Hacker News new | ask | show | jobs
by okneil 2278 days ago
I wish iOS also supported private DNS natively. Seems like it would be right up Apple's street.
1 comments
tuananh 2278 days ago
what is private DNS?
link
jeroenhd 2278 days ago
Private DNS is what Android calls DNS over TLS. It's basically normal DNS but with a TLS connection wrapped around it.

DoT is very easy to self host if you already run something like a pihole (using nginx to proxy a tcpstream + having it wrap a TLS connection around it) and can be exposed to the internet because it can work over TCP (thus reducing the DDoS risk factor significantly).

In Android there's a setting to enable it in the network settings. The default will be "off", if you pick "on" you'll probably be using Google's DNS servers, if you pick "hostname" you can pick a different server.

link
k__ 2278 days ago
I think it's DNS with in-flight encryption.
link
tuananh 2278 days ago
oh, like dns over tls ?
link
solarkraft 2278 days ago
yes.
link
vezycash 2278 days ago
My explanation was wrong...

Google support page explation for private DNS doesn't explain anything. Just recommends leaving it on.

link
tuananh 2278 days ago
> Private DNS allows you to set the DNS server the phone should use instead of your ISP's.

iOS does support that.

link
jeroenhd 2278 days ago
It's more than that, private DNS is not just a different DNS server, it's a DNS over TLS (DoT) server. This means encrypting the lookups to prevent the ISP from tracking the host names you visit.

Many DNS servers don't support DoT and some support DoH (DNS over HTTPS) instead.

link
clairity 2277 days ago
they recommend leaving it on because then all your dns queries go to google and no one else by default--their "private dns" defaults to the very unprivate google dns servers.
link