Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to make encrypted DNS resolutions, so that a packet sniffer in the same network still can't guess what DNS has been requested?

Maybe, just thinking, by tunneling DNS requests through an HTTPS connection?

share|improve this question

closed as not constructive by John Gardeniers, MadHatter, HopelessN00b, Brent Pabst, mdpc Nov 12 '12 at 17:41

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

The real question here is, who is it that you can't trust? – Michael Hampton Nov 11 '12 at 22:52
Other people in the same network. For example, if I'm at Starbucks, I don't trust other people with their packet sniffers running. – Mark Nov 11 '12 at 23:06
You're asking security-oriented questions, but you're not articulating a clear goal. Rather than asking us about each individual (possibly misguided) piece, why not tell us what your end goal is, and ask how to accomplish it? You will probably get a better/more complete/more usable answer. – voretaq7 Nov 11 '12 at 23:58
Maybe you shouldn't be doing whatever you're doing on somebody else's network. If you need to hide your activity then it's extremely unlikely that it's legitimate. Wait till you get home and do it from your own network instead. – John Gardeniers Nov 12 '12 at 5:31
@John Starbucks it's just a metaphor. I thought the question was pretty self-explanatory: is there a way to encrypt DNS queries? I personally don't know how you came to the conclusion that this means doing illegal things. What about developing a service whose authentication key is, for example, into the DNS subdomain. Ideally if the DNS query is encrypted and the whole traffic is under SSL, this would work. The advice to "go home and do it" has really nothing to do with the original question. – Mark Nov 13 '12 at 0:34

Sure. Use a VPN. Preferably one with good hard encryption. I'm thinking IPSEC using AES/SHA.

But then all your traffic gets tunneled. Not sure if that's a good thing or not, for you.

share|improve this answer
You can never have too many tunnels, right ? – Sirex Nov 11 '12 at 23:11
As a londoner, I'm inclined to say no, you can't have too many tunnels. – Tom O'Connor Nov 11 '12 at 23:16

Check out DNSCurve by Daniel J. Bernstein. It's stated main point:

Confidentiality: DNS requests and responses today are completely unencrypted
and are broadcast to any attacker who cares to look. DNSCurve encrypts
all DNS packets.
share|improve this answer
DNSCurve is nice, but requires a server implementation as well and is thus not a practical solution. – praseodym Nov 12 '12 at 1:55

I'd use a VPN to a trusted host/network, or maybe tor.

share|improve this answer
on linux, there's tor-resolve: – goncalopp Nov 11 '12 at 22:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.