_blank\" rel=\"nofollow external noopener noreferrer\" class=\"wpel-icon-right\">https:\/\/dnsprivacy.org\/wiki\/display\/DP\/DNS+Privacy+Clients<span class=\"wpel-icon wpel-image wpel-icon-13\"><\/span><\/a><\/p>\n<p>Presentation from Colin Petrie at RIPE 76:<br \/>\n<a href=\"https:\/\/ripe76.ripe.net\/presentations\/96-dns-over-tls-resolvers.pdf\" data-wpel-link=\"external\" target=\"_blank\" rel=\"nofollow external noopener noreferrer\" class=\"wpel-icon-right\">Deploying DNS over TLS for the RIPE Meeting<span class=\"wpel-icon wpel-image wpel-icon-13\"><\/span><\/a><\/p>\n<h3>Troubleshooting<\/h3>\n<p>The RIPE NCC staff can only offer limited support for investigating problems with these resolvers.<\/p>\n<p>If your issue is related to client configuration, please see the available documentation linked above, or for further support, contact the <a href=\"https:\/\/www.ripe.net\/participate\/ripe\/wg\/dns\" class=\"broken_link wpel-icon-right\" data-wpel-link=\"external\" target=\"_blank\" rel=\"nofollow external noopener noreferrer\">DNS Working Group<span class=\"wpel-icon wpel-image wpel-icon-13\"><\/span><\/a>.<\/p>\n<p>There may be issues resolving certain domain names due to interactions with Qname Minimisation (which is an experimental protocol).<\/p>\n<p>If these issues cause you a problem, please fall back to using the regular resolvers and send a report of the problem to\u00a0<a class=\"external-link\" href=\"javascript:DeCryptX(&#039;2q3s3v1n3w0g0@1s1j1q3h203q1f2v&#039;)\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" data-wpel-link=\"internal\">opsmtg [at] ripe [dot] net<\/a>. If the problem is with the resolver software we are using, it is unlikely we\u00a0will be able to fix it during the meeting. You can also discuss any issues encountered on the <a href=\"https:\/\/www.ripe.net\/mailman\/listinfo\/dns-wg\/\" data-wpel-link=\"external\" target=\"_blank\" rel=\"nofollow external noopener noreferrer\" class=\"wpel-icon-right\">DNS Working Group Mailing List<span class=\"wpel-icon wpel-image wpel-icon-13\"><\/span><\/a>.<\/p>\n<h3>Background<\/h3>\n<p>This service has been set up for RIPE 79 as an experimental service at the request of the DNS Working Group Co-Chairs.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>DNS-over-TLS Resolvers are available at RIPE 79 on a best-effort basis. They are available on TCP port 853, on the same IPv4 \/ IPv6 addresses as the regular DNS resolvers: 2001:67c:64:53::53:1 2001:67c:64:53::53:2 193.0.31.237 193.0.31.238 These experimental resolvers are using\u00a0Knot-resolver and provide the following security and privacy-related features: DNS-over-TLS DNSSEC validation &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":427,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_links_to":"","_links_to_target":""},"_links":{"self":[{"href":"https:\/\/ripe79.ripe.net\/wp-json\/wp\/v2\/pages\/429"}],"collection":[{"href":"https:\/\/ripe79.ripe.net\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/ripe79.ripe.net\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/ripe79.ripe.net\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ripe79.ripe.net\/wp-json\/wp\/v2\/comments?post=429"}],"version-history":[{"count":2,"href":"https:\/\/ripe79.ripe.net\/wp-json\/wp\/v2\/pages\/429\/revisions"}],"predecessor-version":[{"id":437,"href":"https:\/\/ripe79.ripe.net\/wp-json\/wp\/v2\/pages\/429\/revisions\/437"}],"up":[{"embeddable":true,"href":"https:\/\/ripe79.ripe.net\/wp-json\/wp\/v2\/pages\/427"}],"wp:attachment":[{"href":"https:\/\/ripe79.ripe.net\/wp-json\/wp\/v2\/media?parent=429"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}