have you put any thought into your DNS
server recently if you haven't then it's
possible that your ISP and anybody else
who can snoop on your internet
connection is aware of all of your DNS
queries which essentially means that
they know every single website that you
are going to there are solutions to this
but you just have to configure them you
see typically on your systems network
settings whether you're using Windows or
Linux your DNS server will be configured
as an automatic use or it might be
configured like this
in Linux to use an address in the 127
range which is a loopback address and
all you need to know without making
things too complicated is that this 127
range address means that this computer
is going to use whatever DNS settings
are configured on your router which is
the same exact thing that the blank
settings here in Windows means and your
router is most likely configured to pull
a DNS server to use from your ISP
because more than likely your ISP
configured your router or really in a
lot of routers that's just how they're
set up is to pull the DNS server from
your ISP and this is where the root of
the problem lies you see your ISP does
not use encrypted DNS servers at least
in America I have yet to find an ISP
that use encrypted DNS servers or QA
minimisation by default and cue name
minimization by the way is this method
of making DNS queries in such a way that
instead of sending our entire URL query
to each domain level when we have a
multi domain URL instead of sending it
to each domain level to resolve the URL
we only send each one the
of data that they need to actually
figure out what this URL is so to
understand how this works let me just
give you a quick breakdown on how DNS
name resolution would work with this
example multi-domain URL so this link
that we have here is joist drawings
tumblr.com dot de that's a mouthful and
just like how it's quite a bit for us to
say it's quite a bit for single DNS
servers to deal with so when your
computer makes a request to this website
at first asks the DNS root where is dot
de so this would route us to the German
servers and if this site only ended in
dot de we wouldn't have to go any
further because the German top-level
domain dot de can resolve all dot de
domains but since we also have this comm
the dot de server has to ask the dot-com
top-level domain which contains tumblr
and then tumblr contains this
non-existent blog within their domain so
without QA minimization each one of
these servers will be queried for the
full domain name which obviously isn't
very good for privacy because all of
these top-level domains log your data so
the German government will have a record
of this domain that you tried to access
the IC a and n will have a record of it
and of course tumblr will have a record
because you're using their service
there's nothing that you can really do
about that even with this query method
but with QA minimization we don't need
to query the first two top-level domains
for the full URL we only have to ask the
root for dot de and we only have to ask
dot de for dot-com de and we only have
to ask dot-com for tumblr and then from
there
blur serves us our page in that way
these servers they only know the minimum
amount of information they need to know
they don't need to know this part here
in black the Deutsch drawings dot tumblr
they only really need to know that
you're asking for de or the.com
so in order to have this feature enabled
we need to first use an encrypted DNS
server on our device that supports QA
minimization instead of the default one
so you could do something as simple as
specify the IP of a server that you want
to use right in here a lot of the time
that is supported and if you aren't sure
of which IP to use which server to use
then I suggest going to the DNS page on
privacy tools dot IO this way you can
look through a bunch of different DNS
providers and then you can see the type
of logging that they do what type of
company they are different protocols
that they support and they also have
these little notifications here for
certain services that you might want to
avoid or just be aware of certain things
that they do that might otherwise be
difficult to find out about these
companies
but most of them do have Kuhn a
minimization most of them do provide DNS
security most of them claim to do very
little or no logging so once you have
that set up to then enable our encrypted
DNS you again could try using the
servers in here but certain ones are not
going to work this way alone on Linux
you may need to use an additional
program called stubby
and with stubby you can install it from
your software manager if you don't feel
comfortable using the terminal or you
could just install it with sudo apt
install stubby on debian based systems
which really you should get comfortable
with using the terminal if you're going
to use Linux and then to configure the
to configure stubby we want to then them
into this file here with an Etsy stubby
stubby dot yml and of course make sure
that you do it as root or use root with
any other text editor so that you can
actually save your edits and then we
want to go to the line with the string
round-robin upstreams
and then you can either comment this out
because this is how it'll be by default
or you could just change it to be zero
and then you want to paste in the DNS
server that you want to use and you
could only use one if you want or if the
DNS provider you choose only offers one
server for you to use currently I'm
gonna be using next DNS so with this
right now I just have the I think this
is the server that does DNS over HTTP
they support I think four in total so
you could have all four of them put in
here and I guess I'll go ahead and show
you guys how that would look it's not
really any different than this
so if we head on over to next DNS setup
page
it shows you all the different ways to
configure it because there are programs
other than stubby that you could use
like you can use DNS mask for example
DNS crypt but you see here these are the
lines that you would put in so show you
how the pattern is set up here so you
can see that this is just one line with
the address data and then you put the IP
address or you would put the ipv6
abbreviated address if you wanted to use
the ipv6 ones and then below it you just
put the TLS authorization name so pretty
simple not too complicated and then you
want to write your changes to this file
here
actually one other thing that I forgot
to mention so you want to also take note
of this listen address so by default the
listen address is going to be that
loopback right one twenty seven dot zero
dot zero dot one you have to then go
back over to your network settings and
make sure that that is listed as your
DNS server because if you don't have
this here then it's not actually going
to proxy over to this address here and
use the encrypted DNS setting so make
sure you set that up then once all that
is set up you can write quit before I
mean there are two different programs so
you know take care of that and then you
can test to see if you have the queue
name minimization enabled by running
this command here
so this is going to do a dig on this
multi uh see it's a multi domain URL and
then it'll just give you this output
here hooray your Q & A minimization is
enabled on your resolver so we got that
part figured out and then to test our
encryption we can check it against cloud
fares encrypted DNS checker so we'll go
over to that this is the URL right up
here and I'll be sure to leave this
inside of the description as well as the
commands that you need to run all that
good stuff is always send click on check
my browser
that actually ran pretty fast so you can
see here that we got DNS SEC we're using
the latest version of TLS 1.3 we also
have the encrypted SNI now with secure
DNS this isn't going to be checked
unless you're actually using 1.1 1.1 as
your dns server configured in here or
configured in stubby if you're gonna use
that instead and I really don't
recommend using that because this DNS
server is actually owned by cloud fair
and the concerning thing about cloud
fair is that their content delivery
network is quite large and if cloud fair
if cloud flare ever decides to stop
serving a website like they did with a
Chan and the daily stormer then that
website will effectively be taken down
now maybe you don't agree with the
messages of those sites but if you look
into the full thread of why CloudFlare
stopped supporting those sites they were
basically pressured into doing it by the
ADL and the SPLC both of which are
essentially anti-free speech
organizations that are disguised as anti
hate organizations so that they can get
support for normies from normies and
continue to try and dominate the free
market of ideas you see the Internet
itself is built upon free speech it's
the foundation and if you remove that
foundation from this structure it's
going to become something that you don't
want to live in which is part of the
reason why I advocate for free and open
source software and decentralize
computing because if we allow small
groups of people to have a monopoly on
control and power then they're going to
abuse that control they're going to
abuse that power but enough about
politics as you can see here my DNS is
encrypted the settings here might not be
set this encrypted s/n I'm because this
is more of a browser dependent thing I
don't think that Chrome based browser
even support encrypted sni but firefox
does and there's another video that i'm
going to make about firefox so I'll
probably just cover how to configure
this in that video but that's it for
this one guys I hope that it was helpful
if it was be sure to share the video so
that you can help others leave a like
subscribe and take the notification bell
peace out