Maybe future feature request: DNS Stamps (DoH/DoT) possible?

[pictosun]

Hi,

maybe this is something in a future release of your DNS servers. It would be nice to see here DNS Stamps, so that we can integrate it into UniFi, pfSense, OPNsense and other systems.

Don't know, how hard it is to implement - but overall this could be a nice addition.

[hagezi]

Instructions: https://adguard-dns.io/kb/miscellaneous/create-dns-stamp/
The stamps must be recreated each time a Let's Encrypt certificate is renewed.

[DNSBunker]

@hagezi thats not correct. SDNS Stamps can be gereated without cert hash and remain valid. It matters for dnscrypt tools only.

https://dnscrypt.info/stamps/

[hagezi]

Yes, that's clear, but if I offer a stamp, it should also work in DNScrypt. Does it work without certificate pinning?

[DNSBunker]

@hagezi it does, there is an option to validate the certificate. It is not mandatory though.
Adguard home users for example profit with sdns stamps, bacause it contains all informations for setting up an upstream.

The hash feature is to ensure, destination sni has not be tampered

[pictosun]

Thanks for implementing it.