Digitalcourage as DNS over TLS Addition in Foris

Software SW tweaks
1

Hello,

would it be possible to add the following entry to the “DNS” item in Foris?

Digitalcourage | Server location: Germany
DNS server (supports DNSSEC)
DNS over TLS:
Host: dns2.digitalcourage.de
port: 853

That would be a fine addition!
https://digitalcourage.de/support/zensurfreier-dns-server

Best regards

1 Like
2

In the meantime, I think you can do it yourself: https://doc.turris.cz/doc/en/public/dns_knot_misc

3

Rather refer to this documentation in our Gitlab how to add a new DNS server, which will be available in Foris:

1 Like
4

I’m well aware of that, I would just like to make it available to everyone in a simple way.
I’ve already entered it in the system. I find it just a good and useful addition.
Therefore my wish is more in the direction of the team to offer it simply with.

1 Like
5

Hi, thank you for bringing up this topic. Do you mind to share your config?
My digitalcourage-config does not not work (meaning: I cannot resolve external URLs):

#cat /etc/resolver/dns_servers/01_digitalcourage.conf 
name="01_digitalcourage.conf"
description="digitalcourage"
enable_tls="1"
port="853"
hostname="dns2.digitalcourage.de"
pin_sha256="v7rm6OtQQD3x/wbsdHDZjiDg+utMZvnoX3jq3Vi8tGU="
ipv6="2a02:2970:1002::18"
ipv4="46.182.19.48"

DNS works, when I’m using my providers’ DNS-Server.

6

Neither of the addresses accepts connections from me.

7

Thanks for testing. The IPv4 and the IPv6 addresses are those which are listed here:
Zensurfreier DNS-Server | Digitalcourage (german language only)

Quote (english see below):

Wir betreiben einen freien DNS-Server, weil wir zeigen wollen, dass Zensur umgangen werden kann – und ständig befürchten müssen, dass sie ausgeweitet wird. Der Server hat die IP: 46.182.19.48 bzw. 2a02:2970:1002::18 und unterstützt verschlüsselte Anfragen via DNS-over-TLS.

google translate:

We run a free DNS server because we want to show that censorship can be circumvented - and we have to constantly fear that it will be expanded. The server has the IP: 46.182.19.48 or 2a02: 2970: 1002 :: 18 and supports encrypted requests via DNS-over-TLS.

Maybe they are currently down.

8

Greetings!

This is my configuration, successfully tested at https://dnsleaktest.com:

name=“99_digitalcourage.conf”
description=“Digitalcourage (TLS)”
enable_tls=“1”
tls_port=“853”
ipv4=“46.182.19.48”
ipv6=“2a02:2970:1002::18”
ca_file="/etc/ssl/certs/ca-certificates.crt"
pin_sha256=“v7rm6OtQQD3x/wbsdHDZjiDg+utMZvnoX3jq3Vi8tGU=”
hostname=“dns2.digitalcourage.de”

I also set the attributes exactly the same as the other preconfigured servers, i.e. “0600” flag in the permissions for the file itself. I don’t know if this is important but it worked right away. I also named the file “99_digitalcourage.conf” which is the same scheme.

Hope this helps you,

Best regards

9

Now it answers to me. We hit a bad moment, apparently.

10

good to hear!
“/etc/init.d/resolver restart” is also important

Best Regards

11

Their DNS server does not provide reliable connectivity, particularly via IPv6. Tried them several times but in the end gave up and only left their IPv4 instance in place.