Not sure if I’m misunderstanding you, but pi hole doesn’t stop your DNS requests from leaving your network. All it does is filter the requests you send before relaying the requests that aren’t in the filter list to it’s upstream/next hop server.
Either that or use DNS-over-HTTPS.
DoH is a reasonable option, but it only protects your metadata if you’re using a resolver you trust not to keep records. If the resolver keeps records, DoH or not, they’ve got the metadata of where you’re going.
Not sure if I’m misunderstanding you, but pi hole doesn’t stop your DNS requests from leaving your network. All it does is filter the requests you send before relaying the requests that aren’t in the filter list to it’s upstream/next hop server.
Yes, that’s Pi-Hole with it’s default rollout. By default it’s a DNS forwarder that, as you said, after filtering locally, sends a request to an upstream DNS server (like say, Google 8.8.8.8 or Cloudflare 1.1.1.1) to search for the IP for the domain name you have entered into your browser.
Using unbound, you turn a Pi-Hole from a mere forwarder to a Recursive DNS Server. From my link (the one you quoted):
What is a recursive DNS server?¶
The first distinction we have to be aware of is whether a DNS server is authoritative or not. If I’m the authoritative server for, e.g., pi-hole.net, then I know which IP is the correct answer for a query. Recursive name servers, in contrast, resolve any query they receive by consulting the servers authoritative for this query by traversing the domain. Example: We want to resolve pi-hole.net. On behalf of the client, the recursive DNS server will traverse the path of the domain across the Internet to deliver the answer to the question.
And why does this matter? From the same link:
Benefit: Privacy - as you’re directly contacting the responsive servers, no server can fully log the exact paths you’re going, as e.g. the Google DNS servers will only be asked if you want to visit a Google website, but not if you visit the website of your favorite newspaper, etc.
So while it’s not as nice as having a DNS root server in your own home (which is a whole different beast and highly improbable for an individual to roll out) it effectively spreads its search so diffusely among DNS root servers, Top Level Domain DNS servers, and authoritative DNS servers that none of them have a full picture of what you searched for. The link I sent also breaks down the difference in steps:
A standard Pi-hole installation will do it as follows:
Not sure if I’m misunderstanding you, but pi hole doesn’t stop your DNS requests from leaving your network. All it does is filter the requests you send before relaying the requests that aren’t in the filter list to it’s upstream/next hop server.
DoH is a reasonable option, but it only protects your metadata if you’re using a resolver you trust not to keep records. If the resolver keeps records, DoH or not, they’ve got the metadata of where you’re going.
Yes, that’s Pi-Hole with it’s default rollout. By default it’s a DNS forwarder that, as you said, after filtering locally, sends a request to an upstream DNS server (like say, Google 8.8.8.8 or Cloudflare 1.1.1.1) to search for the IP for the domain name you have entered into your browser.
Using unbound, you turn a Pi-Hole from a mere forwarder to a Recursive DNS Server. From my link (the one you quoted):
And why does this matter? From the same link:
So while it’s not as nice as having a DNS root server in your own home (which is a whole different beast and highly improbable for an individual to roll out) it effectively spreads its search so diffusely among DNS root servers, Top Level Domain DNS servers, and authoritative DNS servers that none of them have a full picture of what you searched for. The link I sent also breaks down the difference in steps:
Interesting, I haven’t followed pihole in a long time. Thanks for educating me!