back
6 comments
A device that only exposes an IP field can use DDR without extra user configuration, but it still has to implement DDR and an encrypted DNS protocol in the first place...
a lookup for _dns.resolver.arpa, a name reserved for ... asking whether an encrypted version exists, and where it can be reached

Neat! Let's try: nslookup _dns.resolver.arpa

    [mine] unblound.lan can't find _dns.resolver.arpa: Non-existent domain 

    [1.1.1.1] can't find _dns.resolver.arpa: Non-existent domain

    [8.8.8.8] No internal type for both IPv4 and IPv6 Addresses (A+AAAA) 
    records available for _dns.resolver.arpa

    [9.9.9.9] Name:  _dns.resolver.arpa
You have asked the wrong question. This standard does not describe an “A” or “AAAA” record. Use the "-query" option to nslookup(1). Or, use dig(1).

https://datatracker.ietf.org/doc/html/rfc9462#name-discovery...

This is a proposed standard. The reserved domain is very new. Widespread deployment is not expected or mandatory.

> You have asked the wrong question.

I figured it was something like that.

    dig @1.1.1.1 _dns.resolver.arpa SVCB

    ;; ANSWER SECTION:
    _dns.resolver.arpa.     300     IN      SVCB    1 one.one.one.one.
     alpn="h2,h3" port=443 ipv4hint=1.1.1.1,1.0.0.1
      ipv6hint=2606:4700:4700::1111,2606:4700:4700::1001 key7="/dns-query{?dns}"

    _dns.resolver.arpa.     300     IN      SVCB    2 one.one.one.one.
     alpn="dot" port=853 ipv4hint=1.1.1.1,1.0.0.1
      ipv6hint=2606:4700:4700::1111,2606:4700:4700::1001
running my own resolver as system DNS i can confirm apple devices fire _dns.resolver.arpa on every network join, but since verified DDR needs a TLS cert covering the resolver's IP it's effectively public-resolver-only, so for a LAN resolver the right move is just answering NODATA instead of leaking the query upstream.
> since verified DDR needs a TLS cert covering the resolver's IP it's effectively public-resolver-only

Why would you think this? It's trivial to get certs for internal services that mainstream devices trust, they just have to use names from a portion of the public DNS space that you can demonstrate control over. It doesn't actually have to be publicly exposed.