search

zoonderkins / blahdns

A small hobby ads block dns project with doh, dot, dnscrypt support.
https://blahdns.com
GNU Affero General Public License v3.0
435 stars 25 forks source link

🐛 DNS64 on a public resolver? #130

Closed ghost closed 3 years ago

ghost commented 3 years ago

Checklist

Describe the issue queries to your public resolver instances:

2a01:4f8:1c1c:6b4b::1@443#dot-de.blahdns.com
159.69.198.101@443#dot-de.blahdns.com
2a01:4f9:c010:43ce::1@443#dot-fi.blahdns.com
95.216.212.177@443#dot-fi.blahdns.com

producing synthesised AAAA records for domains that do not provide AAAA records but A records only, e.g.

githubstatus.com. 562 IN AAAA fe80::21b:aabb:b9c7:6c99 githubstatus.com. 562 IN AAAA fe80::21b:aabb:b9c7:6d99 githubstatus.com. 562 IN AAAA fe80::21b:aabb:b9c7:6e99 githubstatus.com. 562 IN AAAA fe80::21b:aabb:b9c7:6f99 ;rrset 562 1 0 2 2 githubstatus.com. 562 IN SOA ns-1330.awsdns-38.org. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 ;rrset 3262 4 0 5 2 githubstatus.com. 3262 IN A 185.199.108.153 githubstatus.com. 3262 IN A 185.199.109.153 githubstatus.com. 3262 IN A 185.199.110.153 githubstatus.com. 3262 IN A 185.199.111.153 ;rrset 562 1 0 2 2

To Reproduce Steps to reproduce the behavior:

  1. enable local resolver instance to forward queries to the aforementioned BLAHDNS instances

Expected behavior DNS64 does not make sense for public resolver and works only in combination with NAT64, see also https://developers.google.com/speed/public-dns/docs/dns64

The BLAHDNS resolver should not return synthesised AAAA records for domains that do not provide AAAA records.

Client (if applicable):

zoonderkins commented 3 years ago

Give me some time to have a look. Thanks

zoonderkins commented 3 years ago

@n8v8R I think I fix this issue, pls have a try.

ghost commented 3 years ago

seems fixed indeed.

off-topic, if I may ask a question

the website states

Filtered ads, trackers, malwares

but then for DoH there is

uncensor

Does it mean that for DoH there an unfiltered instance but not for DoT? Asking because I deploy RPZ on my local node so the filtering is controlled locally and not upstream.

zoonderkins commented 3 years ago

You are correct. So far, DoT only has censored. Cuz it lacks of sharing the same port.