DNS

This article presents a simple and reliable solution to flexibly configure Unbound with interfaces that may not exist when Unbound starts. The setup described below is based on my home server Unbound installation but should work well in other scenarios, too.

This article explains how to set up the Unbound DNS server as the resolver for your home network. It also shows how to generate and assign a static IPv6 address to your Proxmox server. This post is part of my series on home automation, networking & self-hosting that shows how to install, configure, and run a home server & network with dockerized or virtualized services.

DNS is a protocol that lends itself to abuse because it’s largely unmonitored and unrestricted. This article explains how data exfiltration from a corporate network via DNS works and shows how to set up a working exfiltration demo with DNSteal.

This post explains how to configure DNS over HTTPS (DoH) for all WiFi networks in Windows 11 via the Settings app. Unfortunately, this is less intuitive than it should be; I need a reminder every time I connect to the German railway’s WiFiOnIce, which only seems to work with Deutsche Bahn’s (insecure) DNS server (you can switch to more secure DNS servers once you’ve accepted the terms on their captive portal).

This article is for you if you want to improve privacy and block ads on all devices on your network without installing any software, simply by configuring a modern DNS service, yet with the ability to override settings for individual sites, and with nice dashboards thrown in for good measure.

Tools that monitor network traffic typically work with IP addresses, not server names. Humans, on the other hand, seem to prefer names over cryptic numbers. Most tools deal with that by doing reverse lookups of the IP addresses, i.e. they are looking for DNS PTR records. The result of such a lookup, however, is not always what you expect. Let us look at a simple example:

Choosing a domain name that will only be visible from an internal network may look simple. Unfortunately, it is not. The basic problem: How to avoid collisions between the internal namespace and the internet?