Securing DNS Queries using Stubby (DNS over TLS) and DNSMASQ (DNS cache)

stubby installation and setup

By default DNS traffic is insecure and runs unencrypted over port 53. Here you'll find detailed instructions about how to configure your Linux system with Stubby DNS resolver in the DNS over TLS mode and also how to configure dnsmasq as a caching DNS server.

It's relevant for Linux Mint Cinnamon, XFCE and Mate 19 and later, Xubuntu, Ubuntu 18.04 and later, Debian 10 (Buster) and later, and other distributions with Stubby in its repositories. Otherwise you need to compile Stubby from source.

[1]
Enter in the terminal:

sudo apt install stubby

[2]
Verify the status of the installed service:

systemctl status stubby

[3]
Verify that stubby is listening on TCP and UDP ports both on IPv4 and IPv6:

sudo netstat -lnptu | grep stubby

If the netstat command is not found in your system, install net-tools:

sudo apt install net-tools

[4]
Do NOT edit /etc/resolve.conf file to change the name server - leave it in its original state.
Note: /etc/resolve.conf may be a symbolic link to the file /run/NetworkManager/resolv.conf, generated by NetworkManager.

[5]
Click the Network Manager icon on the upper-right corner and select Network settings. Then click Wired settings icon (i.e. your current network).
Select IPv4 tab.
To prevent the system from getting DNS server address from your router, switch DNS Automatic button to OFF.
Enter 127.0.0.1 in the DNS field and click Apply button.

Repeat the same for all working Wi-Fi connections.

Note for Linux Mint XFCE and MATE : On the IPv4 tab set DHCP Method: to Automatic (DHCP) addresses only

[6]

Restart NetworkManager

sudo systemctl restart NetworkManager

[7]
Check Network Settings. You'd see that DNS is 127.0.0.1

Stubby should spread the DNS queries among several DNS Privacy test servers, dnsovertls.sinodun.com, dnsovertls1.sinodun.com and getdnsapi.net, provided in the the default configuration file stubby.yml. Note that this file contains both IPv4 and IPv6 addresses. For the sake of this post, IPv6 was set to OFF in the NetworkManger settings.

[8]
Edit the stubby.yml configuration file to add the DNS server that you want to use. 

sudo nano /etc/stubby/stubby.yml

Go to the line upstream_recursive_servers: and add the following after this line and above other DNS servers:

For Cloudflare DNS over TLS server:

#CloudFlare servers
- address_data: 1.1.1.1
tls_auth_name: "cloudflare-dns.com"
- address_data: 1.0.0.1
tls_auth_name: "cloudflare-dns.com"
#

For Google DNS over TLS server:

# Google
- address_data: 8.8.8.8
tls_auth_name: "dns.google"
- address_data: 8.8.4.4
tls_auth_name: "dns.google"
#

Note: The code copied from Blogspot pages can be corrupted (in spite of the code tag). Double-check copy-paste result. Anyway you can find these Cloudflare and Google lines further down in the stubby.yml commented out. Just move them up and remove the #.

Then change the line:
round_robin_upstreams: 1
to
round_robin_upstreams: 0

Save the file stubby.yml.
If round_robin_upstreams option set to '1' the servers are loadbalanced, if round_robin_upstreams set to '0' only the first DNS server is used.

[9]
Restart stubby:

sudo systemctl restart stubby

Cloudflare test page:
https://www.cloudflare.com/ssl/encrypted-sni/

[10]
To be sure we are using port 853 and DNS server 1.1.1.1 install Wireshark

sudo apt install wireshark
sudo adduser your_user_name wireshark

Log out and log in to apply the changes.
Start Wireshark, select curent network interface, enter "port 853" in the filter field and click the left icon on the toolbar to start the capture.
A quick test can be done by using dig. Enter in the terminal:

dig A linuxmint.com

You can see in the Wireshark main window that request and answer are encrypted and we are using server 1.1.1.1 and port 853:

[11]
All is working now and you can set up the DNS cache by installing and configuring a separate dns cacher, if any.

---

dnsmasq installation and setup

[1]
sudo apt install dnsmasq

[2]
sudo nano /etc/default/dnsmasq

Verify these two lines and save the file:

ENABLED=1
IGNORE_RESOLVCONF=yes

[3]
sudo cp /etc/dnsmasq.conf /etc/dnsmasq.conf.orig

sudo nano /etc/dnsmasq.conf

Delete the content of  dnsmasq.conf and insert in it these lines:

#
# Configuration file for dnsmasq acting as a caching nameserver.
#
# no-hosts = to ignore /etc/hosts
#
no-hosts
#
# no-resolv = not to use /etc/resolv.conf
# no-resolv
server=127.0.0.1#53000
listen-address=127.0.0.1
interface=lo
bind-interfaces

[4]
sudo nano /etc/stubby/stubby.yml

Change two lines under listen_addressesand save the file:

before:
listen_addresses:
  - 127.0.0.1
  -  0::1

after:
listen_addresses:
- 127.0.0.1@53000
- 0::1@53000

[5]
sudo systemctl restart stubby.service

[6]
sudo systemctl restart dnsmasq.service


[TEST]
Enter the command:

dig A wireshark.com

Repeat the command:

dig A wireshark.com

Note Query times: 12 msec and 0 msec