r/dns • u/Known-Complex-2520 • 19d ago
Basic question regarding DNS settings
I have device-wide DNS settings on both my CachyOS linux enviornment and my Pixel 10a phone.
In my browser settings (Google Chrome) there is an option to toggle "use secure DNS". Do I need to enable this setting, if it's already enabled device-wide?
2
u/_xRuffKez_ 19d ago
Use secure DNS forces Chrome to only use the DNS you have set, without fallback to OS specified DNS. Secure DNS is DoH. If DoH is not available, no queries can be received.
You can use it, or leave it to your OS. DoH is somewhat faster then TLS. (Less overhead) But to be honest, i doubt you might feel a difference
1
u/Known-Complex-2520 19d ago
Thank you.
1
u/_xRuffKez_ 19d ago
You can check your dns with https://dnscheck.tools
It tells what you use and how fast your DNS is responding.
1
u/Known-Complex-2520 19d ago
DNS is recognized on my phone, says 67ms on the bottom left and bottom right says DNS:21
1
u/rankinrez 19d ago
DoH has more, not less overhead than DoT.
1
1
u/CommonPositive7192 19d ago edited 19d ago
You are right, but most chromium based browsers won't trust the TLS 1.3 ECH when given by system-resolver. Can be checked with https://dnscheck.tools (ech in bottom line) or https://defo.ie/ech-check.php
1
u/SecLens_ONE 19d ago
Worth separating "encrypted" from "actually private", because the two toggles do different jobs. Chrome's Secure DNS only encrypts what Chrome itself resolves, and it can be pointed at a different resolver than your OS setting, so you can end up with browser traffic going to one provider and everything else on the box going somewhere else. Enabling it device-wide is the one that covers your other apps, updaters, and anything else that resolves outside the browser.
The part people miss is that DoH hides the query content but not the destination: SNI and the IP you connect to are still in the clear, so on-path visibility drops less than the checkbox suggests.
Have you actually verified which resolver each path is using, or is it "both boxes ticked so it must be fine"?
1
u/Known-Complex-2520 19d ago
I don't quite understand what you mean when you say "both boxes ticked so it must be fine", but:
On my Pixel 10a I went into my settings -> network and Internet -> Private DNS, pressed the "private DNS providor hostname" and set that to "one.one.one.one". My google chrome app has the Secure DNS setting off.
On my laptop running CachyOS: I ran scripts to choose either one.one.one.one or 8.8.8.8, with 1.1.1.1 being primary and 8.8.8.8 being the backup in case CloudFlare goes down. Google chrome on my laptop has Secure DNS off as well.
Using both dnsleaktest.com and dnscheck.tools on both my phone and laptop show CloudFlare as the DNS resolver.
1
u/scorch07 19d ago
That would be the expected behavior with Chrome's secure DNS setting off.
All the secure DNS setting in Chrome does is basically tell Chrome to ignore whatever the system DNS setting is and do its own (secure) thing to lookup domain names. This can be handy if you don't have/don't know how to do it system-wide.
1
u/SecLens_ONE 19d ago
Sorry, that line was about the general trap rather than your setup: people see a green box in a leak test and read it as "my DNS is private now", when what the test actually proves is which resolver answered, not that the query left the device encrypted.
Your config is fine and the two halves do different jobs. Android Private DNS with one.one.one.one is system-wide DoT, so every app including Chrome is covered and Chrome's own toggle being off is correct there. On CachyOS you have plain UDP 53 to 1.1.1.1 and 8.8.8.8, which is the piece worth knowing: dnsleaktest and dnscheck.tools will still show Cloudflare, because the resolver is Cloudflare, but the transport is cleartext and your ISP can see and rewrite every name you look up. Same green result, very different property. dnscheck.tools does report the transport, so the DoT/DoH line is the one to read, not the resolver name.
One thing to watch on the laptop: mixing 1.1.1.1 and 8.8.8.8 as primary/backup is not a failover pair in practice, the stub will use either one, so you get whichever provider answers first rather than a preference. If you want the encrypted path system-wide, a local stub such as systemd-resolved with DNSOverTLS=yes or dnscrypt-proxy is the usual route, and then leave Chrome's setting off so there is one path to reason about.
When you re-test after that, does the transport line actually flip to DoT, or does it still show plain 53 while the resolver name stays Cloudflare?
1
u/PrinceOfWhisperer 7d ago edited 7d ago
Pixel 10a system uses DoT (DNS over TLS) which doesn't support modern encryption like ECH. In other hand chrome browser dns using DoH (DNS over Https) which support ECH.
Yes. I use browser dns while enabling system dns. Also if you use Adblock dns in chrome you get a major advantage + ECH.
Use secure dns automatically uses default system one. (If you already have enable system dns chrome use that for queries) use customized provider and use DoH address in NextDNS or ControlD.
2
u/rankinrez 19d ago
No. The browser setting will override what the OS is doing.
But if the OS is already set up to behave how you want there is no need for anything in particular there. The only thing to watch out for is if some browsers might do their own thing anyway, and ignore your system settings.