1

Could anyone explain what kind of information can ISP see about the DNS queries when DNSCrypt proxy is used on my router, configured with some Public DNSCrypt-enabled resolvers (not the ISP's DNS resolvers).

I am aware that DNSCrypt is designed mainly for Client-to-Resolver DNS validation (while DNSSEC is another technology that provides AuthoritativeDNSserver-to-Resolver validation).

However DNSCrypt also provides Encryption of DNS queries. In this case can ISP see the contents of DNS query when DNSCrypt is used? Or does it see only the fact of DNS traffic going from my public IP to the IP of DNSCrypt-enabled Public Resolver, but not what site I query?

Improve this question

2 Answers 2

Reset to default
3

Your ISP can see exactly the same thing as without encrypted DNS. Period.

Improve this answer
3
  • Welcome to Super User! Care to explain your reasoning or add some sources? :)
    – bertieb
    Commented May 1, 2018 at 15:46
  • I invented the DNSCrypt protocol. The intent was to authenticate DNS exchanges, so that they can't be tampered with. DNS encryption, no matter what the protocol is, doesn't prevent your ISP (or even the guy sitting next to you on the same WiFi network) from seeing the IP addresses you are connecting to. It won't hide the host names you are connecting to either. In HTTPS / HTTP2 traffic, the host name (SNI) is not encrypted, so you get a copy of what was in the original DNS query anyway.
    – Frank Denis
    Commented May 1, 2018 at 15:53
  • That's useful information (and from an authoritative source - you!); I was dimly aware that the intention was to authenticate rather than obfuscate but useful to hear it from someone who knows. All of that information would improve your answer- care to edit it in? Comments are temporal and can be deleted at any time. Cheers :)
    – bertieb
    Commented May 1, 2018 at 16:08
1

As stated by the OpenDNS page and the Wikipedia page, your ISP will not be able to see your queries or responses, only encrypted traffic.

Please mind that DNSCrypt doesn't provide end-to-end encryption (from an authoritative DNS server to you), only the encryption between the DNSCrypt server that you choose, and your PC.

References:

  1. https://www.opendns.com/about/innovations/dnscrypt/
  2. https://en.wikipedia.org/wiki/DNSCrypt
Improve this answer
3
  • But ISP still knows the Source and Destination IPs. Can my ISP then see the unencrypted part of DNS communication (iterative queries for example)?
    – drew1kun
    Commented May 1, 2018 at 4:42
  • @drew, I think more importantly, your ISP can see the actual traffic if it's not encrypted. The source and destination IP are an unfortunate caveat to TCP/IP. Start using a VPN service that doesn't keep logs on you if you are concerned about it.
    – Tim_Stewart
    Commented May 1, 2018 at 13:30
  • More than just the IP address of your traffic destinations... even with HTTPS, your ISP can see (as part of the TLS protocol) the hostname (virtual domain) of the destination. So with DNScrypt, your ISP won't see details of your DNS requests, but it will know from your traffic which web sites you visit. If the site uses HTTP, your ISP will see the full URL. If the site uses HTTPS, your ISP will not see the full URL, only the domain.
    – pseudon
    Commented May 1, 2018 at 14:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .