Advice Request Are you using DNS over HTTPS? - Test using Cloudflare Browsing Security Check

[Brahman]

Now that windows and most browsers supports dns over https how many of you are using dns over https? If you are using firefox you can enable Encrypted SNI by using this guide

1. In your browser, navigate to about:config;
   [*]Type network.security.esni.enabled
   [*]Select the toggle button to the right of false to true

If you want to check whether you are using secure dns, DNSSEC, TLS 1.3 and Encrypted SNI you can visit Cloudflare ESNI Checker | Cloudflare and test your browser accordingly.

My test on firefox....

 

[cliffspab]

Only works if you're using Cloudflare DNS.

 

[SeriousHoax]

Only works if you're using Cloudflare DNS.

It works for all DoH supported DNS but that website only shows secure DNS status for Cloudflare DNS because it's owned by Cloudflare

 

[Brahman]

It works for all DoH supported DNS but that website only shows secure DNS status for Cloudflare DNS because it's owned by Cloudflare

Encrypted sni feature only works with firefox and with cloudflare dns as this is a standard pioneerd by cloudflare.

 

[cliffspab]

It works for all DoH supported DNS but that website only shows secure DNS status for Cloudflare DNS because it's owned by Cloudflare

Ah sorry, I didn't see the bit about Firefox at the top

I was just referring to the website, which is only useful if you choose cloudflare.

NextDNS, which I use, also confirms via their dashboard whether you're set up right.

 

[SeriousHoax]

Encrypted sni feature only works with firefox and with cloudflare dns as this is a standard pioneerd by cloudflare.

Hmm I know about that as I use Firefox myself. But the first one on that list Secure DNS is not related to ESNI and only shows secured if you use Cloudflare.

Ah sorry, I didn't see the bit about Firefox at the top

I was just referring to the website, which is only useful if you choose cloudflare.

NextDNS, which I use, also confirms via their dashboard whether you're set up right.

Right. But there needs to be another website where everyone can check their DoH/DOT status regardless of the provider.

 

[Brahman]

But there needs to be another website where everyone can check their DoH/DOT status regardless of the provider.

Ya I feel too. Are there nothing? Strange!
A self check can be done if you are using windows 10 by observing traffic at Port 53.

How to check whether DNS over HTTPS is working properly

As we wrote about yesterday, with build 19628 Microsoft has added support for DNS over HTTPS to Windows 10. DoH is a great way to increase privacy and security online, and its arrival in Windows 10 has been widely welcomed.

betanews.com

 

[cliffspab]

Right. But there needs to be another website where everyone can check their DoH/DOT status regardless of the provider.

Yep, I totally agree

 

[SeriousHoax]

Ya I feel too. Are there nothing? Strange!
A self check can be done if you are using windows 10 by observing traffic at Port 53.

How to check whether DNS over HTTPS is working properly

As we wrote about yesterday, with build 19628 Microsoft has added support for DNS over HTTPS to Windows 10. DoH is a great way to increase privacy and security online, and its arrival in Windows 10 has been widely welcomed.

betanews.com

I saw this article few days ago when searching for something alternative to the cloudflare testing website. But this method works for system wide DoH only. It's not possible to check it on browser level. MS has implemented DoH on insider preview and there are tools like SimpleDnsCrypt for easily implementing DoH system wide so the method above would work in those scenarios.

 

[TairikuOkami]

Ya I feel too. Are there nothing? Strange!

I guess, that is the general idea, if it is secured, it can not be checked, that would be like MITM. Tenta test can show, if DoT is enabled and that is about it.

Browser Privacy - Test IP address, DNS, VPN leaks. Fast & no ads. Protect your online privacy.

Test your browser for data leaks, such as IP address, advanced DNS test, WebRTC leak test, IP geolocation, http headers and device information. Designed for mobile and desktop.

tenta.com

I can check, if DNS requests are being sent via the expected port and hope, that it is encrypted.

 

[Brahman]

I saw this article few days ago when searching for something alternative to the cloudflare testing website. But this method works for system wide DoH only. It's not possible to check it on browser level. MS has implemented DoH on insider preview and there are tools like SimpleDnsCrypt for easily implementing DoH system wide so the method above would work in those scenarios.

Doh system wide can be enabled via registry editor in 2004 edition.

 

[TairikuOkami]

Doh system wide can be enabled via registry editor in 2004 edition.

Is not it available only since the next version, build 196xx?

 

[oldschool]

If you use Adguard DNS you may test here Adguard DNS

 

[bayasdev]

Yes, DoH at the router level

 

[Brahman]

Yes, DoH at the router level

View attachment 241817

View attachment 241818

Which router are you using?

 

[bayasdev]

Which router are you using?

Mikrotik hap ac2 with beta 6.47 firmware

 

[SeriousHoax]

Doh system wide can be enabled via registry editor in 2004 edition.

Is not it available only since the next version, build 196xx?

Right, build 19628 is required at least. Current build with Windows 10 2004 is, 19041.264.

If you use Adguard DNS you may test here Adguard DNS

I know about it too but this doesn't show the DoH/DoT status

Yes, DoH at the router level

View attachment 241817

View attachment 241818

My poor router don't have this feature.

 

[Brahman]

Right, build 19628 is required at least. Current build with Windows 10 2004 is, 190041.264.

My bad....

 

[Brahman]

DNS filtering comparison.

 

[blackice]

I’ve seen a couple recent tests showing Quad9 performing better than they did early on. Which is nice since they are the fastest dns for my location. Just a small perk.