Feature request - DNSCrypt support...

cREoz · Sun Jul 08, 2018 8:37 pm

+1 for DNSCrypt support

mlenhart · Sun Jul 08, 2018 10:36 pm

+1 for DNSSec/DNSCrypt

cavok · Mon Jul 09, 2018 2:00 am

I'm using dnscrypt via a raspberry in combination with pi-hole and OpenDNS. Works perfectly for alle my internal clients and I dont have to use a dnscrypt proxy on every mashine. If anyone is interested in configuring it (especially as their are some compatibility tricks you have to be aware of) I can provide you a the required steps to make it work

Would love to get this info, please.

vladvalmont · Tue Jul 10, 2018 6:23 pm

+1 for DNSCrypt support

foxxiu7 · Wed Jul 11, 2018 2:35 am

I'm using dnscrypt via a raspberry in combination with pi-hole and OpenDNS. Works perfectly for alle my internal clients and I dont have to use a dnscrypt proxy on every mashine. If anyone is interested in configuring it (especially as their are some compatibility tricks you have to be aware of) I can provide you a the required steps to make it work
Would love to get this info, please.

I'm also interested how to add DNSCrypt support on the RPi as currently I'm using two MikroTiks and RaspberryPi with pi-hole and OpenDNS.

Anastasia · Sat Sep 15, 2018 8:41 pm

+1 for DNSCrypt support

MikroRouter · Thu Oct 04, 2018 11:40 am

Hope this can be implemented soon...

thief · Mon Oct 08, 2018 7:47 am

+1 for DNSSec/DNSCrypt

Kamaz · Tue Oct 09, 2018 8:39 pm

+1 for DNSSec/DNSCrypt

Azure · Wed Oct 10, 2018 2:31 pm

Doesn't this supersede DNScrypt, plus, is now an accepted standard? https://tools.ietf.org/html/rfc7858

But it is still a very fresh RFC

Yes! This!
DNScrypt is great and all... But I'd like to see DNS-TLS as Quad9 supports it.
In the end, either is better than neither!

https://www.quad9.net/faq/#Does_Quad9_s ... S_over_TLS

skiif · Thu Oct 25, 2018 9:23 am

+1 for DNS-over-TLS as it's an IETF approved standard, but of course DNScrypt and DNS-HTTPs also will be very appreciated.

Chupaka · Thu Oct 25, 2018 11:55 am

DNS over TLS is now supported both by CloudFlare (1.1.1.1) and Google (8.8.8.8), so looks like it's time =)

Joni · Thu Oct 25, 2018 12:54 pm

DoH is incompatible with the basic architecture of the DNS because it moves control plane (signalling) messages to the data plane (message forwarding), and that's a no-no.

https://www.theregister.co.uk/2018/10/2 ... _standard/

nimbo78 · Sun Oct 28, 2018 2:00 pm

DNS over TLS is now supported both by CloudFlare (1.1.1.1) and Google (8.8.8.8), so looks like it's time =)

+1

estas · Wed Nov 28, 2018 4:21 pm

+1 for DNS-over-TLS and DNSCrypt!
and also waiting UDP Proxy...

xkubus · Mon Jan 07, 2019 10:38 am

+1 Please!

EvgeniyV · Tue Jan 08, 2019 1:19 am

+1
interesting, how many people still have to write "+1" that this gave the result?

Kamaz · Mon Jan 14, 2019 11:30 am

Google provides DNS-over-TLS https://developers.google.com/speed/pub ... s-over-tls from January 2019,
also it provides DNS-over-HTTPS https://developers.google.com/speed/pub ... over-https from September 2018.

cgood · Mon Jan 14, 2019 12:04 pm

+1
interesting, how many people still have to write "+1" that this gave the result?

Topic started at 30 Jan 2012 09:55 ... we wait for a miracle

vecernik87 · Mon Jan 14, 2019 1:59 pm

Topic started at 30 Jan 2012 09:55 ... we wait for a miracle

No. It just proves how futile is the idea of implementing nonstandard or nonstable technologies - they are gone withing few years. Where is DNScrypt today? Is it massively accepted? No. If mikrotik implemented it back then, it would be enormous waste of time.
Wait for standardized solution which is widely accepted. Then ask for support and you got at least a chance...

cgood · Mon Jan 14, 2019 9:39 pm

Topic started at 30 Jan 2012 09:55 ... we wait for a miracle
No. It just proves how futile is the idea of implementing nonstandard or nonstable technologies - they are gone withing few years. Where is DNScrypt today? Is it massively accepted? No. If mikrotik implemented it back then, it would be enormous waste of time.
Wait for standardized solution which is widely accepted. Then ask for support and you got at least a chance...

ovpn UDP support may be too "enormous waste of time"?

poizzon · Thu Jan 17, 2019 2:36 am

Chupaka · Thu Jan 17, 2019 8:28 am

+10

+10 to "enormous waste of time"?

Thu Jan 17, 2019 8:45 am

Instead of wordless pluses, how about a discussion on TLS vs HTTPS.
TLS gives you a specific port and capability to filter and NAT etc. HTTPS gives you more security, but also the inability to catch this traffic as an administrator. More aspects?

Chupaka · Thu Jan 17, 2019 1:43 pm

HTTPS gives you more security

Huh?..

inability to catch this traffic as an administrator

Well, as it was earlier - by IP address

But generally yes - it's harder for your ISP to block/redirect DoH than DoT as it uses shared port number (443).

Thu Jan 17, 2019 2:24 pm

Huh? Since DNS over HTTPS uses port 443 and there is no visual difference in traffic type, admin can't intercept or block this traffic (except by destination address).

cgood · Thu Jan 17, 2019 3:20 pm

Huh? Since DNS over HTTPS uses port 443 and there is no visual difference in traffic type, admin can't intercept or block this traffic (except by destination address).

When will the DoH appear

? Когда же?

Chupaka · Thu Jan 17, 2019 3:21 pm

What about SNI?

ESNI is not on stage currently

cgood · Thu Jan 17, 2019 3:26 pm

At home i'm mangling DNS fwd+out connections and redirect to EU OVPN (CHR VPS), but DoH = peer-to-peer encryption & we all need it (=

Thu Jan 17, 2019 3:29 pm

? https://blog.cloudflare.com/esni/

ErfanDL · Thu Jan 17, 2019 4:36 pm

add DNSSEC features

Sent from my C6833 using Tapatalk

Thu Jan 17, 2019 4:43 pm

add DNSSEC features

Sent from my C6833 using Tapatalk

What does it mean?

ErfanDL · Thu Jan 17, 2019 6:35 pm

add DNSSEC features

Sent from my C6833 using Tapatalk
What does it mean?

https://en.m.wikipedia.org/wiki/Domain_ ... Extensions

Sent from my C6833 using Tapatalk

anthonws · Mon Jan 21, 2019 10:15 pm

Instead of wordless pluses, how about a discussion on TLS vs HTTPS.
TLS gives you a specific port and capability to filter and NAT etc. HTTPS gives you more security, but also the inability to catch this traffic as an administrator. More aspects?

Both would be the ideal scenario

Naturally that I understand that there's budget/resources constrains and prioritization of features, and therefore that is not viable.

Using Mikrotik mainly as Home gear, my natural choice would be to go with DoH. But, since your main target is Enterprise then it makes sense to invest on the DoT first. I'm sure that the Home users/clients like me will be able to still use DoT.

Ultimately, one or the other will provide the additional security (with more or less controls) that the majority of your customers are looking for

What about SNI? ESNI is not on stage currently

Isn't that at the Browser level only?

anav · Tue Jan 22, 2019 4:31 pm

At a minimum, from a practical point of view, wouldn't it matter more that juniper, cisco, fortigate, zyxel etc......... started implementing such technologies.
Further if mikrotik saw a decrease in sales and an erosion in the current base to such vendors due to technology available elsewhere, then they would be forced to move.
However, that would be too late so it is a matter of timing besides the other usual suspects, money, human resources, code stability, hardware limitations.......

.

R1CH · Wed Feb 13, 2019 12:41 pm

Instead of wordless pluses, how about a discussion on TLS vs HTTPS.
TLS gives you a specific port and capability to filter and NAT etc. HTTPS gives you more security, but also the inability to catch this traffic as an administrator. More aspects?

Why not both? Although DNS over HTTPS seems to be the way forward, very few providers are actually deploying DNS over TLS. As long as you maintain a persistent connection to the resolver, latency should be minimal.

eworm · Wed Feb 13, 2019 11:30 pm

At FOSDEM 2019 Daniel Stenberg (the maintainer of curl) had a talk about DNS over HTTPS - the good, the bad and the ugly. Very interesting topic and he scheds some light on DoT, DNScrypt, DNSsec & Co as well.

IMHO DoH is the way to go.

pothi · Sun Mar 03, 2019 9:57 am

As an administrator, I'd like to have some (or full) control over the traffic, thus favoring DNS over TLS.

As a user, I don't want any control over my internet connection, thus supporting DNS over HTTPS.

Both are better than plain text DNS query.

kenyloveg · Thu Mar 14, 2019 3:50 pm

Can we just holding back these advanced fancy DNS standards, but support setting up non-standard tcp/udp port in /ip dns?
Just a little update in 6.45, or maybe 6.46...
DNS pollution(intercept plain text like google from udp 53 port then return 127.0.0.1) is very easy way for a ISP to do if mikrotik device (and most common soho devices) only support udp 53.
BTW, I'm using below rules to redirect dns port.

add action=dst-nat chain=dstnat dst-address=208.67.220.220 dst-port=53 protocol=udp to-addresses=208.67.220.220 to-ports=5353
add action=dst-nat chain=dstnat dst-address=208.67.222.222 dst-port=53 protocol=udp to-addresses=208.67.222.222 to-ports=5353

mutinsa · Sun Apr 07, 2019 10:37 pm

anav · Mon Apr 08, 2019 12:14 am

Can we just holding back these advanced fancy DNS standards, but support setting up non-standard tcp/udp port in /ip dns?
Just a little update in 6.45, or maybe 6.46...
DNS pollution(intercept plain text like google from udp 53 port then return 127.0.0.1) is very easy way for a ISP to do if mikrotik device (and most common soho devices) only support udp 53.
BTW, I'm using below rules to redirect dns port.
Code: Select all
add action=dst-nat chain=dstnat dst-address=208.67.220.220 dst-port=53 protocol=udp to-addresses=208.67.220.220 to-ports=5353
add action=dst-nat chain=dstnat dst-address=208.67.222.222 dst-port=53 protocol=udp to-addresses=208.67.222.222 to-ports=5353

Why limit the destination address to one pubic DNS server. Why not just dstport 53 protocol udp/tcp redirect to port 5353 (sounds like dnssec for pihole).
In your rule, somebody hardcoding 8.8.8.8 or 1.1.1.1 would not get trapped.

anthonws · Wed Apr 10, 2019 12:46 am

DoH is no longer a "waste of time" and it's now massively used by the industry (there's even Android Apps to turn on that nowadays with CloudFare for example).

So, questions:

1. Is there an intention from Mikrotik to implement this?
2. Is there a sharable roadmap for the feature to be implemented?
3. If #1 = negative, why and what's the alternative for your users to be able to make use of such technologies?

Thanks,
anthonws.

kenyloveg · Mon Apr 15, 2019 7:39 am

Can we just holding back these advanced fancy DNS standards, but support setting up non-standard tcp/udp port in /ip dns?
Just a little update in 6.45, or maybe 6.46...
DNS pollution(intercept plain text like google from udp 53 port then return 127.0.0.1) is very easy way for a ISP to do if mikrotik device (and most common soho devices) only support udp 53.
BTW, I'm using below rules to redirect dns port.
Code: Select all
add action=dst-nat chain=dstnat dst-address=208.67.220.220 dst-port=53 protocol=udp to-addresses=208.67.220.220 to-ports=5353
add action=dst-nat chain=dstnat dst-address=208.67.222.222 dst-port=53 protocol=udp to-addresses=208.67.222.222 to-ports=5353
Why limit the destination address to one pubic DNS server. Why not just dstport 53 protocol udp/tcp redirect to port 5353 (sounds like dnssec for pihole).
In your rule, somebody hardcoding 8.8.8.8 or 1.1.1.1 would not get trapped.

Tested this works with opendns, but failed with cloudflare or some other public dns. (assume ISP rules to intercept opendns is not created for now)

obesbash · Tue Apr 30, 2019 6:00 pm

+1 for DNSSec/DNSCrypt

darkmanlv · Wed Jun 12, 2019 3:04 pm

+1 DNSCrypt, when?

febhost32 · Sun Jun 16, 2019 7:24 am

+1 for DNSCrypt

karo84 · Fri Jun 21, 2019 4:07 pm

+10000 for DNSSec/DNSCrypt . It is a big need today to use DNSCrypt. Thanks!

mutinsa · Fri Jun 28, 2019 3:26 pm

up

+1.

kathampy · Wed Jul 31, 2019 8:07 pm

I would also like to see DNS over HTTPS support so I can use Cloudflare's service. Since the RouterOS DNS service is only a forwarder, DNSSEC can only be done by the upstream iterative resolver. To prevent tampering between RouterOS and the upstream resolver, DNS over HTTPS is required.

ErfanDL · Wed Jul 31, 2019 8:18 pm

+1M

Sent from my SM-A705FN using Tapatalk

konigman · Sat Aug 03, 2019 12:16 am

Mikrotik is a business, so we have to treat this feature request as such. Not on ideological (privacy of user) or technical (DoT vs DoH) grounds.

That said, the question Mikrotik is asking themselves is obvious. Is this feature "worth it"?

Our approach should be to not only say "yes" with a sea of +1s (by the way, can there not be some annual feature request poll, annual feedback survey or something like that), but provide arguments that support this conclusion.

For example;

Which major DNS providers now offer DoT/DoH?
Which competing network hardware manufacturers provide DoT/DoH or are planning to?
Which consumer devices support DoT/DoH? The point here is that if consumers start using DoT/DoH, then they will expect to see it in the network gear in their homes, workplace, ISPs.

Now, did you expect me to provide answers to the above? Too bad. I'm Friday-lazy, but consider this me trying to get the ball rolling.

Ok, fine. Here's a list of DNS providers https://en.wikipedia.org/wiki/Public_re ... ame_server so it's evident Cloudflare, Google and Quad9 are leading the way.
Also, about consumer devices, we have "Private DNS" in Android 9.0, which accepts DoT.
Regarding competing firms, someone in the know could chime in.

WojtusW5 · Sat Aug 03, 2019 12:32 pm

+1 a very good idea that encrypted DNS support will be implemented in RouterOS

anthonws · Sat Aug 03, 2019 2:26 pm

Mikrotik is a business, so we have to treat this feature request as such. Not on ideological (privacy of user) or technical (DoT vs DoH) grounds.

That said, the question Mikrotik is asking themselves is obvious. Is this feature "worth it"?

Our approach should be to not only say "yes" with a sea of +1s (by the way, can there not be some annual feature request poll, annual feedback survey or something like that), but provide arguments that support this conclusion.

For example;

Which major DNS providers now offer DoT/DoH?
Which competing network hardware manufacturers provide DoT/DoH or are planning to?
Which consumer devices support DoT/DoH? The point here is that if consumers start using DoT/DoH, then they will expect to see it in the network gear in their homes, workplace, ISPs.

Now, did you expect me to provide answers to the above? Too bad. I'm Friday-lazy, but consider this me trying to get the ball rolling.

Ok, fine. Here's a list of DNS providers https://en.wikipedia.org/wiki/Public_re ... ame_server so it's evident Cloudflare, Google and Quad9 are leading the way.
Also, about consumer devices, we have "Private DNS" in Android 9.0, which accepts DoT.
Regarding competing firms, someone in the know could chime in.

All good points that have been indefinitely mentioned throughout the forum in numerous threads.

Just forget it. It's not going to happen.

There's no objective Customer Care/Success Unit strategy from Mikrotik, let alone someone or some Business Unit looking into these forums, other than support.

Honestly (and I'm not the only one saying this), take you're money elsewhere for your next network equipment acquisition.

drdedus · Wed Sep 11, 2019 12:47 am

+1 for DNSSec/DNSCrypt

3dfx · Thu Sep 26, 2019 12:53 am

Any updates on the topic?

kenyloveg · Mon Oct 14, 2019 7:02 am

Never tried V7 beta, something new in the DNS section?

Sob · Mon Oct 14, 2019 6:42 pm

Nothing I can see. But it's early beta and the main goal is to have new kernel, not so much new features, even though there are some (not for DNS).

kenyloveg · Thu Oct 17, 2019 5:20 am

Nothing I can see. But it's early beta and the main goal is to have new kernel, not so much new features, even though there are some (not for DNS).

Thank you.

JmJ17 · Wed Nov 20, 2019 3:23 pm

+1 for this request.

TheDoctor · Wed Dec 18, 2019 10:56 am

+1 for sure.
Are there any news ?

misterx11 · Tue Dec 31, 2019 8:19 pm

+1 for this request as well.
Hoping we see it implemented soon.

arusi · Thu Jan 02, 2020 3:55 am

+1 for DNS over HTTPS

anakin475 · Wed Jan 15, 2020 10:03 am

+1 for DNSCrypt!!!

gorec2005 · Tue Feb 04, 2020 8:05 am

+1 for DNS over HTTPS

msatter · Tue Feb 04, 2020 2:48 pm

-1 for DNS support over HTTPS (DoH)
+1 for DNS support over TLS (DoT)

DNSCrypt is an extra encrypting then.

TheDoctor · Tue May 26, 2020 12:42 am

And one more time topic up.
+1 for DoT.

Kamaz · Thu May 28, 2020 12:44 pm

+1 for DoT.

Thu May 28, 2020 12:45 pm

What is the reason to support DoT if you already have DoH?
You want DNS entryption that is easy to be blocked by the ISP? Why?

Chupaka · Thu May 28, 2020 1:11 pm

You want DNS entryption that is easy to be blocked by the ISP? Why?

Probably because they are ISP

Thu May 28, 2020 1:54 pm

awwww

zabullet · Thu Jun 04, 2020 10:38 pm

https://wiki.mikrotik.com/wiki/Manual:I ... over_HTTPS

YAY!?

0bit · Tue Jul 14, 2020 1:56 am

As alternative is good to have DoT.
+1 for DoT

syborg · Thu Mar 31, 2022 8:53 pm

I second this.

curzondax · Sat Oct 08, 2022 8:50 pm

Seriously, thank you to MT for implementing DoH at least.

+1 for DoT though, as they are both different and have their own strengths and weaknesses. As DoH is already implemented, it should be trivial to implement DoT, especially with how well-documented and well-supported it is by most of the world.

DoT is not trivial to implement. DoH is much easier to implement.

If Mikrotik wanted to deploy DoT, they would likely have to choose between an existing daemon (Stubby?), or make their own, which requires a lot of performance and behavioral considerations.

Supporting DoH3 (DNS over HTTPS/3 or QUIC) is probably the natural next step.

Who is online