diff --git a/.nojekyll b/.nojekyll new file mode 100644 index 0000000..e69de29 diff --git a/404.html b/404.html new file mode 100644 index 0000000..d20ec9f --- /dev/null +++ b/404.html @@ -0,0 +1,1101 @@ + + + +
+ + + + + + + + + + + + + + +The simplest test is to open on.quad9.net in your browser of choice.
+Confirm which protocol is used when Quad9 receives your DNS queries. This is particularly relevant after setting up DNS encryption, such as DNS over TLS or DNS over HTTPS, in the operating system, router, DNS forwarder.
+Execute the following command and refer to the possible responses below:
+Resolve-DnsName -Type txt proto.on.quad9.net.
dig +short txt proto.on.quad9.net.
Possible Responses:
+If you do not receive a response (NXDOMAIN), then Quad9 was not used to perform this DNS query.
+The quickest way to see if a domain is blocked at Quad9 is using our Blocked Domain Tester.
+When Quad9 blocks a domain, the response is NXDOMAIN
. NXDOMAIN
is also returned when a domain does not exist.To differentiate between domains that are nonexistent, and domains that are blocked, we set the AUTHORITY
value differently. When you receive an NXDOMAIN
with AUTHORITY: 0
, that is a block from Quad9. When you receive NXDOMAIN
with AUTHORITY: 1
, then that is a domain that does not exist.
A domain will also fail to resolve if DNSSEC authentication fails, but that will result in the SERVFAIL
code instead of NXDOMAIN
.
dig @9.9.9.9 isitblocked.org | grep "status\|AUTHORITY"
+
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 29193
+;; flags: qr rd ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
+
dig @9.9.9.9 sfaisofnadgre.odafds | grep "status\|AUTHORITY:"
+
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 22595
+;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
+
dig @9.9.9.9 A brokendnssec.net +dnssec | grep status
+
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 40999
+
Some ISPs, most often in Asia, Africa, or the Middle East, will transparently redirect DNS requests destined for third-party DNS services, like Quad9, to their own DNS forwarders/servers. This may be an attempt to enforce local policies/laws, or to simply increase their cache HIT rate on their DNS forwarders.
+You can detect a transparent DNS redirection by executing the following command from the Command Prompt or Terminal of any operating system. If the answer is anything except resXXX.xxx.rrdns.pch.net
, then DNS is being transparently redirected.
nslookup -q=txt -class=chaos id.server. 9.9.9.9 | Select-String "pch"
+
dig +short ch txt id.server. @9.9.9.9
+
If the output does not look similar to the following, or there is no output, then DNS is being transparently redirected.
+Non-authoritative answer:
+"res200.vie.rrdns.pch.net"
+
"res860.qfra3.rrdns.pch.net"
+
Please refer to our Setup Guides appended with (Encrypted)
in the title. By using encrypted DNS, transparent DNS redirection will not be possible.
Quad9's 9.9.9.11
service supports ECS.
EDNS Client Subnet (ECS) allows Quad9 to send a portion of your IP address to authoritative name servers, which helps major content providers (CDNs), such as Google, Microsoft, etc, accurately determine your geolocation.
+ECS will have no effect on which Quad9 location your queries are sent to, it simply effects what information Quad9 forwards to the authoritative name server and may effect what IP address they return back. Quad9 uses anycast addressing to ensure you are routed to the nearest Quad9 location available to you regardless of whether or not you use our ECS service.
+Since ECS does not play any role in determining where your queries are sent to, it does not have any positive or negative effect on the round trip time (ping) to Quad9
+ECS can be viewed as a trade off between privacy and getting geospecific content. One option for the privacy focused user is to leave it disabled and only enable it if you notice a specific domain not delivering you the correct content or not loading at all.
+Quad9 utilizes multiple network providers in our global network. When running a DNS leak test, it's expected to see IP addresses owned by the following providers:
+Recommended DNS Leak Test Tool
+ +These organizations are also listed on the Sponsors page of the Quad9 website: quad9.net/about/sponsors
+If you are trying to simply determine if you are using Quad9, you can visit on.quad9.net instead of relying on a DNS leak test. However, a DNS leak test can be useful to ensure you're exclusively using Quad9, which is required to ensure that all of your DNS requests will be protected by Quad9.
+ + + + + + + + + + + + + + + + +You're administrating DNS for a building, office, business, ISP, etc, and you want to use Quad 9. Great choice!
+Note
+For ISPs or organizations with more than 5,000 users behind a forwarding cache, or if you expect more than 500 queries per second from a single egress IP address, please contact Quad9 Support with the details of your deployment, so that we can work together to ensure a smooth and successful deployment.
+Caching forwarders and their optimal configuration are critical when sending queries en masse to Quad9, and is highly preferred over direct assignment via DHCP to end users with regards to:
+Reducing the amount of queries that recurse to Quad9, saving bandwidth and providing a faster experience for the end user when their queries are already in the forwarders' cache.
+Enabling query logging or some type of high-level metrics is advised to identify possible compromise from specific endpoints or customers, and is sometimes required by local law.
+Being able to block or analyze certain FQDNs at the forwarder level puts more control in the hands of the network administrator without relying exclusively on Quad9 to block malicious domains.
+When setting Quad9 as the recursive resolver in your infrastructure and caching DNS forwarders, please consider the following best practices.
+Since DNS forwarders use round-robin ordering when forwarding queries to a list of recursive DNS servers, Quad9 must be set as the exclusive recursive DNS servers in your forwarders. Adding additional, non-Quad9 recursive DNS servers will result in a percentage of your DNS queries not being protected by Quad9's threat blocking.
+It is imperative that your DNS forwarders are configured to cache response data in order to avoid excessive recursive queries to Quad9 and to provide significantly faster DNS resolution for devices on the network.
+Ensure that your DNS forwarders have enough memory or disk space allocated to the cache to avoid the cache filling up.
+The amount of memory that should be dedicated to DNS caching varies greatly from megabytes to gigabytes based on the amount of DNS requests originating from your network endpoints.
+Bind caches in memory by default, so the only limitation is exhausting available memory in the system.
+To check the size of the current cache, you can dump the cache to a local file and then examine the file size, which will be approximately how much memory is being used by cache:
+rndc dumpdb -all
+
ls -alh /var/bind/
+
Caching is disabled by default, but can be enabled for in-memory storage.
+Allocated cache size is determined by the msg-cache-size and rrset-cache-size options in the unbound.conf file.
+You can check the amount of memory that your cache is currently using to compare against the cache size you allocated in unbound.conf by using the unbound-control command to view stats for mem.cache.rrset and mem.cache.message values.
+Knot Resolver caches on disk by default, but can be configured to use memory/tmpfs, backends, and share cache between instances. Knot Resolver has excellent documentation about all things caching.
+In-memory caching can be configured using the Set-DnsServerCache
cmd applet.
Memory usage can be checked using the Get-DnsServerStatistics
cmd applet.
Configuring both the primary and secondary IP of your desired Quad9 service helps naturally load balance the DNS queries in the Quad9 infrastructure.
+If your network is capable of IPv6, also configure the primary and secondary IPv6 addresses of your desired Quad9 service in your DNS forwarders, which helps naturally load balance the DNS queries in the Quad9 infrastructure.
+If IPv6 is not in use, Quad9 strongly encourages you to investigate how to get it enabled on your network. IPv6 route paths are often faster compared to IPv4 paths, which leads to a higher chance of success at faster speeds with better redundancy.
+Each DNS forwarder should, ideally, send and receive DNS queries to Quad9 using different public IPv4 and IPv6 addresses, even if the addresses are within the same subnet.
+Since Quad9 already performs DNSSEC validation, DNSSEC being enabled in the forwarder will cause a duplication of the DNSSEC process, significantly reducing performance and potentially causing false BOGUS responses.
+Add this in dnsdist.conf
above your pool assignment.
+
if noDNSSECOnNOSEC then
+ addAction(NetmaskGroupRule(nmgNOSEC, false), SetDisableValidationAction(), { name="R_NO_DS" })
+end
+
Add this to the kresd.conf
file and reload/restart the kresd
service.
+
-- turns off DNSSEC validation
+trust_anchors.remove('.')
+
In recursor.conf
, disable dnssec
and reload/restart pdns-recursor
.
+
dnssec=off
+
Comment out these lines in unbound.conf
and reload/restart unbound.
+
trust-anchor-file:
+auto-trust-anchor-file:
+trust-anchor:
+trusted-keys-file:
+
QNAME Minimization is a privacy feature that is intended to be used when you operate a recursive resolver (Quad9), but in a DNS forwarder, it provides no privacy enhancement and significantly reduces performance. What is QNAME Minimization?
+In the options {
section of the named.conf file, add the following line and reload/restart named/bind9.
+
qname-minimization disabled;
+
QNAME Minimization is not supported in dnsdist. Nothing to do here.
+Add this in the unbound.conf
and reload/restart unbound.
+
qname-minimisation: no
+
In the kresd.conf
file, add a policy to disable QNAME Minimization and restart/reload the kresd
service.
+
policy.add(policy.all(policy.FLAGS('NO_MINIMIZE')))
+
Questions? Issues? Contact us!
+ + + + + + + + + + + + + + + + + +Android 9 and later includes the Private DNS
feature, which allows you to connect to DNS servers using DNS over TLS (DoT). It is important to note, that the private DNS function does not work if the Quad9 Connect app is installed and enabled. To configure your Android device to use Quad9 in this way, follow the steps below.
VPNs
+The Private DNS feature will not be utilized if you are using a VPN. If using a VPN, instead, configure Quad9's IP addresses in your VPN's Custom DNS
settings. Please refer to your VPN provider's documentation fr more information
Open the Settings
app on your Android device.
Network & Internet
.Private DNS
.Select Private DNS provider hostname
dns.quad9.net
Save
Visit on.quad9.net in your browser of choice.
+Questions? Issues? Didn't work? Contact us!
+ + + + + + + + + + + + + + + + + +Quad9 Connect is an Android application compatible with ChromeOS using the Google Play Store. It creates a secure tunnel between the device and Quad9 for sending DNS queries via DNS over Quad9 Connect provides additional features like a query log, one-click service switching, and the ability to report false positives from the Query Log.
+Quad9 Connect is not a VPN, but uses the VPN functionality of the device to achieve encrypted DNS and the features associated with the application. When Quad9 Connect is enabled, it is not possible to use another VPN connection at the same time. If using a VPN, consider setting Quad9's DNS servers in the "Custom DNS" settings of your VPN client.
+Install Quad9 Connect
+Quad9 Connect
Display Preference
+Phone
, Tablet
, or Resizable
. You can select your preference.Read and click OK
when prompted for the connection request.
You have to connect to this VPN to use Quad9 Connect.
+play
icon to connect! The number ‘9’ and VPN key logo should appear in the bottom right corner of your screen.
+To confirm you're using Quad9, visit: on.quad9.net
+Questions? Issues? Didn't work? Contact us!
+ + + + + + + + + + + + + + + + + +Set up Quad9 in Windows DNS Server for use in DNS forwarding.
+Note
+Before proceeding, please refer to our DNS Forwarder Best Practices article.
+Open Server Manager
from the Start
menu.
Server Manager
, select Tools
> DNS
From the DNS Manager, right-click your server and select Properties
Forwarders
tab and then select Edit
.9.9.9.9
, 149.112.112.112
2620:fe::fe
, 2620:fe::9
Questions? Issues? Contact us!
+ + + + + + + + + + + + + + + + + +The easiest way to set Quad9 on your entire network is via your router settings. If you'd prefer to set Quad9 on a single system, please follow the steps below to configure Fedora 38 to use Quad9.
+Firefox, VPNs
+Custom DNS
settings of your VPN client. Refer to your VPN provider's documentation for further information.Click the Network
or WiFi
icon in the system tray at the top-right corner of the screen.
>
next to the active connection.Wired Settings
or Wireless Settings
.Click the icon next to your connection.
+Click the IPv4
tab
Automatic DNS
Multiple IP addresses can be entered in the list using comas.
+9.9.9.9, 149.112.112.112
Apply
to complete the setup process, and then confirm you're using Quad9.If your network supports IPv6, it's also recommended to configure the Quad9 IPv6 addresses. If you're not sure if IPv6 is configured on your network, you can test that here: https://test-ipv6.com/
+IPv6
tabAutomatic DNS
Multiple IP addresses can be entered in the list using comas.
+2620:fe::fe, 2620:fe::9
Apply
to complete the setup process.Confirm you're using Quad9 by visiting on.quad9.net in your preferred browser.
+Questions? Issues? Didn't work? Contact us!
+ + + + + + + + + + + + + + + + + +This article describes how to configure and use FreeBSD's pre-installed "local_unbound" service in order to send encrypted DNS via DNS over TLS to Quad9.
+This was tested using FreeBSD 13.1, but should work with 12.X as well.
+Firefox, VPNs
+Custom DNS
settings of your VPN client. Refer to your VPN provider's documentation for further information.Warning
+FreeBSD, by default, installs a local instance of Unbound DNS. This is meant to act as a local, caching DNS forwarder for the local machine only, and is not intended to act as a DNS forwarder for other network devices. If you want to run Unbound DNS on FreeBSD for the purposes of running a caching DNS forwarder that will be used by multiple devices on the network, FreeBSD recommends installing the dns/unbound package instead. These instructions are only valid for the "local_unbound" service.
+You will need the sudo command to run the commands below. Alternatively, you can simply use the su command to become the root user and execute these commands directly as the root user, in which case, you'll need to remove "sudo" from all the commands below.
+pkg install bind-tools
+
sudo grep unbound /etc/rc.conf
+
If the following output is produced, local_unbound is already enabled, and you can skip to the next section:
+local_unbound_enable="YES"
+
echo 'local_unbound_enable="YES"' >> /etc/rc.conf
+
Then reboot the system (yes, really):
+reboot
+
sudo local-unbound-setup
+
The output should similar to this, but may differ slightly:
+destination:
+Extracting forwarders from /etc/resolv.conf.
+/var/unbound/forward.conf not modified
+/var/unbound/lan-zones.conf not modified
+/var/unbound/control.conf not modified
+/var/unbound/unbound.conf not modified
+local_unbound not running? (check /var/run/local_unbound.pid).
+Starting local_unbound.
+/etc/resolvconf.conf created
+Original /etc/resolv.conf saved as /var/backups/resolv.conf.20220625.200835
+
Configuring local_unbound for DNS over TLS to Quad9
+This command will back up the default configuration files, download the modified config files from the attachment of this article, and restart the local_unbound service.
+sudo mv /var/unbound/forward.conf /var/unbound/forward-ORIG.conf && sudo mv /var/unbound/unbound.conf /var/unbound/unbound-ORIG.conf && sudo fetch -o /var/unbound/unbound.conf https://docs.quad9.net/assets/conf/freebsd/unbound.conf && sudo fetch -o /var/unbound/forward.conf https://docs.quad9.net/assets/conf/freebsd/forward.conf && sudo service local_unbound restart
+
These files are configured for our 9.9.9.9 service by default, without IPv6. If you'd like to use the .10 or .11 service instead, and/or enable IPv6, open the /var/unbound/forward.conf
file and un-comment/comment out the appropriate lines.
You'll need two Terminal sessions/windows
+In the first session, start a packet capture to filter for DNS over TLS traffic:
+sudo tcpdump -n 'port 853'
+
In the second session, generate some DNS lookups:
+dig +short quad9.net && dig +short www.quad9.net && dig +short zombo.com
+
Refer back to the first session. If you see any output, your system is now using DNS over TLS to send encrypted DNS to Quad9:
+tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
+listening on em0, link-type EN10MB (Ethernet), capture size 262144 bytes
+20:30:21.004625 IP 192.168.1.118.29017 > 149.112.112.112.853: Flags [S], seq 255439876, win 65535, options [mss 1460,nop,wscale 6,sackOK,TS val 2441683586 ecr 0], length 0
+20:30:21.011088 IP 149.112.112.112.853 > 192.168.1.118.29017: Flags [S.], seq 838572319, ack 255439877, win 28960, options [mss 1460,nop,nop,TS val 3171725219 ecr 2441683586,nop,wscale 8], length 0
+20:30:21.011140 IP 192.168.1.118.29017 > 149.112.112.112.853: Flags [.], ack 1, win 1027, options [nop,nop,TS val 2441683592 ecr 3171725219], length 0
+20:30:21.011628 IP 192.168.1.118.29017 > 149.112.112.112.853: Flags [P.], seq 1:294, ack 1, win 1027, options [nop,nop,TS val 2441683592 ecr 3171725219], length 293
+20:30:21.017885 IP 149.112.112.112.853 > 192.168.1.118.29017: Flags [.], ack 294, win 118, options [nop,nop,TS val 3171725226 ecr 2441683592], length 0
+20:30:21.018447 IP 149.112.112.112.853 > 192.168.1.118.29017: Flags [.], seq 1:1449, ack 294, win 118, options [nop,nop,TS val 3171725227 ecr 2441683592], length 1448
+20:30:21.018453 IP 149.112.112.112.853 > 192.168.1.118.29017: Flags [.], seq 1449:2897, ack 294, win 118, options [nop,nop,TS val 3171725227 ecr 2441683592], length 1448
+
To undo the configuration changes to local_unbound, simply run this command to restore the original files and restart local_unbound:
+sudo mv /var/unbound/forward-ORIG.conf /var/unbound/forward.conf && sudo mv /var/unbound/unbound-ORIG.conf /var/unbound/unbound.conf && sudo service local_unbound restart
+
Questions? Issues? Didn't work? Contact us!
+ + + + + + + + + + + + + + + + + +The easiest way to set Quad9 on your entire network is via your router settings. If you'd prefer to set Quad9 on a single system, please follow the steps below to configure Linux Mint to use Quad9.
+Firefox, VPNs
+Custom DNS
settings of your VPN client. Refer to your VPN provider's documentation for further information.Network
or Wi-Fi
icon on the system tray in the bottom-right corner.Network Settings
IPv4
on the left-side menu.DNS
section:Automatic
Server
field.9.9.9.9
in the first Server
field, and 149.112.112.112
in the second.Apply
Confirm you're using Quad9 by visiting on.quad9.net in your preferred browser.
+Questions? Issues? Didn't work? Contact us!
+ + + + + + + + + + + + + + + + + +The easiest way to set Quad9 on your entire network is via your router settings. If you'd prefer to set Quad9 on a single system, please follow the steps below to configure MX Linux 23 to use Quad9.
+Firefox, VPNs
+Custom DNS
settings of your VPN client. Refer to your VPN provider's documentation for further information.Right click on the Network/WiFi icon in the system tray on the left side of the screen.
+Edit Connections
Select the IPv4 Settings
tab.
Method
to Automatic (DHCP) addresses only
DNS Servers
field, add: 9.9.9.9,149.112.112.112
Save
Confirm you're using Quad9 by visiting on.quad9.net in your preferred browser.
+Questions? Issues? Didn't work? Contact us!
+ + + + + + + + + + + + + + + + + +This article describes how to configure and use Unbound on OpenBSD in order to send encrypted DNS via DNS over TLS to Quad9.
+This was tested using OpenBSD 7.1.
+Firefox, VPNs
+Custom DNS
settings of your VPN client. Refer to your VPN provider's documentation for further information.Warning
+Unbound DNS is installed by default on standard OpenBSD installations. This is meant to act as a local, caching DNS forwarder for the local machine only, and is not intended to act as a DNS forwarder for other network devices. If you want to run Unbound DNS on OpenBSD for the purposes of running a caching DNS forwarder that will be used by multiple devices on the network, you can modify the interface and access-control values in unbound.conf appropriately, which by default, only allow DNS queries from localhost.
+You must be logged in as the root user directly or by running the su
command and typing in your password in a Terminal session.
unbound.conf
file, which is pre-configured for sending DNS queries to Quad9 via DNS over TLS.Note
+You're encouraged to download and inspect the unbound.conf file in a text editor, which is attached to this article, before downloading it to your OpenBSD system.
+mv /var/unbound/etc/unbound.conf /var/unbound/etc/unbound.BAK && ftp -o /var/unbound/etc/unbound.conf https://docs.quad9.net/assets/conf/openbsd/unbound.conf
+
Optional: If your network supports IPv6, open the /var/unbound/etc/unbound.conf file on OpenBSD with your favorite text editor, and make the following changes, removing the # (comment) before these lines begin.
+Before
+# do-ip6: no
+# forward-addr: 2620:fe::fe@853#dns.quad9.net
+# forward-addr: 2620:fe::9@853#dns.quad9.net
+
After
+do-ip6: yes
+forward-addr: 2620:fe::fe@853#dns.quad9.net
+forward-addr: 2620:fe::9@853#dns.quad9.net
+
rcctl enable unbound
+
rcctl start unbound
+
Open a separate/second Terminal session to the OpenBSD system as the root user and start a packet capture, filtering for port 853 (DNS over TLS port): +tcpdump -n 'port 853'
+The result should be: 216.21.3.77
+On your second Terminal session, tcpdump should show output like this, which confirms that the DNS query was sent to Quad9 with DNS over TLS: +
tcpdump: listening on em0, link-type EN10MB
+00:29:08.307240 192.168.1.194.42064 > 149.112.112.112.853: S 3620809840:3620809840(0) win 16384 <mss 1460,nop,nop,sackOK,nop,wscale 6,nop,nop,timestamp 495425124 0> (DF)
+00:29:08.313467 149.112.112.112.853 > 192.168.1.194.42064: S 1684627303:1684627303(0) ack 3620809841 win 28960 <mss 1460,nop,nop,timestamp 3541989193 495425124,nop,wscale 8> (DF)
+00:29:08.313559 192.168.1.194.42064 > 149.112.112.112.853: . ack 1 win 256 <nop,nop,timestamp 495425124 3541989193> (DF)
+00:29:08.313895 192.168.1.194.42064 > 149.112.112.112.853: P 1:310(309) ack 1 win 256 <nop,nop,timestamp 495425124 3541989193> (DF)
+00:29:08.319973 149.112.112.112.853 > 192.168.1.194.42064: . ack 310 win 118 <nop,nop,timestamp 3541989200 495425124> (DF)
+00:29:08.320719 149.112.112.112.853 > 192.168.1.194.42064: . 1:1449(1448) ack 310 win 118
+
Set your system to start using Unbound for DNS by backing up the existing resolv.conf file and set 127.0.0.1 as the DNS server for the system: +
cp /etc/resolv.conf /etc/resolv.BAK && echo "nameserver 127.0.0.1" > /etc/resolv.conf
+
If you want to stop using Unbound as the DNS server, simply restore the backed-up resolv.conf file:
+mv /etc/resolv.BAK /etc/resolv.conf
+
Questions? Issues? Didn't work? Contact us!
+ + + + + + + + + + + + + + + + + +The easiest way to set Quad9 on your entire network is via your router settings. If you'd prefer to set Quad9 on a single system, please follow the steps below to configure Ubuntu 22.04 or 22.04 LTS to use Quad9.
+Firefox, VPNs
+Custom DNS
settings of your VPN client. Refer to your VPN provider's documentation for further information.From the Ubuntu desktop, select the drop down menu in the top right corner of the screen, expand either Wired Connection
or Wireless Connection
based on your connection type, then select Wired Settings
or Wireless Settings
.
Click the icon next to your connection.
+Click the IPv4
tab
Automatic DNS
Multiple IP addresses can be entered in the list using comas.
+9.9.9.9, 149.112.112.112
Apply
to complete the setup process, and then confirm you're using Quad9.If your network/computer support IPv6, it's also recommended to configure the Quad9 IPv6 addresses. If you're not sure if IPv6 is configured on your network, you can test that here: https://test-ipv6.com/
+IPv6
tabAutomatic DNS
Multiple IP addresses can be entered in the list using comas.
+2620:fe::fe, 2620:fe::9
Apply
to complete the setup process.Confirm you're using Quad9 by visiting on.quad9.net in your preferred browser.
+Questions? Issues? Didn't work? Contact us!
+ + + + + + + + + + + + + + + + + +Note: The maintainers of systemd-resolved emphasize that this DNS over TLS implementation is currently a work in progress. You may consider using Stubby instead if experiencing performance issues. See here for Ubuntu 18.04 / 20.04 + Stubby instructions.
+Ubuntu 22.04 and Linux Mint 20.3 or later support DNS over TLS natively in systemd-resolved, but the option is not available in the GUI.
+Bug
+While this is technically also supported in Ubuntu 20.04, we do not recommend using this method for 20.04, since it uses an older systemd-resolve version which has problems.
+Bug
+The DNSSEC option should not be enabled in systemd-resolved. It is extremely buggy, and it would only duplicate the DNSSEC validation process which Quad9 already performs, significantly reducing performance.
+Firefox, VPNs
+Custom DNS
settings of your VPN client. Refer to your VPN provider's documentation for further information.Configure Quad9 in the Network Settings (Ubuntu, Linux Mint).
+Open the Terminal
application, and copy/paste these commands to enable DNS over TLS. When prompted for your password, type it in and hit Enter
.
sudo sed -i 's/#DNSOverTLS=no/DNSOverTLS=yes/g' /etc/systemd/resolved.conf
+
systemd-resolvd
and networking services
to recognize the changes to the file:sudo systemctl restart systemd-resolved.service && sudo service network-manager restart
+
Terminal
application and running the following command, typing in your password and pressing `Enter``:$ dig +short txt proto.on.quad9.net.
+
dot.
, then it is working! If the response is do53-udp.
, then it's still using plaintext. If there is no response, that means that Quad9 may not have been configured probably in the Network Settings
.
+If you experience any issues or want to undo this configuration change:
+sudo sed -i 's/DNSOverTLS=yes/#DNSOverTLS=no/g' /etc/systemd/resolved.conf
+
systemd-resolvd
and networking
services to recognize the changes to the file we just made:sudo systemctl restart systemd-resolved.service && sudo service network-manager restart
+
Questions? Issues? Didn't work? Contact us!
+ + + + + + + + + + + + + + + + + +DNS over TLS (DoT) and DNS over HTTPS (DoH) are now supported natively in MacOS Big Sur and later.
+Please follow the steps below to install the Quad9 DNS Profile.
+VPNs, iCloud Private Relay, Little Snitch
+When using iCloud Private Relay, most VPN clients, or Little Snitch, it will not utilize/respect this DNS profile.
+VPN: do not follow these instructions. Instead set Quad9's IP addresses in the Custom DNS
settings of your VPN client. Refer to your VPN client's documentation for further information.
Apple Private Relay: do not follow these instructions. Apple private relay will use its own DNS servers at the system level, with no way to override it
+Firefox
+DNS over TLS is recommended if the device will mainly connect to Wi-Fi networks you control, or on corporate networks where DNS over TLS is allowed.
+DNS over HTTPS is recommended if the device will frequently connect to guest Wi-Fi, and/or networks you do not administrate, as DoH is not as commonly blocked on firewalls.
+nslookup
and dig
The App Store, as well as the dig
and nslookup
commands in a Terminal
do not use encrypted DNS. This is by design.
DNS over TLS
+If connected to a Wi-Fi network which blocks DNS over TLS, which may occur on restrictive network firewalls, you will have to disable the profile or disconnect from the network to regain DNS resolution. This solution does not allow for unencrypted "fallback" behavior. DNS over HTTPS is recommended for most users
+This profile will expire!
+These profiles are only valid until they expire, at which point, they will automatically disable until a new profile is installed. This is by design of Apple, and there is no way around it."
+Download one of the profiles here directly using Safari on your MacOS device. You must use Safari to download the file.
+Note
+If you do not know which file to choose, we recommend DNS over HTTPS - 9.9.9.9 (DNSSEC, Threat-Blocking)
+9.9.9.9 (DNSSEC, Threat-Blocking)
+6d826edcf0e7f89c32352266896c8aacd96da8074789d1ecf01f9f60fcc63d8d
eeabc4e42bd701e0afc74c9da706024e2df40cca38d9ae3f6be92eaa91986db1
9.9.9.10 (No DNSSEC, no Threat-Blocking)
+cde1057b6dc6f61f73963299a22e7bb2eaa17100cdc60e69896c1f132804859c
5dc6b70a7e6d0971a6e988c4f46423d4bdbc66f443d6d92f43c3719675304ea7
9.9.9.11 (DNSSEC, Threat-Blocking, with ECS)
+8126f0187de219a0e9df2e2df104df1ffc0f2efa2af3e6d5c441268b3f6a020d
8c9ce407e7032d91252be58c65237d3014710df6622d37d7c0ed40bb80502e70
9.9.9.12 (No DNSSEC, no Threat-Blocking, with ECS)
+fe5943d6ad5dd553cf321e7be251cc6da68db1056ab6d754e581c8ab2e3adbb4
79cd0536250e6a1292b318a490057c17d03fd0c90768fad2f999c59b58d89345
Settings
> Profile Downloaded
and select the Quad9 profile you opened.Note
+You will receive a warning message warning that your network traffic may be filtered or monitored by the DNS server. While Quad9’s profile can protect your device by filtering potentially malicious traffic, none of your traffic will be logged by Quad9. Please refer to our Privacy Policy for more information
+Select Install, then Install again.
+The profile is now installed. Select Done
To confirm the installation was successful, visit on.quad9.net
+Questions? Issues? Didn't work? Contact us!
+ + + + + + + + + + + + + + + + + +Cloudflared is a DNS over HTTPS proxy that can be configured to use Quad9 for DNS resolution.
+cloudflared.yml
configuration file, replace the Cloudflare IPs in the proxy-dns-upstream
section with the Quad9 addresses associated with your desired features.cloudflared
serviceBefore (Cloudflare DoH Servers) +
proxy-dns-upstream:
+
+- https://1.1.1.1/dns-query
+- https://1.0.0.1/dns-query
+
IPv4 +
proxy-dns-upstream:
+
+- https://9.9.9.9/dns-query
+- https://149.112.112.112/dns-query
+
IPv6 +
proxy-dns-upstream:
+
+- https://[2620:fe::fe]/dns-query
+- https://[2620:fe::9]/dns-query
+
Questions? Issues? Didn't work? Contact us!
+ + + + + + + + + + + + + + + + + +Pi-Hole is a popular DNS forwarder, often used primarily for blocking domains specifically associated with ads and tracking.
+For detailed setup instructions of Pi-Hole itself, please see the Official Pi-Hole Documentation.
+Once you have installed Pi-Hole and can access the administration panel, Quad9 is already one of the default options.
+In the Admin panel, navigate to Settings
-> DNS
Check/Enable the options:
+Never forward non-FQDNs
and Never forward reverse lookups for private IP ranges
to prevent sending unanswerable DNS queries to Quad9.Save
at the bottom.Once Quad9 has been configured in Pi-Hole, you can configure your router or a single computer to use the Pi-Hole's IP address as a DNS server. If the Query Log is enabled (Settings -> Privacy [tab]), you should see Quad9 recorded in the Status column:
+You can also confirm if Quad9 is being used manually on Linux, MacOS, or Windows.
+Domains which are blocked by Quad9 will record Blocked (external, NXRA) in the Status column of the Query Log:
+Questions? Issues? Didn't work? Contact us!
+ + + + + + + + + + + + + + + + + +IPFire is an open-source firewall and router, used in both consumer and commercial environments.
+IPFire utilizes Unbound, which has built-in DNS over TLS support, with the configuration being accessible in the GUI.
+This setup guide was tested using IPFire 2.27
+Backup Time!
+Before making changes to a production environment, we recommend backing up the existing configuration
+Navigate to System
-> Domain Name System
DNS Servers
, click Add
9.9.9.9
149.112.112.112
Use ISP-assigned DNS Servers: Disabled
TLS
Disabled
Disabled
Save
Navigate to Status
-> Net-Traffic
in the top menu, and search for an active connect to either 9.9.9.9
or 149.112.112.112
via port 853 TCP
pakfire -y install tshark
+
tshark -i any 'port 853'
+
If the IPFire device is using DNS over HTTPS for DNS queries, you will see output like this: +
1 0.000000000 192.168.1.150 → 9.9.9.9 TCP 76 37226 → 853 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=3103990808 TSecr=0 WS=512
+2 0.006914259 9.9.9.9 → 192.168.1.150 TCP 76 853 → 37226 [SYN, ACK] Seq=0 Ack=1 Win=28960 Len=0 MSS=1460 TSval=2447463919 TSecr=3103990808 WS=256
+3 0.006948874 192.168.1.150 → 9.9.9.9 TCP 68 37226 → 853 [ACK] Seq=1 Ack=1 Win=64512 Len=0 TSval=3103990815 TSecr=2447463919
+4 0.007110658 192.168.1.150 → 9.9.9.9 TLSv1 387 Client Hello
+5 0.013306457 9.9.9.9 → 192.168.1.150 TCP 68 853 → 37226 [ACK] Seq=1 Ack=320 Win=30208 Len=0 TSval=2447463926 TSecr=3103990815
+6 0.013926633 9.9.9.9 → 192.168.1.150 TLSv1.3 2964 Server Hello, Change Cipher Spec, Application Data
+7 0.013945067 192.168.1.150 → 9.9.9.9 TCP 68 37226 → 853 [ACK] Seq=320 Ack=2897 Win=62464 Len=0 TSval=3103990822 TSecr=2447463926
+
Questions? Issues? Didn't work? Contact us!
+ + + + + + + + + + + + + + + + + +This article describes how to configure your MikroTik router using RouterOS to send encrypted DNS queries to Quad9 using DNS over HTTPS.
+RouterOS >=6.4.7 is required. These instructions were tested using RouterOS 7.1.3.
+Backup Time!
+Before making changes to a production environment, we recommend backing up the existing configuration
+Connect to your MikroTik router's management interface via SSH or console. The username and password will be the same as if using Webfig (GUI).
+In order for MikroTik to perform certificate verification of the Quad9 DNS over HTTPS domain, we need to download and import the DigiCert Global Root CA certificate.
+/tool/fetch mode=https url="https://cacerts.digicert.com/DigiCertGlobalRootCA.crt.pem"
+
/certificate/import file-name=DigiCertGlobalRootCA.crt.pem
+
The resulting output should be:
+passphrase:
+certificates-imported: 1
+private-keys-imported: 0
+files-imported: 1
+decryption-failures: 0
+keys-with-no-certificate: 0
+
IP
-> DNS
on the left-side menu.9.9.9.9
, 149.112.112.112
, 2620:fe::fe
, 2620:fe::9
Warning
+If your network does not support IPv6, then the IPv6 addresses should not be added, as it may result in a percentage of your DNS requests failing. Not sure if you have IPv6? Test here.
+https://dns.quad9.net/dns-query
Enabled
Enabled
Warning
+Don't forget to configure the firewall rules to prevent non-local IP address from using this as a DNS server.
+To confirm that the MikroTik router is sending DNS queries to Quad9 using DNS over HTTPS, you can use the packet sniffer tool to filter for packets being sent to/from Quad9 IP addresses using port 443 (HTTPS):
+tool/sniffer/quick port=443 ip-address=9.9.9.9,149.112.112.112
+
If DNS queries sent to the MikroTik router are being forwarded to Quad9 using DNS over HTTPS, you will see any output.
+Columns: INTERFACE, TIME, NUM, DIR, SRC-MAC, DST-MAC, SRC-ADDRESS, DST-ADDRESS, PROTOCOL, SIZE, CPU
+INTERFACE TIME NUM DIR SRC-MAC DST-MAC SRC-ADDRESS DST-ADDRESS PROTOCOL SIZE CPU
+ether1 6.886 5 <- 04:F0:21:45:C9:0C 08:00:27:7D:3B:33 9.9.9.9:443 (https) 192.168.1.222:59348 ip:tcp 66 0
+ether1 6.887 6 <- 04:F0:21:45:C9:0C 08:00:27:7D:3B:33 9.9.9.9:443 (https) 192.168.1.222:59348 ip:tcp 1514 0
+ether1 6.887 7 -> 08:00:27:7D:3B:33 04:F0:21:45:C9:0C 192.168.1.222:59348 9.9.9.9:443 (https) ip:tcp 66 0
+ether1 6.887 8 <- 04:F0:21:45:C9:0C 08:00:27:7D:3B:33 9.9.9.9:443 (https) 192.168.1.222:59348 ip:tcp 1514 0
+ether1 6.887 9 -> 08:00:27:7D:3B:33 04:F0:21:45:C9:0C 192.168.1.222:59348 9.9.9.9:443 (https) ip:tcp 66 0
+
If you do not yet have endpoints using the MikroTik router for DNS, you can manually query the MikroTik router to facilitate testing and checking for the output generated above from Terminal (Linux/macOS) or Command Prompt (Windows), replacing 192.168.1.1 with the LAN IP address of your MikroTik router.
+nslookup quad9.net 192.168.1.1
+
OPNsense is an open-source firewall, used in both consumer and commercial environments.
+OPNsense utilizes Unbound, which has built-in DNS over TLS support, with the configuration being accessible in the GUI.
+Backup Time!
+Before making changes to a production environment, we recommend backing up the existing configuration
+Services
-> Unbound DNS
-> DNS over TLS
on the left-side menudns.quad9.net
in the Verify CN Field, and 853
in the Server Port: field.Server IP: 9.9.9.9
+Server IP: 149.112.112.112
+Server IP: 2620:fe::fe
+Server IP: 2620:fe::9
IPv6
+If your network does not have IPv6, which you can test here, then IPv6 addresses should not be added, as it may result in a percentage of your DNS requests failing.
+Click Apply
to save the changes.
Navigate to System
-> Settings
-> General
on the left-side menu.
Disable Allow DNS server list to be overridden by DHCP/PPP on WAN
Save
Apply
at the top of the pageTo confirm that OPNsense is now sending your queries via DNS over TLS, you can run a packet capture in command line, such as:
+tcpdump -i em0 'port 853'
+
Note
+You may have to adjust the interface name from em0 to that of your device's WAN interface.
+You can also test from a macOS, Linux, or Windows system that is connected to this OPNsense router/firewall.
+ + + + + + + + + + + + + + + + + +The OpenWrt Project is a Linux operating system targeting embedded devices, which is often used as an open-source solution for routers and firewalls.
+This guide covers setting Quad9 in the DNS forwarder settings. When using your OpenWrt router as a DNS server, it will forward DNS requests to Quad9.
+Backup Time!
+Before making changes to a production environment, we recommend backing up the existing configuration
+Log into your LuCI control panel, typically by opening http://192.168.1.1
in your browser.
Navigate to Network
-> DHCP and DNS
9.9.9.9
and 149.112.112.112
, or the addresses of your preferred Quad9 service in the "DNS forwardings" input fields.If your network supports IPv6, you can also add 2620:fe::fe and 2620:fe::9, or the IPv6 addresses of your preferred Quad9 service.
+Navigate to Resolv and Hosts Files
sub-tab, and make sure Ignore resolv file
is Enabled
.
Click Save & Apply
at the bottom. Since you are not changing the DHCP settings, the change should be instantaneous .
pfSense is an open-source firewall and router, used in both consumer and commercial environments.
+pfSense has documentation for DNS over TLS, which we recommend reviewing in addition to this article.
+pfSense utilizes Unbound, which has built-in DNS over TLS support, with the configuration being accessible in the GUI.
+Backup Time!
+Before making changes to a production environment, we recommend backing up the existing configuration
+Navigate to System
-> Generate Setup
on the top menu.
Add DNS Server
until there are 4 rows of entries available.9.9.9.9
,149.112.112.112
,2620:fe::fe
,2620:fe::9
Warning
+If your network does not have IPv6, which you can test here, then IPv6 addresses should not be added, as it may result in a percentage of your DNS requests failing.
+dns.quad9.net
on all the Hostname fields on the right.Click "Save" at the bottom of the screen.
+Navigate to Services
-> DNS Forwarder
on the top menu.
+* Make sure Enable DNS forwarder is disabled. If it is enabled, disable it, and click Save
at the bottom of the page.
Navigate to Services
-> DNS Resolver
on the top menu.
DNSSEC
+DNSSEC is already enforced by Quad9, and enabling DNSSEC at the forwarder level can cause false DNSSEC failures.
+DNS Query Forwarding
Use SSL/TLS for outgoing DNS queries to Forwarding Servers
Save
at the bottom of the screen.Apply
Changes near the top of the screen to apply the saved changes.You can confirm that pfSense is now sending your queries via DNS over TLS using the built-in Packet Capture Tool.
+You can also run a test from a macOS, Linux, or Windows system on the network.
+ + + + + + + + + + + + + + + + + +The easiest way to set Quad9 on your entire network is via your router settings. If you'd prefer to set Quad9 on an individual Windows device, please follow the steps below to configure Windows 10 to use Quad9.
+Firefox, VPNs
+Custom DNS
settings of your VPN client. Refer to your VPN provider's documentation for further information.Right click on the Network icon (Wired or WiFi) in the system tray and click Open Network & Internet Settings
.
Click Change adapter options
Select Properties
.
Select Internet Protocol Version 4 (TCP/IPv4)
. Then, click Properties
.
Select Use the following DNS server addresses
.
9.9.9.9
in Preferred DNS Server149.112.112.112
in Alternate DNS Server.OK
.If your networks supports IPv6, it's also recommended to configure the Quad9 IPv6 addresses. If you're not sure if IPv6 is configured on your network, you can test that here: https://test-ipv6.com/
+Select Internet Protocol Version 6 (TCP/IPv6)
+Select Use the following DNS server addresses
.
2620:fe::fe
in Preferred DNS Server2620:fe::9
in Alternate DNS Server.OK
.Close all configuration windows.
+Confirm you're using Quad9 by visiting on.quad9.net in your preferred browser.
+Questions? Issues? Didn't work? Contact us!
+ + + + + + + + + + + + + + + + + +The easiest way to set Quad9 on your entire network is via your router settings. If you'd prefer to set Quad9 on an individual Windows device, please follow the steps below to configure Windows 11 to use Quad9.
+Firefox, VPNs
+Custom DNS
settings of your VPN client. Refer to your VPN provider's documentation for further information.Right click the Network or WiFi icon on the system tray, and left click Network and Internet Settings
Select Ethernet
or WiFi
, depending on your connection type.
Scroll down and click Edit
next to DNS server assignment
Make the following changes:
+Automatic (DHCP)
to Manual
On
switch to change the DNS serverPreferred DNS
: 9.9.9.9Preferred DNS encryption
to Encrypted Only (DNS over HTTPS)
Alternate DNS
: 149.112.112.112Note
+If using a laptop that roams to other networks which may block DNS over HTTPS, consider choosing Encryption preferred, unencrypted allowed
instead of Encrypted Only
.
Save
If using IPv6, which you can confirm here, you should also scroll down and set up Quad9 on IPv6. +Note: if Windows is not configured with an IPv6 address, setting up an IPv6 DNS server could cause DNS resolution to fail.
+Resolve-DnsName -Type txt proto.on.quad9.net.
+
The output should show doh.
(DNS over HTTPS) in the NameHost
section if you set Quad9 in the Network Settings and enabled encryption.
Name Type TTL Section NameHost
+---- ---- --- ------- --------
+proto.on.quad9.net CNAME 60 Answer doh
+
Questions? Issues? Didn't work? Contact us!
+ + + + + + + + + + + + + + + + + +Please follow the steps below to install the Quad9 DNS Profile. Requires iOS 14 or later.
+VPNs, iCloud Private Relay, Little Snitch
+When using iCloud Private Relay, most VPN clients, or Little Snitch, it will not utilize/respect this DNS profile.
+VPN: do not follow these instructions. Instead set Quad9's IP addresses in the Custom DNS
settings of your VPN client. Refer to your VPN client's documentation for further information.
Apple Private Relay: do not follow these instructions. Apple private relay will use its own DNS servers at the system level, with no way to override it.
+DNS over HTTPS is recommended for most users. If the device will frequently connect to guest Wi-Fi and/or networks you do not administrate. HTTPS has a minuscule chance of being blocked on firewalls.
+DNS over TLS is recommended only if the device will mainly connect to Wi-Fi networks you control, or on corporate networks where DNS over TLS is allowed. TLS has a higher chance of being blocked on firewalls.
+nslookup
and dig
The App Store, as well as the dig
and nslookup
commands in a Terminal
do not use encrypted DNS. This is by design.
DNS over TLS
+If connected to a Wi-Fi network which blocks DNS over TLS, which may occur on restrictive network firewalls, you will have to disable the profile or disconnect from the network to regain DNS resolution. This solution does not allow for unencrypted "fallback" behavior. DNS over HTTPS is recommended for most users.
+Profiles expire on January 29th, 2025!
+These profiles are only valid until they expire, at which point, they will automatically disable until a new profile is installed. This is by design of Apple, and there is no way around it.
+Remind yourself to download a new version a few days before they expire by adding a calendar event:
+ +Download one of the profiles here directly using Safari on your iOS device. This will not work if downloaded with a different browser.
+9.9.9.9 (DNSSEC, Threat-Blocking)
+eeabc4e42bd701e0afc74c9da706024e2df40cca38d9ae3f6be92eaa91986db1
6d826edcf0e7f89c32352266896c8aacd96da8074789d1ecf01f9f60fcc63d8d
9.9.9.10 (No DNSSEC, no Threat-Blocking)
+5dc6b70a7e6d0971a6e988c4f46423d4bdbc66f443d6d92f43c3719675304ea7
cde1057b6dc6f61f73963299a22e7bb2eaa17100cdc60e69896c1f132804859c
9.9.9.11 (DNSSEC, Threat-Blocking, with ECS)
+8c9ce407e7032d91252be58c65237d3014710df6622d37d7c0ed40bb80502e70
8126f0187de219a0e9df2e2df104df1ffc0f2efa2af3e6d5c441268b3f6a020d
9.9.9.12 (No DNSSEC, no Threat-Blocking, with ECS)
+79cd0536250e6a1292b318a490057c17d03fd0c90768fad2f999c59b58d89345
fe5943d6ad5dd553cf321e7be251cc6da68db1056ab6d754e581c8ab2e3adbb4
Settings
> Profile Downloaded
and select the Quad9 profile you opened.Install
.Note
+You will receive a warning message warning that your network traffic may be filtered or monitored by the DNS server. While Quad9’s profile can protect your device by filtering potentially malicious traffic, none of your traffic will be logged by Quad9. Please refer to our Privacy Policy for more information.
+Select Install
, then Install
again.
The profile is now installed. Select Done
.
To confirm the installation was successful, visit on.quad9.net
+Questions? Issues? Didn't work? Contact us!
+ + + + + + + + + + + + + + + + + +