Your DNS history is metadata in the same way your phone call history is. The government may not be listening to your calls, but they can figure out a lot by seeing you made a three hour call to a Suicide Hotline. Similarly, they may not see your data-in-transit, but they may be able to see your DNS requests and glean a lot about what sites you’re visiting.
Not sure if I’m misunderstanding you, but pi hole doesn’t stop your DNS requests from leaving your network. All it does is filter the requests you send before relaying the requests that aren’t in the filter list to it’s upstream/next hop server.
Either that or use DNS-over-HTTPS.
DoH is a reasonable option, but it only protects your metadata if you’re using a resolver you trust not to keep records. If the resolver keeps records, DoH or not, they’ve got the metadata of where you’re going.
Not sure if I’m misunderstanding you, but pi hole doesn’t stop your DNS requests from leaving your network. All it does is filter the requests you send before relaying the requests that aren’t in the filter list to it’s upstream/next hop server.
Yes, that’s Pi-Hole with it’s default rollout. By default it’s a DNS forwarder that, as you said, after filtering locally, sends a request to an upstream DNS server (like say, Google 8.8.8.8 or Cloudflare 1.1.1.1) to search for the IP for the domain name you have entered into your browser.
Using unbound, you turn a Pi-Hole from a mere forwarder to a Recursive DNS Server. From my link (the one you quoted):
What is a recursive DNS server?¶
The first distinction we have to be aware of is whether a DNS server is authoritative or not. If I’m the authoritative server for, e.g., pi-hole.net, then I know which IP is the correct answer for a query. Recursive name servers, in contrast, resolve any query they receive by consulting the servers authoritative for this query by traversing the domain. Example: We want to resolve pi-hole.net. On behalf of the client, the recursive DNS server will traverse the path of the domain across the Internet to deliver the answer to the question.
And why does this matter? From the same link:
Benefit: Privacy - as you’re directly contacting the responsive servers, no server can fully log the exact paths you’re going, as e.g. the Google DNS servers will only be asked if you want to visit a Google website, but not if you visit the website of your favorite newspaper, etc.
So while it’s not as nice as having a DNS root server in your own home (which is a whole different beast and highly improbable for an individual to roll out) it effectively spreads its search so diffusely among DNS root servers, Top Level Domain DNS servers, and authoritative DNS servers that none of them have a full picture of what you searched for. The link I sent also breaks down the difference in steps:
A standard Pi-hole installation will do it as follows:
Also, might be a good time to look into a Raspberry Pi or even an old laptop and learning how to turn an adblocking Pi-Hole into a full fledged DNS resolver so you’re not sending your requests outside of your own network.
Either that or use DNS-over-HTTPS.
Your DNS history is metadata in the same way your phone call history is. The government may not be listening to your calls, but they can figure out a lot by seeing you made a three hour call to a Suicide Hotline. Similarly, they may not see your data-in-transit, but they may be able to see your DNS requests and glean a lot about what sites you’re visiting.
Not sure if I’m misunderstanding you, but pi hole doesn’t stop your DNS requests from leaving your network. All it does is filter the requests you send before relaying the requests that aren’t in the filter list to it’s upstream/next hop server.
DoH is a reasonable option, but it only protects your metadata if you’re using a resolver you trust not to keep records. If the resolver keeps records, DoH or not, they’ve got the metadata of where you’re going.
Yes, that’s Pi-Hole with it’s default rollout. By default it’s a DNS forwarder that, as you said, after filtering locally, sends a request to an upstream DNS server (like say, Google 8.8.8.8 or Cloudflare 1.1.1.1) to search for the IP for the domain name you have entered into your browser.
Using unbound, you turn a Pi-Hole from a mere forwarder to a Recursive DNS Server. From my link (the one you quoted):
And why does this matter? From the same link:
So while it’s not as nice as having a DNS root server in your own home (which is a whole different beast and highly improbable for an individual to roll out) it effectively spreads its search so diffusely among DNS root servers, Top Level Domain DNS servers, and authoritative DNS servers that none of them have a full picture of what you searched for. The link I sent also breaks down the difference in steps:
Interesting, I haven’t followed pihole in a long time. Thanks for educating me!
Couldn’t they just get that info from the IP addresses anyway?