Closed Saroumane closed 2 months ago
Hi there. Mullvad is doing DNSSEC validation whenever possible. DNSSEC signing is activated for this domain but they have misconfigured it: https://dnsviz.net/d/trestresbon.fr/dnssec/.
One of the main purposes of DNSSEC is to allow for digital signatures to ensure validity and prevent spoofing, so we are simply blocking access to it when DNSSEC validation fails and return SERVFAIL as in your example.
If you run the same dig command with +cd at the end to skip the DNSSEC-check it will return the IP-address.
Thank you for the explanation and the trick with dig
It would be nice if browsers were able to display the real reason when they fail to load.
For example chromium always shows "DNS PROBE FINISHED NXDOMAIN", and I can't tell if it's because :
I guess some people would be interested if Mullvad would offer a new set of DNS without this DNSSEC check (to maximize websites compatibility, despite the spoofing risk)
Meanwhile I understand the only way to deal with this situation is to dig/nslookup every failing domain name and use different DNS when needed. (I could also just browse the IP address, but for trestresbon.fr it does not seem to work, I get a 'website not configured' page)
@vistor-m If I use the 'private DNS' setting offered by Mullvad VPN apps, my dns requests are still routed through the VPN tunnel, and the wifi/GSM/LAN network owner can't see them, right ?
If I use the 'private DNS' setting offered by Mullvad VPN apps, my dns requests are still routed through the VPN tunnel, and the wifi/GSM/LAN network owner can't see them, right ?
That depends. If you configure the apps to use a resolver on the internet (such as 8.8.8.8
), then DNS queries are sent in the tunnel. If the IP address belongs to a server on your LAN (or, in general, is a private IP), then they are not tunneled.
Ok let's say a public DNS. Does the type of DNS request matters ? Do all 3 types (UDP port 53, DNS over TLS, DNS over HTTPS) get routed through the tunnel ? I haven't found explicit confirmation on Mullvad website.
Edit : I tested DoH with Chromium (it's called 'secure DNS' in the privacy settings) and VPN 'On' : https://mullvad.net/en/check sees it as a 'DNS leak', but I'm not sure of the exact nature of the leak. Does the public DNS only sees the domain names requested, and Mullvad VPN server as 'requesting' IP ? Or does it also see my real IP ?
Do all 3 types (UDP port 53, DNS over TLS, DNS over HTTPS) get routed through the tunnel ?
Typically, all three types are routed through the VPN. Moreover, any traffic outside the tunnel is blocked by the firewall, with exceptions for essential protocols, traffic to the VPN server itself, and sometimes LAN and custom DNS.
[...] sees it as a 'DNS leak'
The check reports a leak whenever queries come from a server that isn't one of Mullvad's resolvers. In your case, this is expected.
Does the public DNS only sees the domain names requested, and Mullvad VPN server as 'requesting' IP ?
Correct.
I'm closing this. IMO you should probably contact website providers that have configured their domains wrong. But this is mostly a question not about our app, but about our infrastructure. For non-app related questions please contact support@mullvadvpn.net
Issue report
Ubuntu 23.04 Mullvad App 2023.4
Issue description
It seems that Mullvad DNS can't resolve some domain names that I can resolve with my ISP DNS. Example: trestresbon.fr
with Mullvad VPN ON :
with Mullvad VPN OFF :
More details : https://www.nslookup.io/domains/trestresbon.fr/dns-records/#authoritative It looks like major DNS providers like Cloudflare or Google don't have it in their cache, but the authoritative DNS server is answering.
Let's check nameservers : (Mullvad VPN OFF)
Why Mullvad DNS doesn't provide DNS resolution for this domain name ?