Add DNSSEC support #66

KrasnayaPloshchad · 2016-10-18T09:18:33Z

I think adding full DNSSEC validation will making all queries more reliable unless clients explicitly opt out.

ameshkov · 2016-10-18T22:26:43Z

It makes sense, thank you for the feature request!

Itsnothectic · 2017-04-10T14:58:01Z

I came here to make this same request.

To test if DNSSEC is enabled opening sigfail.verteiltesysteme.net you should get an error. If you test sigok.verteilesysteme.net you should see a blank page.

sergeevabc · 2017-06-27T01:36:57Z

Unfortunately, another DNSSEC resolver test fails so far.

ameshkov · 2017-09-10T21:02:14Z

Not yet, guys. I am sorry for the delays, we're a bit limited in resources, and I'd like not to switch to DNS tasks until we can really focus on them.

TPS · 2017-09-10T21:18:40Z

No worries! Just figuring, since DNSCrypt got done, perhaps this got some love as well. Keep on 🚚ing! 📣

evilvibes · 2018-01-01T11:05:55Z

Any update on this?

ameshkov · 2018-01-03T11:58:37Z

@evilvibes we don't want to touch the current installation until the updated version is ready. That's why this issue is still open.

TPS · 2018-01-03T14:43:31Z

So, does that mean there's ß version someplace? Will it be accessible to ~~play with~~ test sometime?

ameshkov · 2018-01-04T15:45:10Z

So, does that mean there's ß version someplace? Will it be accessible to play with test sometime?

I'd say it's more of a "demo" at the moment. The old code was tossed out, and the new version is basically a patched Unbound DNS server. Not yet available publicly.

Corsten56 · 2018-02-23T12:05:27Z

Yes. Will wait for DNSSEC support. Most important thing in modern Russia.

ibksturm · 2018-03-20T10:50:48Z

Hi there, any news about dnssec?

and do you think hheres a opinion do start a server in central europe example frankfurt or zurich?

greets

jonathanmmm · 2018-03-22T09:36:48Z

Central Europe Server would be great, yes 👍

ibksturm · 2018-04-15T21:25:18Z

jupp, would be great, so my route don't have to go over the half of the world as i wrote months ago ^^

Ryan-Goldstein · 2018-09-21T14:48:33Z

Any updates on this issue? DNSSEC is very important and has been receiving increased attention lately, including as a part of Cloudflare's Crypto Week 2018 (https://blog.cloudflare.com/automatically-provision-and-maintain-dnssec/).

* commit 'e689c7d940e9a20bc13f024e18b86f3c1e5ba759': Do not lose filter name when saving to yaml coredns querylog -- since we read entire querylog json once at startup, fill querylog cache from it and then rotate it on each incoming DNS query Cache DNS lookups when resolving safebrowsing or parental servers, also cache replacement hostnames as well.

Who-42 · 2018-10-18T07:13:19Z

I was planning to open also a DNSSEC Request but since there is already one, one more who wishes this option

ameshkov · 2018-10-18T08:17:54Z

We'll prioritize this issue, guys, thank you!

ibksturm · 2018-12-07T20:25:51Z

news? i looks as the way i'm running AGH dnssec looks like running

Mikiya83 · 2019-01-14T20:37:44Z

Do you have any news ? it's a big feature now for a DNS server. Thanks !

ameshkov · 2019-01-15T01:36:01Z

No news on this yet, sorry

Revertron · 2020-03-10T16:01:55Z

Just to keep in mind: it should be possible to mark some domains and zones as "unsecure", not to try verification at all.

ibksturm · 2020-03-18T16:45:22Z

ьолшо сьасибо 👍

kmahyyg · 2020-04-11T02:40:51Z

Recently, I enabled the dnsmasq's DNSSEC on my openwrt router and it works as a dns proxy just working the same as the normal router, AGH on my laptop. I set to use AGH as local dns and CF (DoT) as upstream. However, when dnsmasq's DNSSEC enabled, the AGH failed to dispatch any valid DNS response. According to the verbose log of AGH, it seems that AGH just got connection error from upstream and then returned error(But I'm not so sure about that, my internet connectivity is working properly). I tried to switch off the dnsmasq's DNSSEC, AGH works properly.

Any suggestion?

ameshkov · 2020-04-13T13:16:25Z

@kmahyyg have you tried checking what exactly dnsmasq returns for these queries?

kmahyyg · 2020-04-13T13:31:50Z

Yes, I tried. works perfectly. Send from Evangeline's Android

…

________________________________ From: Andrey Meshkov <[email protected]> Sent: Monday, April 13, 2020 9:16:41 PM To: AdguardTeam/AdGuardHome <[email protected]> Cc: Patrick Young <[email protected]>; Mention <[email protected]> Subject: Re: [AdguardTeam/AdGuardHome] Add DNSSEC support (#66) @kmahyyg<https://github.com/kmahyyg> have you tried checking what exactly dnsmasq returns for these queries? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#66 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AD6V3Y43LGAXCKHXZFSUD3LRMMGDTANCNFSM4CTGHHYA>.

ameshkov · 2020-04-13T14:13:34Z

Weird, what kind of connection error does AGH receives?

kmahyyg · 2020-04-13T16:23:45Z

Weird, what kind of connection error does AGH receives?

I don't know. I turned on verbose , all logging seems perfect, just get response from upstream as NORESPONSE FROM UPSTREAM. Then dns request timed out. but those domains really exists. I tried to use kdig and set the upstream correctly, the domain is exists.

After I turned off DNSSEC on my router, all things get working. BTW, I'm in china mainland, which has serious network censorship.

ameshkov · 2020-04-13T17:07:45Z

Could you please post a part of the log with these requests and responses? Maybe I'll notice something there

kmahyyg · 2020-04-16T02:47:41Z

Could you please post a part of the log with these requests and responses? Maybe I'll notice something there

logfile-20200416-2.log

Here's the full log after I enabled DNSSEC on my router. Since I've configured the upstream as log shown, it shouldn't be failed to response.

#1579 might be related to this issue.

At the same time when AGH failed,

szolin · 2020-04-17T13:31:02Z

@kmahyyg Can you disable SafeBrowsing ?
In your logs I only see SafeBrowsing: checking... but no sign of the results of SB check. That's very strange considering 3sec timeout for those operations.
Looks like a global dead lock to me: no goroutine has woken up from SB check.

kmahyyg · 2020-04-17T14:10:09Z

@kmahyyg Can you disable SafeBrowsing ?
In your logs I only see SafeBrowsing: checking... but no sign of the results of SB check. That's very strange considering 3sec timeout for those operations.
Looks like a global dead lock to me: no goroutine has woken up from SB check.

I will try later... But I think dnssec shouldn't have affiliate with SB?

ameshkov · 2020-04-17T14:28:49Z

@szolin

Here's why it happens:

2020/04/16 10:40:18 17356#55 [debug] github.com/AdguardTeam/dnsproxy/upstream.lookup(): successfully finished lookup for dns-family.adguard.com in 59 milliseconds using 176.103.130.131. Result : []
2020/04/16 10:40:18 17356#54 [debug] github.com/AdguardTeam/dnsproxy/upstream.lookup(): successfully finished lookup for dns-family.adguard.com in 78 milliseconds using 176.103.130.130. Result : []

@kmahyyg
Could it be that your router intercepts plain DNS queries and does some additional filtering? Because it seems that when DNSSEC is enabled, we cannot resolve dns-family.adguard.com address (empty "Result: []" in the log)

kmahyyg · 2020-04-17T15:18:58Z

@szolin

Here's why it happens:
2020/04/16 10:40:18 17356#55 [debug] github.com/AdguardTeam/dnsproxy/upstream.lookup(): successfully finished lookup for dns-family.adguard.com in 59 milliseconds using 176.103.130.131. Result : []
2020/04/16 10:40:18 17356#54 [debug] github.com/AdguardTeam/dnsproxy/upstream.lookup(): successfully finished lookup for dns-family.adguard.com in 78 milliseconds using 176.103.130.130. Result : []
@kmahyyg
Could it be that your router intercepts plain DNS queries and does some additional filtering? Because it seems that when DNSSEC is enabled, we cannot resolve dns-family.adguard.com address (empty "Result: []" in the log)

pretty weird......

kmahyyg · 2020-04-17T15:21:50Z

Okay, I see the problem. The last photo is DNSSEC disabled.

This is enabled. Problem is SERVFAIL. But even so, this should not happen. Why does DNSSEC use my router's DNS instead of using the upstream DNSs I specified in the AGH setting?

ameshkov · 2020-04-19T17:47:18Z

Why does DNSSEC use my router's DNS instead of using the upstream DNSs I specified in the AGH setting?

We use it just one time - when we resolve dns-family.adguard.com address for the first time.

ibksturm · 2020-04-22T21:03:37Z

Why does DNSSEC use my router's DNS instead of using the upstream DNSs I specified in the AGH setting?

We use it just one time - when we resolve dns-family.adguard.com address for the first time.

maybe thats the problem... theres a circle

look (example):

routerdns (dnsmasq) 127.0.0.1:53 forwards to AGH on 127.0.0.1:55

AGH ask router onfirst time „hey whats dns-family.adguard...“. router ask back... we‘ve got a circle

possible solution is, if AGH do allways the first request to quad9 or $upstreamresolvers

szolin · 2020-04-23T07:21:06Z

AGH ask router onfirst time „hey whats dns-family.adguard...“

Are you sure? Can you show the packets AGH sends to your router?
AGH uses these 2 IP addresses "176.103.130.130", "176.103.130.131" to resolve dns-family.adguard.com.

ameshkov · 2020-04-23T08:16:15Z

@szolin I suppose that the router may be intercepting plain DNS queries.

szolin · 2020-04-23T08:36:38Z

I suppose that the router may be intercepting plain DNS queries.

In this case there's nothing wrong with AGH - it's this particular router's configuration problem.

ameshkov · 2020-04-23T08:38:06Z

In this case there's nothing wrong with AGH - it's this particular router's configuration problem.

Sure, but we shouldn't be stuck in the case when we cannot resolve that address, the safe browsing check should simply quickly fail

szolin · 2020-04-23T08:48:46Z

#1612

ameshkov added the enhancement label Oct 18, 2016

ameshkov added this to the v0.91 milestone Oct 18, 2018

ameshkov added the P2: High label Oct 18, 2018

ameshkov modified the milestones: v0.91, v0.92 Nov 26, 2018

ameshkov removed this from the v0.92 milestone Jan 2, 2019

ameshkov assigned szolin Jun 10, 2019

ameshkov added this to the v0.97 milestone Jun 10, 2019

ameshkov modified the milestones: v0.97, v0.98 Jun 25, 2019

szolin assigned IldarKamalov Feb 17, 2020

ameshkov mentioned this issue Mar 17, 2020

DNSSEC support？ #1485

Closed

adguard closed this as completed in 72c20ac Mar 18, 2020

Eyeborgs mentioned this issue Apr 13, 2020

Option to enforce DNSSEC #1576

Closed

ameshkov mentioned this issue Apr 13, 2020

Full DNSSEC support #1579

Open

szolin reopened this Apr 17, 2020

szolin mentioned this issue Apr 23, 2020

SB check is hanging #1612

Closed

szolin closed this as completed Apr 23, 2020

SukkaW mentioned this issue Nov 29, 2021

[Feature Request] Even Richer Statistics #3900

Closed

3 tasks

Add DNSSEC support #66

Add DNSSEC support #66

Comments

KrasnayaPloshchad commented Oct 18, 2016

ameshkov commented Oct 18, 2016

Itsnothectic commented Apr 10, 2017

sergeevabc commented Jun 27, 2017

ameshkov commented Sep 10, 2017

TPS commented Sep 10, 2017

evilvibes commented Jan 1, 2018

ameshkov commented Jan 3, 2018

TPS commented Jan 3, 2018

ameshkov commented Jan 4, 2018

Corsten56 commented Feb 23, 2018

ibksturm commented Mar 20, 2018

jonathanmmm commented Mar 22, 2018

ibksturm commented Apr 15, 2018

Ryan-Goldstein commented Sep 21, 2018

Who-42 commented Oct 18, 2018

ameshkov commented Oct 18, 2018

ibksturm commented Dec 7, 2018

Mikiya83 commented Jan 14, 2019

ameshkov commented Jan 15, 2019 • edited Loading

Revertron commented Mar 10, 2020

ibksturm commented Mar 18, 2020

kmahyyg commented Apr 11, 2020 • edited Loading

ameshkov commented Apr 13, 2020

kmahyyg commented Apr 13, 2020 via email

ameshkov commented Apr 13, 2020

kmahyyg commented Apr 13, 2020 • edited Loading

ameshkov commented Apr 13, 2020 • edited Loading

kmahyyg commented Apr 16, 2020 • edited Loading

szolin commented Apr 17, 2020

kmahyyg commented Apr 17, 2020

ameshkov commented Apr 17, 2020

kmahyyg commented Apr 17, 2020

kmahyyg commented Apr 17, 2020

ameshkov commented Apr 19, 2020

ibksturm commented Apr 22, 2020

szolin commented Apr 23, 2020

ameshkov commented Apr 23, 2020

szolin commented Apr 23, 2020

ameshkov commented Apr 23, 2020

szolin commented Apr 23, 2020

ameshkov commented Jan 15, 2019 •

edited

Loading

kmahyyg commented Apr 11, 2020 •

edited

Loading

kmahyyg commented Apr 13, 2020 •

edited

Loading

ameshkov commented Apr 13, 2020 •

edited

Loading

kmahyyg commented Apr 16, 2020 •

edited

Loading