Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to use TCP for DNS, to bypass my ISP's slow and broken DNS servers. I'm not using (and don't want to use) a proxy.

Note: I want to use DNS over TCP because if I use it over udp, no matter what server I set, I get answers from my ISP's DNS.

Notice that I will fiercely downvote whoever suggests:

  • programs to do TCP over DNS,
  • the setting in about:config to make DNS go over the proxy too: I'm not using a proxy,
  • use another DNS: I've already set up Google as my DNS, but I get intercepted.

Example of what I mean by saying intercept:

$ dig @

; <<>> DiG 9.8.1 <<>> @
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24385
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;               IN      A

;; ANSWER SECTION:        28800   IN      A

;; Query time: 50 msec
;; WHEN: Sun Sep 16 22:51:06 2012
;; MSG SIZE  rcvd: 49

$ dig +tcp @

; <<>> DiG 9.8.1 <<>> +tcp @
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15131
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;               IN      A

;; ANSWER SECTION:        436     IN      A

;; Query time: 61 msec
;; WHEN: Sun Sep 16 22:51:10 2012
;; MSG SIZE  rcvd: 49

If it matters, I'm using Firefox 14 on Gentoo Linux.

share|improve this question
Is this from a fixed network? Eg. a home network? If so, have you tried running your own DNS? – Julian Knight Sep 16 '12 at 19:58
Not really an answer for you so I'll leave it as a comment. OpenDNS offer a Windows and Mac client DnsCrypt that should fix this – Julian Knight Sep 16 '12 at 20:01
@JulianKnight yeah, it is. Running my own DNS could be an idea. If you write it as an answer I'll upvote and eventually accept as answer if no better ideas are found – miniBill Sep 16 '12 at 20:13
Firefox may be using the OS'es socket interface for DNS resolution as well, so it may not even control how DNS is done. – Sep 16 '12 at 20:24
@JulianKnight: also, are there specific settings to put in named.conf? Because with the default config it keeps getting intercepted... – miniBill Sep 16 '12 at 20:35
up vote 2 down vote accepted

If you are using glibc you can use the undocumented use-vc option (see resolv/res_init.c in the glib source code) which forces the libc resolver to always use TCP.

Either set it globally in resolv.conf:

options use-vc nameserver

Or pass the option in the environment:

RES_OPTIONS=use-vc firefox

It will not work if the application implemented its own support for DNS without using the libc res_init/res_query/… functions. It's working with Firefox (probably as long as you are not using the "remote DNS" option in the SOCKS proxy settings).

share|improve this answer

Install Unbound, and just change "tcp-upstream: no" to "yes" in the unbound.conf config file.

# upstream connections use TCP only (and no UDP), "yes" or "no"
# useful for tunneling scenarios, default no.
# tcp-upstream: no

And in order to resolver everything through an upstream resolver, add something like:

    name: "."

You can also use dnssec-trigger, a convenient user interface for Unbound, that configures it to tunnel everything through an SSL connection.

share|improve this answer
Thank you. In the end I could get away by using opendns's 5353 port (using forward-addr:, with udp, but your answer was what I was looking for :) – miniBill Sep 25 '12 at 17:56

One way to get round the ISP issue is to run your own, local, DNS server. This isn't especially difficult on Linux.

There is a previous, related question that covers some of the relevant points: What to do when an ISP intercepts NXDOMAIN requests? And another article here.

DNSsec (WikiPedia) should remove this problem in the long term. Also DNSCrypt from OpenDNS fixes the issue but only for Mac and Windows workstations.

There are a number of good articles on setting up your own DNS:

share|improve this answer
But my local DNS server eventually needs to get out there and actually get the resolved name. Now, when that happens my ISP intercepts the request. The delegation-only trick doesn't work for me, or maybe I misconfigured named. – miniBill Sep 16 '12 at 20:50
OpenDNS accepts queries on 5353. – LawrenceC Sep 17 '12 at 11:12
@ultrasawblade now that's interesting. Is there a way to directly use that or do I have to install a local dns server? – miniBill Sep 25 '12 at 17:32
@ultrasawblade actually, using Unbound as Frank suggested, with the custom port, did the trick. Thanks. – miniBill Sep 25 '12 at 17:57

make Firefox use TCP for DNS?

You can't

Firefox doesn't make that decision, it just calls an operating system API like gethostbyname()

The operating system resolver hands that off to a DNS server.

You might think you could set up your own internal DNS server and configure that to only use TCP.

Here's a relevant post from someone who probably knows more about DNS than anyone else.

08-11-2008 03:20 AM

Re: Is it possible to force BIND to use TCP exclusively?

"Joe Baptista" writes:

Are there any configuration changes that can be made to BIND to force it to use TCP exclusively and never use UDP? Possible?


Paul Vixie

Probably anyway

In theory you can find, write or modify a DNS forwarder that does what you want.

In theory you may be able to find or write a Firefox plugin that intercepts and replaces any calls to gethostbyname() with custom DNS client code - I've no idea if the Firefox plugin architecture makes this possible but it might be worth a look.

share|improve this answer

I had the same problem. It turned out to have nothing to do with any setting in Firefox, any setting in the OS, or TCP vs. UDP. The problem is really in the router from your ISP. It's intercepting all "port 53" traffic and rerouting it to your ISP's DNS servers. The rerouting is done by rewriting both sent and received packets (similar to NAT) in such a way that you can't tell what happened (the address of the DNS server in the packets appears to be the one you intended, even though the packet really went to the ISP's own DNS server).

Access your router (often by web browsing to and entering a name and password), find the place where it says DNS server, and change that address from your ISP's DNS server to the one you really want to use (OpenDNS? Google? ...?).

The router config will almost certainly make it appear that address is only used by the router itself. It probably won't say anything about intercepting or about your computer. Don't believe it. DNS interception by routers is intended to keep SOHO users from temporarily bypassing a filtered DNS to look at an illicit site, and as such is a big secret: so minimally documented it usually appears to not even exist.

share|improve this answer
Unfortunately my router is a "Vodafone Station", there is no DNS setting in here... You get an upvote anyway ^^ – miniBill Jan 29 '13 at 19:37
Arrggghhhh. Do I understand correctly your LAN connectivity is via a cellphone tether? If so, I don't know of any answer. So far as I know, use of any alternative DNS over a cell network is an unsolved problem and there aren't even any good hacks. The address of the DNS server is provided to the cellphone as part of the DHCP response from the ISP. Hacking it may be possible with some combination of a "rooted" phone and a "static" IP configuration ...but probably not. I've no experience with TCP DNS on a cell network, so don't know for certain that it wouldn't work...:-( – Chuck Kollars Jan 30 '13 at 2:30
The cellphone tether is there only as a fallback, normal connectivity comes via regular DSL so no, your observation doesn't apply :) – miniBill Feb 2 '13 at 19:22
Oops, I said "router" when for clarity I should have said "modem", because nowadays the two devices are generally combined. For an outboard router backed by a DSL modem, the setting will be in the DSL modem. (Another way to think of this is the setting will be in the part that has to be "approved" by your telephone company:-) – Chuck Kollars Apr 8 '13 at 21:51

Use dnscrypt+unbound. By default dnscrypt sends out dns queries to OpenDNS on 443/udp.

I haven't figured out a way to tunnel this dns service to other machines on my LAN though. No mothod works, not netcat, socat, or udptunnel.

share|improve this answer

Use Google's public DNS servers. They are fast and reliable. Here are directions to use them on a variety of OSs.

share|improve this answer
If I use dns over udp I get intercepted by my ISP. I'll edit the question to reflect that – miniBill Sep 16 '12 at 19:36
OOC, who is your ISP? – Keltari Sep 16 '12 at 19:38
It's Vodafone IT – miniBill Sep 16 '12 at 19:41
hm, not famililar with them. – Keltari Sep 16 '12 at 19:44
Vodafone are a UK mobile phone provider. – Julian Knight Sep 29 '12 at 8:55

Try blocking outgoing UDP DNS requests using iptables:

iptables -A OUTPUT -p udp --dport 53 -j REJECT

The lookup should fail for UDP and then (hopefully) be retried using TCP.

share|improve this answer
If I do that the lookup simply fails, and firefox does not retry with TCP – miniBill Sep 17 '12 at 9:14
Per RFC 1035 DNS queries are normally UDP. Making queries work on TCP requires a resolver set to send queries that way and a DNS server set to receive queries that way. – dafydd Jan 29 '13 at 19:35

Eventually, you can go the way many TPB users go and use TOR or a VPN service.

share|improve this answer
TPB was just a specific example. The question clearly states that I don't want to use a proxy [and TOR and a VPN qualify as proxies for this question]... – miniBill Sep 25 '12 at 17:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .