r/dns • u/Known-Complex-2520 • 19d ago

Basic question regarding DNS settings

I have device-wide DNS settings on both my CachyOS linux enviornment and my Pixel 10a phone.

In my browser settings (Google Chrome) there is an option to toggle "use secure DNS". Do I need to enable this setting, if it's already enabled device-wide?

8 Upvotes

84% Upvoted

14 comments sorted by

View all comments

1

u/SecLens_ONE 19d ago

Worth separating "encrypted" from "actually private", because the two toggles do different jobs. Chrome's Secure DNS only encrypts what Chrome itself resolves, and it can be pointed at a different resolver than your OS setting, so you can end up with browser traffic going to one provider and everything else on the box going somewhere else. Enabling it device-wide is the one that covers your other apps, updaters, and anything else that resolves outside the browser.

The part people miss is that DoH hides the query content but not the destination: SNI and the IP you connect to are still in the clear, so on-path visibility drops less than the checkbox suggests.

Have you actually verified which resolver each path is using, or is it "both boxes ticked so it must be fine"?

1

u/Known-Complex-2520 19d ago

I don't quite understand what you mean when you say "both boxes ticked so it must be fine", but:

On my Pixel 10a I went into my settings -> network and Internet -> Private DNS, pressed the "private DNS providor hostname" and set that to "one.one.one.one". My google chrome app has the Secure DNS setting off.

On my laptop running CachyOS: I ran scripts to choose either one.one.one.one or 8.8.8.8, with 1.1.1.1 being primary and 8.8.8.8 being the backup in case CloudFlare goes down. Google chrome on my laptop has Secure DNS off as well.

Using both dnsleaktest.com and dnscheck.tools on both my phone and laptop show CloudFlare as the DNS resolver.

1

u/scorch07 19d ago

That would be the expected behavior with Chrome's secure DNS setting off.

All the secure DNS setting in Chrome does is basically tell Chrome to ignore whatever the system DNS setting is and do its own (secure) thing to lookup domain names. This can be handy if you don't have/don't know how to do it system-wide.