ECH Support

[zbugrkx]

Hi,

The readme.md does not mention if there is or isn't support for ECH on any of the HageZi DNS servers.

I was also unable to find that information anywhere.

Would it be possible to get this clarified ?

Thanks

Regards

[DNSBunker]

@zbugrkx are you asking for tlsa records on hagezi.org?

Example:

{
  "Metadata": {
    "NameServer": "dnsbunker.org:853 (27.123.245.130)",
    "Protocol": "Quic",
    "DatagramSize": "99 bytes",
    "RoundTripTime": "161.45 ms"
  },
  "EDNS": {
    "UdpPayloadSize": 1232,
    "ExtendedRCODE": "NoError",
    "Version": 0,
    "Flags": "None",
    "Options": []
  },
  "Identifier": 0,
  "IsResponse": true,
  "OPCODE": "StandardQuery",
  "AuthoritativeAnswer": false,
  "Truncation": false,
  "RecursionDesired": true,
  "RecursionAvailable": true,
  "Z": 0,
  "AuthenticData": false,
  "CheckingDisabled": false,
  "RCODE": "NoError",
  "QDCOUNT": 1,
  "ANCOUNT": 1,
  "NSCOUNT": 0,
  "ARCOUNT": 1,
  "Question": [
    {
      "Name": "_443._tcp.dnsbunker.org",
      "Type": "TLSA",
      "Class": "IN"
    }
  ],
  "Answer": [
    {
      "Name": "_443._tcp.dnsbunker.org",
      "Type": "TLSA",
      "Class": "IN",
      "TTL": "3600 (1h)",
      "RDLENGTH": "35 bytes",
      "RDATA": {
        "CertificateUsage": "DANE_EE",
        "Selector": "SPKI",
        "MatchingType": "SHA2_256",
        "CertificateAssociationData": "EFA17BC97C1DD1FF217EAB3D3EE90EFB9BFFE62223BD80CA18DA1F971CEE2A00"
      },
      "DnssecStatus": "Disabled"
    }
  ],
  "Authority": [],
  "Additional": [
    {
      "Name": "",
      "Type": "OPT",
      "Class": "1232",
      "TTL": "0 (0s)",
      "RDLENGTH": "0 bytes",
      "RDATA": {
        "Options": []
      },
      "DnssecStatus": "Disabled"
    }
  ]
}

[hagezi]

No, but I was a bit confused at first as well. What he means is support for Encrypted Client Hello (ECH) improves privacy by hiding the requested hostname during connection setup.

However, the Technitium web server does not support ECH and therefore cannot provide the required ECH configuration (such as the key or configuration blob).

As a result, ECH is not supported in this case.

[hagezi]

I just found a note saying that Technitium does support ECH after all; test it via root.hagezi.org: https://defo.ie/ech-check.php

[hagezi]

Sorry, after all the back-and-forth:

ECH is supported.

[zbugrkx]

Thanks a ton! no worries, I should have been a bit more clear!

[hagezi]

What I “overlooked”:

What you can't do: Determine directly from a response from https://root.hagezi.org/dns-query whether ECH is being used, because ECH takes place at the TLS level and the actual HTTP(S) communication is already occurring within an established, encrypted channel.

[DNSBunker]

I just found a note saying that Technitium does support ECH after all; test it via root.hagezi.org: https://defo.ie/ech-check.php

I think that is a browser thing, not dns resolver

[hagezi]

DoH/DoT must be used in your browser, and the DNS resolver you use must provide the appropriate HTTPS/ECH information. In addition, the website you visit must have ECH enabled; otherwise, ECH will remain disabled.