However, you could use alternative DNS revolvers with these applications when deconfiguring socks proxy settings.įor example, Tor Browser would be unaffected by these changes alone. Another reason is, that many applications do not yet make use of authenticated DNS (DNSSEC).This is because applications in Whonix ™ are configured to use SocksPort instead of Trans- or DnsPort, see Stream Isolation for details.

Note that most applications, such as Tor Browser, will not automatically profit from setting up an alternative DNS resolver. All traffic originating from Whonix-Workstation ™ and Whonix-Gateway ™ is routed over Tor.Difference between encryption and authentication.This gets even worse, when you additionally tunnel the DNS request through an additional proxy (for example: Tor → JonDonym → DNS server). Sometimes Tor or the DNS server causes a timeout. Note, that even if you correctly set up all settings, it might happen that this won't work. Using a permanent DNS server is recommended against just as using a permanent Tor exit relay is recommended against. That would add too much power to a single DNS server. Although it is technically possible to completely replace DNS resolution (not using Tor for DNS resolution anymore), it is recommended against. It is recommended against to use non-Tor DNS resolvers for an extended amount of time. This may also be useful, in special cases if you want to resolve types of DNS over Tor, which are unsupported by Tor itself, such as MX, SRV or DNSSEC. If you suspect a Tor exit relay to tamper with DNS, you can get a second opinion from another non-Tor DNS server. 3.5.3 Does DNSCrypt on the Host or Router Harm Anonymity when Using Tor / Whonix ™?īy Whonix ™ default, Tor is used for DNS resolution.3.5.2 Can I Use DNSCrypt on the Host or Router for Clearnet?.

3.5.1 Why not Use DNSCrypt by Default in Whonix ™?.

2 Recursive Authenticated DNSSEC over Tor.

How to download opendns dnscrypt