Alternative DNS Resolver

Whonix ®

Download

Windows Linux Mac VirtualBox KVM Qubes Intel / AMD64 ARM64 PPC64 USB ISO Raspberry Pi More options Source Code

About

Overview Features Whonix vs VPNs Why Open Source? Project Activities Contributors Mission & Vision

Docs

Documentation FAQ Troubleshooting

Community

Forums Forum Best Practices Contribute

Support

Self Support First Policy Search Engines, Docs and AI Support (Limited) Reporting Bugs Contact (Restricted)

Tools Upload file Special pages Recent changes Print Version Page meta What links here Related changes Page information

Page Read Edit History Move Protection Unwatch Watch Delete Purge

User Preferences Watchlist Contributions Logout Create account Login

Donate

VPN-Firewall Advanced Documentation Hide Tor from your Internet Service Provider Previous page: VPN-Firewall Index page: Advanced Documentation Next page: Hide Tor from your Internet Service Provider Alternative DNS Resolver

Authenticated/Encrypted DNS over Tor, DNSSEC over Tor, DNSCrypt by OpenDNS, httpsdnsd by JonDos

Introduction

By Whonix default, Tor is used for DNS resolution. If you suspect a Tor exit relay of tampering with DNS, you can get a second opinion from another non-Tor DNS server. This may also be useful in special cases if you want to resolve DNS record types over Tor that are unsupported by Tor itself, such as MX , SRV, or DNSSEC.

It is recommended against to use non-Tor DNS resolvers for an extended period. Although it is technically possible to completely replace DNS resolution (not using Tor for DNS resolution at all), this is discouraged. Doing so would grant too much power to a single DNS server. Using a permanent DNS server is discouraged for the same reason as using a permanent Tor exit relay is discouraged.

Note that even if you correctly configure everything, it might still fail. Sometimes Tor or the DNS server causes a timeout. This becomes even worse when the DNS request is tunneled through an additional proxy (for example: Tor → JonDonym → DNS server).

Read first: Stream Isolation.

Required knowledge:

• Difference between encryption and authentication.
• All traffic originating from Whonix-Workstation^™ and Whonix-Gateway^™ is routed to the Tor software.

For technical details, click on "Learn More" on the right side.

• Traffic from Whonix-Gateway also routed over Tor: Starting from Whonix version 0.2.1, traffic from Whonix-Gateway is also routed over Tor. This approach conceals the use of Whonix from entities monitoring the network.
• Gateway's own traffic not essential for anonymity: To preserve the anonymity of a user's Whonix-Workstation activities, it is not essential to route Whonix-Gateway's own traffic through Tor. (Note: The gateway is mainly a tool that helps route traffic; it does not typically contain personal activity data.)
• DNS configuration on Whonix-Gateway has limited impact: Altering DNS settings on Whonix-Gateway in /etc/resolv.conf only impacts DNS requests made by Whonix-Gateway's applications that utilize the system's default DNS resolver. (DNS is like the internet's phonebook - it translates website names to IP addresses.) By default, no applications on Whonix-Gateway that generate network traffic use this default resolver. All default applications on Whonix-Gateway that produce network traffic (like apt, systemcheck, sdwdate) are explicitly configured, or forced by uwt wrappers, to use their dedicated Tor SocksPort (refer to Stream Isolation).
• Whonix-Workstation DNS requests handled via Tor: Whonix-Workstation's default applications are configured to use dedicated Tor SocksPorts (see Stream Isolation), avoiding the system's default DNS resolver. Any applications in Whonix-Workstation not set up for stream isolation - such as nslookup - will use the default DNS server configured in Whonix-Workstation (through /etc/network/interfaces), which points to Whonix-Gateway. These DNS requests are then redirected to Tor's DnsPort by the Whonix-Gateway firewall. (This ensures DNS lookups still go through Tor even if they use the default method.) Changes in Whonix-Gateway's /etc/resolv.conf do not influence Whonix-Workstation's DNS queries.
• Tor process traffic allowed direct internet access: Traffic produced by the Tor process, which by Debian's default operates under the account debian-tor and originates from Whonix-Gateway, can access the internet directly. This is permitted because the Linux user account debian-tor is exempted in the Whonix-Gateway Firewall and allowed to use the "regular" internet. (This is necessary for Tor to establish its connections.)
• Tor mostly uses TCP traffic: As of Tor version 0.4.5.6 (with no changes announced at the time of writing), the Tor software predominantly relies on TCP traffic. (TCP is a common protocol used for stable internet connections.) For further details, see Tor wiki page, chapter UDP. For DNS, please refer to the next footnote.
• Tor's DNS independence and exceptions: Tor does not depend on, nor use, a functional (system) DNS for most of its operations. IP addresses of Tor directory authorities are hardcoded in the Tor software by Tor developers. (That means Tor knows important addresses in advance and doesn't need to look them up.) Exceptions include:
  • Proxy with domain name: Proxy settings that use proxies with domain names instead of IP addresses.
  • Pluggable transport domain resolution: Some Tor pluggable transports, such as meek lite, which resolve domains set in url= and front= to IP addresses, or snowflake's -front.

Note that most applications, such as Tor Browser, will not automatically benefit from setting up an alternative DNS resolver.

• This is because applications in Whonix are configured to use SocksPort instead of Trans- or DnsPort. See Stream Isolation for details.
• Another reason is that many applications do not yet support authenticated DNS (DNSSEC).

However, you can use alternative DNS resolvers with these applications when deconfiguring socks proxy settings.

For example, Tor Browser would be unaffected by these changes alone. In theory, a user who wanted to change Tor Browser DNS settings would have to enable transparent proxying in Tor Browser, which is discouraged as it alters the web fingerprint.

Advanced users only!

Recursive Authenticated DNSSEC over Tor

Introduction

DNSSEC-aware, DNSSEC validating, recursive DNS resolution over TCP, over Tor using Unbound. Unencrypted, because Root name servers do not support encryption yet. There is a DNS Security Optimization Problem.

These instructions completely replace Tor's DNS resolver on the whole Whonix-Workstation^™. Not recommended for long-term use, see the warning above.

Installation

Everything inside Whonix-Workstation^™.

1. Create folder /etc/unbound/unbound.conf.d.

mkdir --parents /etc/unbound/unbound.conf.d

2. Unbound configuration.

Open file /etc/unbound/unbound.conf.d/50_user.conf in an editor with root rights.

Select your platform.

Non-Qubes-Whonix

See Open File with Root Rights for detailed instructions on why using sudoedit improves security and how to use it.

Note: Mousepad (or the chosen text editor) must be closed before running the sudoedit command.

sudoedit /etc/unbound/unbound.conf.d/50_user.conf

Qubes-Whonix

Notes:

• When using Qubes-Whonix, this must be done inside the Template.

sudoedit /etc/unbound/unbound.conf.d/50_user.conf

• After applying this change, shut down the Template.
• All App Qubes based on the Template need to be restarted if they were already running.
• This is a general procedure required for Qubes and is unspecific to Qubes-Whonix.

Others and Alternatives

Notes:

• This is just an example. Other tools could achieve the same goal.
• If this example does not work for you, or if you are not using Whonix, please refer to Open File with Root Rights.

sudoedit /etc/unbound/unbound.conf.d/50_user.conf

3. Paste the following lines.

server: hide-identity: yes hide-version: yes interface: 127.0.0.1 do-ip6: no tcp-upstream: yes ## TODO: onion resolution over Tor-only does not work yet. ## Please use search engines, see unbound documentation, ## find out how to fix this and improve this documentation! ## ## Optional: leave resolving onion to Tor. ## Feel free to comment the following 4 lines out, ## but this would break onion resolving since unbound ## cannot resolve '.onion' domains. #forward-zone: # name: "onion" # forward-addr: 10.152.152.10@9050 # forward-no-cache: yes

4. Save.

5. Install dnssec-trigger, which automatically installs and configures the unbound DNS resolver.

Install package(s) dnssec-trigger following these instructions

1 Platform specific notice.

• Non-Qubes-Whonix: No special notice.
• Qubes-Whonix: In Template.

2 Update the package lists and upgrade the system.

sudo apt update && sudo apt full-upgrade

3 Install the dnssec-trigger package(s).

Using apt command line --no-install-recommends option is in most cases optional.

sudo apt install --no-install-recommends dnssec-trigger

4 Platform specific notice.

• Non-Qubes-Whonix: No special notice.
• Qubes-Whonix: Shut down Template and restart App Qubes based on it as per Qubes Template Modification.

5 Done.

The procedure of installing package(s) dnssec-trigger is complete.

6. Done.

7. Testing DNSSEC

DNSCrypt

Introduction

DNSCrypt supports encryption and DNSSEC but DNSCrypt does not validate DNSSEC signatures yet.

These instructions completely replace Tor's DNS resolver with a DNSCrypt-enabled resolver for all users and the whole Whonix-Workstation^™. Not recommended for long-term use, see the warning above.

Installation

Apply all instructions inside your Whonix-Workstation.

1) Install the dnscrypt-proxy package.

Install package(s) dnscrypt-proxy following these instructions

1 Platform specific notice.

• Non-Qubes-Whonix: No special notice.
• Qubes-Whonix: In Template.

2 Update the package lists and upgrade the system.

sudo apt update && sudo apt full-upgrade

3 Install the dnscrypt-proxy package(s).

Using apt command line --no-install-recommends option is in most cases optional.

sudo apt install --no-install-recommends dnscrypt-proxy

4 Platform specific notice.

• Non-Qubes-Whonix: No special notice.
• Qubes-Whonix: Shut down Template and restart App Qubes based on it as per Qubes Template Modification.

5 Done.

The procedure of installing package(s) dnscrypt-proxy is complete.

2) Open file /etc/dnscrypt-proxy/dnscrypt-proxy.toml in an editor with root rights.

Select your platform.

Non-Qubes-Whonix

See Open File with Root Rights for detailed instructions on why using sudoedit improves security and how to use it.

Note: Mousepad (or the chosen text editor) must be closed before running the sudoedit command.

sudoedit /etc/dnscrypt-proxy/dnscrypt-proxy.toml

Qubes-Whonix

Notes:

• When using Qubes-Whonix, this must be done inside the Template.

sudoedit /etc/dnscrypt-proxy/dnscrypt-proxy.toml

• After applying this change, shut down the Template.
• All App Qubes based on the Template need to be restarted if they were already running.
• This is a general procedure required for Qubes and is unspecific to Qubes-Whonix.

Others and Alternatives

Notes:

• This is just an example. Other tools could achieve the same goal.
• If this example does not work for you, or if you are not using Whonix, please refer to Open File with Root Rights.

sudoedit /etc/dnscrypt-proxy/dnscrypt-proxy.toml

Add the following text at the very top of the file. Note: The default server did not work for the author of this page. Therefore, the following instructions advise commenting that server out and adding a random alternative server that worked. This is not an endorsement or rejection of any server. Pick your own server. DNSCrypt publishes a list of servers here.

force_tcp = true #proxy = "socks5://127.0.0.1:9050" server_names = ['arvind-io']

Comment out:

server_names = ['cloudflare']

In other words, rewrite server_names = ['cloudflare'] to #server_names = ['cloudflare'] by adding a hash # in front of it. So it would look like this:

#server_names = ['cloudflare']

Save.

Restart dnscrypt-proxy.service.

sudo systemctl restart dnscrypt-proxy.service

Restart dnscrypt-proxy.socket.

sudo systemctl restart dnscrypt-proxy.socket

3) Open file /etc/resolv.conf in an editor with root rights.

Select your platform.

Non-Qubes-Whonix

See Open File with Root Rights for detailed instructions on why using sudoedit improves security and how to use it.

Note: Mousepad (or the chosen text editor) must be closed before running the sudoedit command.

sudoedit /etc/resolv.conf

Qubes-Whonix

Notes:

• When using Qubes-Whonix, this must be done inside the Template.

sudoedit /etc/resolv.conf

• After applying this change, shut down the Template.
• All App Qubes based on the Template need to be restarted if they were already running.
• This is a general procedure required for Qubes and is unspecific to Qubes-Whonix.

Others and Alternatives

Notes:

• This is just an example. Other tools could achieve the same goal.
• If this example does not work for you, or if you are not using Whonix, please refer to Open File with Root Rights.

sudoedit /etc/resolv.conf

4) Comment out everything and add (It is not 127.0.0.1. It really is 127.0.2.1.):

options use-vc nameserver 127.0.2.1

Save.

DNSCrypt In Use

Stop dnscrypt-proxy systemd socket.

sudo systemctl stop dnscrypt-proxy.socket

Test again. Now it is expected to fail.

Restart dnscrypt-proxy systemd socket.

sudo systemctl restart dnscrypt-proxy.socket

Test again. Now it is expected to work.

FAQ

Why not Use DNSCrypt by Default in Whonix?

DNSCrypt may have good use cases for clearnet activities. However, it is not useful in Whonix and therefore should not be installed or activated by default. Although some users may have high expectations, DNSCrypt does not magically solve all DNS-related security issues, nor does it implement end-to-end DNS encryption to the destination server. Most importantly, the server will still see all DNS requests in cleartext.

There are several other reasons why DNSCrypt is not activated by default. Firstly, Tor distributes trust because the DNS server changes as circuits are rotated. For pre-installed applications, circuits are also stream-isolated and change every ten minutes by default. Notably, in early 2018 there were 78 open resolvers that supported the protocol.

Public resolvers supporting DNSCrypt have not yet acted in a way that caused mistrust. However, even if the operators were absolutely trustworthy, complete confidence is also needed in their servers. It is unwise to let the DNS security for all Whonix users depend on a few servers. Another consideration is load balancing. If Whonix relied upon a DNSCrypt-supporting server by default, DNS would break for all users if that server ever decided to forbid connections from the Tor network or if the servers went down for maintenance.

This would result in a unique web fingerprint, i.e. visited websites could distinguish Whonix users using DNSCrypt from other Tor users relying on Tor for DNS resolution.

Can I Use DNSCrypt on the Host or Router for Clearnet?

This configuration is possible; read the next section before proceeding.

Does DNSCrypt on the Host or Router Harm Anonymity when Using Tor / Whonix?

The short answer is no. The longer answer is that DNSCrypt on the host or in the router only affects clearnet activities. Tor assumes in advance that a user's local network and ISP are completely unsafe and untrustworthy. Tor and Whonix are unaffected by DNS settings made on the host or in the router.

It is debatable whether DNSCrypt is useful or not for clearnet activities, since there are various pros and cons. It is useful when using foreign or untrusted Wi-Fi networks shared with others, since DNS requests could potentially be modified or read. That said, trust is simply shifted from the ISP to a DNSCrypt-supporting DNS server, such as OpenDNS. If the DNS server supporting DNSCrypt leaks a user's network address and/or logs queries as part of their business model, then it might actually be worse than using the ISP. It is hard to argue which party is more trustworthy, the ISP or a third-party provider.

Footnotes

Whonix The most watertight privacy operating system in the world.

Dark mode

Follow us on social media

Supported by Power Up Privacy

Whonix is proudly supported until 2026 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Whonix we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint 2012- 2025 ENCRYPTED SUPPORT LLC

Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!