Skip to main content

DNS-over-HTTPS and DNS-over-TLS server and forwarder.

Project description

Encrypted-DNS

License Pull requests GitHub stars

Encrypted-DNS operates as a DNS server that forward DNS queries over UDP, TCP, TLS or HTTPS, thus preventing your device from DNS cache poisoning and censorship. It could also cache DNS records to accelerate further queries, block specific client, and ignore particular domain names.

Languages: English, 简体中文.

Usage

$ python3 -m pip install encrypted-dns
  • Generate and edit config file.
$ sudo encrypted-dns
$ vim ~/.config/encrypted_dns/config.json
  • Run Encrypted-DNS Resolver.
$ sudo encrypted-dns
  • Test DNS Query.
Linux or MacOS:
$ dig @127.0.0.1 www.google.com

Windows:
$ nslookup www.google.com 127.0.0.1
  • Change DNS Address to 127.0.0.1.

Configure

Encrypted-DNS will generate a JSON file within its directory.

Upstream DNS

The following JSON object is a typical Upstream DNS server.

Encrypted-DNS supports three protocols: udp, tcp, tls, and https.

You may specify the ip address of DNS-over-HTTPS or DNS-over-TLS server to avoid DNS cache poisoning.

'upstream_dns': [
    {
        'protocol': 'https',
        'address': 'cloudflare-dns.com',
        'ip': '1.0.0.1',
        'port': 443,
        'weight': 0,
        'enable_http_proxy': False,
        'proxy_host': 'localhost',
        'proxy_port': 8001
    },
    {
        'protocol': 'tls',
        'address': 'dns.google',
        'ip': '8.8.4.4',
        'port': 853,
        'weight': 100
    },
    {
        'protocol': 'udp',
        'address': '9.9.9.9',
        'port': 53,
        'weight': 0
    },
    {
        'protocol': 'tcp',
        'address': '8.8.4.4',
        'port': 53,
        'weight': 0
    }
}

If you add multiple upstream servers, each DNS query will be forwarded to a server based on random selection or weighted random selection.

Bootstrap DNS Address

Encrypted-DNS will send a UDP DNS query to the bootstrap DNS server to retrieve the ip address of DNS-over-HTTPS or DNS-over-TLS server unless you specify it.

'bootstrap_dns_address': {
    'address': '1.0.0.1',
    'port': 53
}

Client Blacklist

You may set the ip addresses of the clients which you want to ignore DNS queries sent by them.

'client_blacklist': [
    '1.0.0.1',
    '172.100.100.100'
]

DNS Bypass

You may specify a list of domain names which you don't want to be forward to upstream DNS servers.

Queries will be sent to the bootstrap DNS server.

'dns_bypass': [
    "captive.apple.com",
    "connectivitycheck.gstatic.com",
    "detectportal.firefox.com",
    "msftconnecttest.com",
    "nmcheck.gnome.org",

    "pool.ntp.org",
    "time.apple.com",
    "time.asia.apple.com",
    "time.euro.apple.com",
    "time.nist.gov",
    "time.windows.com"
]

DNS Bypass China

If you set dns_bypass_china to True, all the queries related to domain names in China will be redirected to the bootstrap address, which could be set to a public DNS server located in China.

'dns_bypass_china': True

DNS Cache

If you set enable_cache to True, responses will be cached based on the TTL.

'enable_cache': True

Hosts

Manually set A or CNAME record for specific domain name.

'hosts': {
    'www.instagram.com': '31.13.82.174',
    'www.bbc.co.uk': '212.58.244.69'
}

Force SafeSearch

Enable SafeSearch Mode for Google, Bing, and Youtube to filter harmful content.

'force_safe_search': True

Project details


Release history Release notifications

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for encrypted-dns, version 1.0.0
Filename, size File type Python version Upload date Hashes
Filename, size encrypted_dns-1.0.0-py3-none-any.whl (22.4 kB) File type Wheel Python version py3 Upload date Hashes View hashes
Filename, size encrypted-dns-1.0.0.tar.gz (13.6 kB) File type Source Python version None Upload date Hashes View hashes

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN SignalFx SignalFx Supporter DigiCert DigiCert EV certificate StatusPage StatusPage Status page