# Implement DNS-over-TLS capability in Pi-hole

**URL:** <https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722>\
**Category:** Feature Requests\
**Tags:** tls\
**Created:** [April 8, 2018, 6:57pm UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722 "2018-04-08T18:57:29Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![anon17255370](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/dfb087/32.png) [@anon17255370](https://discourse.pi-hole.net/u/anon17255370)\
**Post date:** [April 8, 2018, 6:57pm UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722/1 "2018-04-08T18:57:29Z")

</div>

**Requested behaviour**

Although there is an experimental implementation of DNS-over-TLS through the use of Stubby, official support coming to Pi-hole would greatly enhance the privacy aspects of the Pi-hole. DNS-over-TLS is in essence an encrypted tunnel through which the DNS-requests are send. Man-in-the-Middle (MitM) attacks on this traffic would result in captured encrypted data.

DNS-over-TLS (port 853) is not to be confused with DNS-over-HTTPS (port 443) and DNSCrypt (port 53). DNS-over-HTTPS is something that is supported by Google DNS, but just as DNSCrypt (supported by OpenDNS), it ain't a formal standard (RFC). DNS-over-TLS is an official standard and it is supported by Quad9 (9.9.9.9) and Cloudflare DNS (1.1.1.1).

Out-of-the-box support for DNS-over-TLS is therefore my feature request :).

**Actual behaviour:**

All DNS lookups to DNS-servers higher up in the chain are all not encrypted. Hence this invades privacy, because anyone can sniff out to which site you are going. Not the url, but in many cases the domain-name itself surrenders enough data to build a profile.

**More info**

I have read the following guides, but as there is no formal support yet I do not want to adjust my daily-Pi-hole-driver yet.

- [https://blog.sandchaschte.ch/en/pi-hole-with-dns-over-tls](https://blog.sandchaschte.ch/en/pi-hole-with-dns-over-tls)
- [https://www.reddit.com/r/pihole/comments/7oyh9m/guide\_how\_to\_use\_pihole\_with\_stubby/](https://www.reddit.com/r/pihole/comments/7oyh9m/guide_how_to_use_pihole_with_stubby/)

But see also these pages from DNS-resolvers.

- [https://developers.cloudflare.com/1.1.1.1/dns-over-tls/](https://developers.cloudflare.com/1.1.1.1/dns-over-tls/)
- [https://www.quad9.net/faq/#Does\_Quad9\_support\_DNS\_over\_TLS](https://www.quad9.net/faq/#Does_Quad9_support_DNS_over_TLS)

DNS-over-TLS RFC7858

- [https://tools.ietf.org/html/rfc7858](https://tools.ietf.org/html/rfc7858)

---

<div class="post-metadata">

**Author:** ![Tntdruid](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/tntdruid/32/773_2.png) [@Tntdruid](https://discourse.pi-hole.net/u/Tntdruid)\
**Post date:** [April 8, 2018, 8:20pm UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722/2 "2018-04-08T20:20:55Z")

</div>

Did you read this?

> [@PSA: Issue With Pi-hole, DoH, and dnsmasq](https://discourse.pi-hole.net/t/psa-issue-with-pi-hole-doh-and-dnsmasq/8716/2):
>
> Can you clarify if a basic pihole installation (including the current beta for the FTLDNS) implements DnS over HTTPS (DoH)? From what I see, implementing DoH actually required a few other steps from the user (eg installing cloudflared) - thus if we didn't do anything like this, are we affected? If not, should it be OK to conintue using Cloudflare's DNS (1.1.1.1 and 1.0.0.1)?

---

<div class="post-metadata">

**Author:** ![mibere](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mibere/32/18057_2.png) [@mibere](https://discourse.pi-hole.net/u/mibere)\
**Post date:** [April 10, 2018, 2:21pm UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722/3 "2018-04-10T14:21:43Z")

</div>

I prefer DNS-over-HTTPS, or even better DNSCrypt.

---

<div class="post-metadata">

**Author:** ![stryker4526](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/977dab/32.png) [@stryker4526](https://discourse.pi-hole.net/u/stryker4526)\
**Post date:** [April 10, 2018, 2:56pm UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722/4 "2018-04-10T14:56:34Z")

</div>

How is DNSCrypt "even better?" DNS-over-TLS is an actual standard and should be pursued over non-standard solutions such as DoH or DNSCrypt.

---

<div class="post-metadata">

**Author:** ![anon17255370](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/dfb087/32.png) [@anon17255370](https://discourse.pi-hole.net/u/anon17255370)\
**Post date:** [April 10, 2018, 5:29pm UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722/6 "2018-04-10T17:29:18Z")

</div>

DoH and DNSCrypt are no RFC-standards indeed. And DNSCrypt is about encrypted DNS requests over plaintext channels. So from a continuity and compatibility point-of-view, DoT should be the way to go.

But, that is my point-of-view 🙂

---

<div class="post-metadata">

**Author:** ![anon17255370](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/dfb087/32.png) [@anon17255370](https://discourse.pi-hole.net/u/anon17255370)\
**Post date:** [April 10, 2018, 5:30pm UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722/7 "2018-04-10T17:30:06Z")

</div>

Ah, good to hear! And what about updates in regard to Stubby? Do you have automated that or does it require manual work?

---

<div class="post-metadata">

**Author:** ![mibere](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mibere/32/18057_2.png) [@mibere](https://discourse.pi-hole.net/u/mibere)\
**Post date:** [April 10, 2018, 6:58pm UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722/8 "2018-04-10T18:58:28Z")

</div>

Here is a good comparison: [https://dnscrypt.info/faq](https://dnscrypt.info/faq)

---

<div class="post-metadata">

**Author:** ![Comodore125](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/comodore125/32/2800_2.png) [@Comodore125](https://discourse.pi-hole.net/u/Comodore125)\
**Post date:** [April 10, 2018, 8:46pm UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722/9 "2018-04-10T20:46:38Z")

</div>

knot resolver is imho best piece of dns resolver when it comes to dns over tls

---

<div class="post-metadata">

**Author:** ![stryker4526](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/977dab/32.png) [@stryker4526](https://discourse.pi-hole.net/u/stryker4526)\
**Post date:** [April 10, 2018, 11:09pm UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722/10 "2018-04-10T23:09:10Z")

</div>

Got any comparisons that aren't inherently biased?

Of course DNSCrypt's official website is going to say DNSCrypt is the best.

---

<div class="post-metadata">

**Author:** ![Comodore125](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/comodore125/32/2800_2.png) [@Comodore125](https://discourse.pi-hole.net/u/Comodore125)\
**Post date:** [April 11, 2018, 10:39am UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722/11 "2018-04-11T10:39:56Z")

</div>

Lies, dns over tls is **completed in Knot resolver**. as well as related standards. F\*\*\*\* biased comparison

```
DNS-over-TLS (Transport Layer Security) RFC 7858,
Query Minimization RFC 7816,
Aggressive Use of DNSSEC-Validated Cache RFC 8198.

```

---

<div class="post-metadata">

**Author:** ![mibere](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mibere/32/18057_2.png) [@mibere](https://discourse.pi-hole.net/u/mibere)\
**Post date:** [April 11, 2018, 12:56pm UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722/12 "2018-04-11T12:56:24Z")

</div>

Feel free to use whatever you want. You already can use all three, even without official support in Pi-hole. My choice is and will be DNSCrypt.

---

<div class="post-metadata">

**Author:** ![asdasdfag](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/a3d4f5/32.png) [@asdasdfag](https://discourse.pi-hole.net/u/asdasdfag)\
**Post date:** [April 18, 2018, 3:16pm UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722/13 "2018-04-18T15:16:54Z")

</div>

This feature request is specifically for 'Implement DNS-over-TLS' - which is not DNSCrypt. If you want DNSCrypt, please vote for one of the other feature requests for DNSCrypt. My vote is specifically for DNS-over-TLS, which is supported by Google, Quad9, and CloudFlare - who do not support DNSCrypt.

Anyways, there was a request in the Dnsmasq mailing list from Oct. 2017 for them to support DNS over TLS - but there were no responses: [[Dnsmasq-discuss] DNS-over-TLS](http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2017q4/011804.html)

The previous Dnsmasq request for DNS over TLS (Sept 2015) mentioned issues with requests over TCP - which is now supported by Dnsmasq. It would be nice if Dnsmasq could just add support for this, and Pi-Hole's fork could pull it in.

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [April 18, 2018, 3:50pm UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722/14 "2018-04-18T15:50:47Z")

</div>

> [@asdasdfag](#):
>
> It would be nice if Dnsmasq could just add support for this, and Pi-Hole’s fork could pull it in.

You could trigger a discussion there. We will surely take it over into _FTL_DNS once it went into a release of `dnsmasq`!

---

<div class="post-metadata">

**Author:** ![asdasdfag](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/a3d4f5/32.png) [@asdasdfag](https://discourse.pi-hole.net/u/asdasdfag)\
**Post date:** [April 23, 2018, 1:52pm UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722/15 "2018-04-23T13:52:47Z")

</div>

@DL6ER I sent a message¹ asking for an updated opinion on native DNS-over-TLS support. Looks like this feature will not be added to Dnsmasq anytime soon - if ever. Kinda a bummer since I believe there is a good amount of demand for better DNS privacy and having this feature built-in would go a long way in reaching that goal. Oh well, it is nice that the big providers are supporting DNS-over-TLS, but it will be awhile before the general public can benefit from that increase in privacy

[1] [[Dnsmasq-discuss] DNS-over-TLS](http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2018q2/012131.html)

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [April 23, 2018, 7:32pm UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722/16 "2018-04-23T19:32:03Z")

</div>

> [@asdasdfag](#):
>
> Looks like this feature will not be added to Dnsmasq anytime soon - if ever.

Yeah, I was afraid that this might be the answer. I can confirm, being familiar with most it its source code, that it is not possible to use TCP for the upstream connection if the request comes in over UDP. This is by design and it would be really difficult to change it.

> [@asdasdfag](#):
>
> Oh well, it is nice that the big providers are supporting DNS-over-TLS, but it will be awhile before the general public can benefit from that increase in privacy

As always, the question is _whom can you trust?_ Can you trust the big providers? Why can you trust, e.g., Google more than your ISP? Are you sure about it? But this is a discussion for a different thread!

I will mark this feature request as out-of-scope as this is what Simon Kelly said.

---

<div class="post-metadata">

**Author:** ![anon17255370](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/dfb087/32.png) [@anon17255370](https://discourse.pi-hole.net/u/anon17255370)\
**Post date:** [April 24, 2018, 10:26am UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722/17 "2018-04-24T10:26:54Z")

</div>

Thanks all for the responses! I tend to disagree though with out-of-scope, especially due to the fact that Pi-hole is moving away from dnsmasq towards FTLDNS. Why fork if you do not want to add new features/improvements yourself?

Considering the proposition of Pi-hole itself (protecting ones privacy) I feel somehow a small bit mislead if that same Pi-hole now wants to disregard a 10-voted feature with the argument: "whom can you trust?". Considering the fork to FTLDNS I cannot even understand out-of-scope.

Just as with Security, Privacy comes in depth also. So shielding the DNS-requests for mass-surveillance is still a very good practice. And that has nothing to do with someone trusting someone. I am worried about parties that I cannot control nor choose that are intercepting my DNS-traffic.

---

<div class="post-metadata">

**Author:** ![stryker4526](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/977dab/32.png) [@stryker4526](https://discourse.pi-hole.net/u/stryker4526)\
**Post date:** [April 24, 2018, 5:05pm UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722/18 "2018-04-24T17:05:56Z")

</div>

How is this out of scope? You have your own fork, FTLDNS, so how is dnsmasq's reply having anything to do with this request being "out of scope?"

Pi-hole is a DNS forwarder... implementing additional DNS security is not "out of scope" for such a project.

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [April 24, 2018, 5:49pm UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722/19 "2018-04-24T17:49:16Z")

</div>

> [@anon17255370](#):
>
> the fact that Pi-hole is moving away from dnsmasq towards FTLDNS

You have gotten it all wrong. We are not moving away from `dnsmasq`, we are just incorporating it into `FTL` to have a reliable monolith DNS solution that can provide all the known statistics. As a purely volunteer driven project, it was already a major undertaking to get _FTL_DNS set up and running, because it was _much_ more than just copy-pasting `dnsmasq` into place...

We have been very explicit about how we will react to feature requests that target the resolver part:

> Think of _FTL_DNS as `dnsmasq` with Pi-hole’s special sauce. This allows us to easily merge any upstream changes that get added, while still allowing us to continue to develop Pi-hole as we have been.

If we would start to heavily modify the resolver code (and we would have to rewrite a majority of the code that handled forwarding to upstream providers!), then this would probably make us deviate too much from `dnsmasq`'s code base and we couldn't apply version update patches easily.

[https://pi-hole.net/2018/03/24/help-us-beta-test-ftldns/](https://pi-hole.net/2018/03/24/help-us-beta-test-ftldns/)

> [@anon17255370](#):
>
> Why fork if you do not want to add new features/improvements yourself?

I think I already covered this.

> [@anon17255370](#):
>
> I feel somehow a small bit mislead if that same Pi-hole now wants to disregard a 10-voted feature with the argument: “whom can you trust?”

If you have read my post well, then you see that this a wrong oversimplification. I did not say that we will not implement this _because_ of the fact that you cannot trust Google or some other guys. If you are really concerned about privacy, you should not trust anyone of them but set up your own resolving DNS server (I recently wrote a wiki article about this) and equip this one maybe even with `dnscrypt` or something similar. By this, you have to trust nobody and can still resolve DNS.

> [@anon17255370](#):
>
> I am worried about parties that I cannot control nor choose that are intercepting my DNS-traffic.

Well, I see what you're after, but I do not agree in regards to that I don't see why it would be better to have Google record my entire DNS traffic but not the NSA? Is Google really better just because you _know_ that they are doing it and since you explicitly selected them as your big-brother provider?

@stryker4526 Your comments are covered here as well.

---

<div class="post-metadata">

**Author:** ![anon17255370](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/dfb087/32.png) [@anon17255370](https://discourse.pi-hole.net/u/anon17255370)\
**Post date:** [April 24, 2018, 6:10pm UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722/20 "2018-04-24T18:10:03Z")

</div>

@DL6ER Thanks for your extensive answer and the further explanations. Much appreciated! I understand it way better now (with the UDP upstream and all) 🙂 . Although I want DoTLS real bad, there are applications that can implement that, so I have read in this thread.

Anyway, just to be clear, I really like Pi-hole and I am a happy user! Thanks for taking your time in regard to my feature request.

Ps, I am not using Google as my upstream, but Quad9 😉

---

<div class="post-metadata">

**Author:** ![stryker4526](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/977dab/32.png) [@stryker4526](https://discourse.pi-hole.net/u/stryker4526)\
**Post date:** [April 24, 2018, 6:21pm UTC](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722/21 "2018-04-24T18:21:04Z")

</div>

Thanks for the response. Is it safe to say that FTLDNS will remain the only choice of resolver/forwarder for Pi-hole going forward? Is there any consideration toward integrating other DNS resolvers or forwarders in the GUI or script configuration?

[Next page](https://discourse.pi-hole.net/t/implement-dns-over-tls-capability-in-pi-hole/8722.md?page=2)