Feature request - Test only encrypted DNS

[JohnK]

Thanks for a very useful tool! One (hopefully easy) tweak that I think would be quite useful is the ability to test DoH and DoT resolvers at once, but not UDP resolvers.

The use-case is that my router, pfSense, happily supports DoH and DOT, and I'm indifferent about which protocol to use. My only requirement is encryption. Currently in DNSBv2, I need to test all DNSs including UDP and then manually filter out the non-encrypted DNSs from the final list. This obviously consumes more time and resources than absolutely required given the use-case.

Thanks, again!
JohnK

 

[Steve]

Hi @JohnK.

What you're looking for IS available, but it requires a bit of customization. If you check under the app's "system menu" by clicking its little red icon in the upper left corner of the app (or you can enter ALT+SPACE when the app has the system's focus). Near the top of that menu you'll find a set of 4 enables. If you disable IPv4 and IPv6, that leaves the two DoH and DoT protocols.

If all of the protocols have already been loaded, the IPv4 and IPv6 resolvers will be skipped and not benchmarked. But these enables are deliberately "sticky" — they will be remembered on your system until they are changed. So, to obtain a cleaner list, simply close and reopen the app and now, with IPv4 and IPv6 already disabled, they will not be loaded into the list.

 

[DanR]

I need to test all DNSs including UDP and then manually filter out the non-encrypted DNSs from the final list. This obviously consumes more time and resources than absolutely required given the use-case.

In addition to what Steve said, click the red icon in the UL corner of the main window to get drop down menu. About half way down there will be: Build (or Re-Build) Custom Nameserver List. Click that. In the window that pops up, check the box for DNSSEC Capable Only. One click and all non-secure are eliminated.

 

[peterblaise]

"... Custom Nameserver List. Click that. In the window that pops up,
check the box for DNSSEC Capable Only. One click and all non-secure
are eliminated ..."

... from that particular Build Custom List results.

NOT from System, NOT from non-System "Default", and NOT from an
INI file, whenever any of those get loaded for testing.

And yet sometimes we also need to Right-click the resulting
Nameserver list and see if any non-DNSSec resolvers made it through
Build Custom List anyway.

The Build Custom list is less thoroughly scrutinizing compared to
Re-Verify Internet Connectivity and initial enumeration and
classification.

In other words, Build Custom List sometimes lets non-DNSSec
through even though we ask to test for DNSSec and exclude
non-DNSSec.

DNS Nameserver resolvers are tricksters.

Hence the plethora of controls.

Let us know what you find, @JohnK.

 

[JohnK]

Hi @JohnK.

What you're looking for IS available, but it requires a bit of customization. If you check under the app's "system menu" by clicking its little red icon in the upper left corner of the app (or you can enter ALT+SPACE when the app has the system's focus). Near the top of that menu you'll find a set of 4 enables. If you disable IPv4 and IPv6, that leaves the two DoH and DoT protocols.

If all of the protocols have already been loaded, the IPv4 and IPv6 resolvers will be skipped and not benchmarked. But these enables are deliberately "sticky" — they will be remembered on your system until they are changed. So, to obtain a cleaner list, simply close and reopen the app and now, with IPv4 and IPv6 already disabled, they will not be loaded into the list.

Thanks very much, Steve. Now that I see the system menu, the way to do what I was looking for is clear. If I may... if may serve the software well to make the menus more apparent. Finding the menus feel more like Easter Eggs than actual software menus. Nonetheless, great software. Thank you for creating it.

 

[JohnK]

"... Custom Nameserver List. Click that. In the window that pops up,
check the box for DNSSEC Capable Only. One click and all non-secure
are eliminated ..."

... from that particular Build Custom List results.

NOT from System, non-System "Default", or an INI, whenever any of
those get loaded for testing.

And yet sometimes we also need to Right-click the resulting
Nameserver list and see if DNSSec made it through Build Custom List
anyway.

The Build Custom list is less thoroughly scrutinizing compared to
Re-Verify Internet Connectivity and initial enumeration and
classification.

In other words, Build Custom List sometimes lets non-DNSSec
through even though we ask to test for DNSSec and exclude
non-DNSSec.

DNS Nameserver resolvers are tricksters.

Hence the plethora of controls.

Let us know what you find, @JohnK.

Thank you @peterblaise. Works like a charm.

 

[Steve]

If I may... if may serve the software well to make the menus more apparent. Finding the menus feel more like Easter Eggs than actual software menus.

I agree, John. The product evolved a lot during the v2 work and that menu was the recipient of all the new stuff. I'm reluctant to make huge changes now, but I'll definitely give it some more thought. Thanks!

 

[PHolder]

make the menus more apparent.

This is MS's fault for messing around with the UI on "new" Windows but leaving old apps alone. The way Steve did it is VERY common for any app coming from Windows 7 and earlier (pre-"Metro" aka Modern Windows UI). Some apps actually show the menu if they have more that one top level, but EVERY app should have a system menu because that is where the things like minimize, maximize, move, and exit are.

 

[Steve]

And, Paul (@PHolder), I also think that the typical Windows user has changed a lot over the years. Some of the original “old school” knowledge of the earlier UI operation has drained out of the Windows-using population. That system menu was a convenient place for me to tuck a few random things ... but as I just posted over in the newsgroup, I do feel that I've stretched it to the breaking point.

 

[raffi]

What would be the Wine user equivalent of the system menu? On macOS running wine, I don't have the little red icon in the top left corner.

Also, hello Steve! I've been a long time follower, but a new user. Thanks for everything that you do.

 

[PHolder]

What would be the Wine user equivalent of the system menu?

There is a Wine configuration to "force" it to show the System Menu instead of (or in addition to) whatever window chrome (the "decorations" on a window on that specific system) would normally override it. However, in any case, Steve is testing an updated version of the app, due out soon, which will use multiple menus and not just the System Menu, and thus it should work fine on Wine in the very near future.

 

[raffi]

Thanks PHolder. I tried to look into winecfg but couldn't find any setting that would allow me to get it to show the system menu. I guess I'll wait and see what the update looks like.

 

[DanR]

I tried to look into winecfg but couldn't find any setting that would allow me to get it to show the system menu

See this: https://grc.com/groups/dns.dev:1487

 

[raffi]

See this: https://grc.com/groups/dns.dev:1487

Oh wow, that worked! So simple. Thank you @DanR. Cheers.