Use DNSCrypt by default in Kicksecure? (not Whonix!)

[Patrick]

Excellent analysis, which I wholeheartedly agree with.

As distribution default:
Yes, let’s go for the feature, which can be implemented reasonably reliably. And indeed, let’s not pick a specific third-party DNS provider or invent a complex user interface.

@arraybolt3

Fully effective privacy is also impossible unless you bring Tor into the picture. Either everyone can read your DNS traffic, or a third-party who may very well be a tattletale can read your DNS traffic. If you route all your DNS over Tor, you can mitigate that, but that’s about the only way to do it.

Right. So DNS won’t be torified by default in Kicksecure. As per:

Privacy Goals and Non-Goals of Kicksecure

@arraybolt3

With all of the above in mind, I think the option to go with “recursive, unencrypted, validating, caching” is the clear winner.

Yes.

The decision is made.

@arraybolt3

Now, pivoting to the technical side of things, how do we actually get DNSSEC validation working? Unbound seems to be the only server that actually does the right thing here for some weird reason, but it has severe issues when IPv6 is supposedly available but isn’t really.

Right. Next step is implementation. The only blocker now is either getting unbound fixed, finding another secure, capable DNS resolver, if one exists or some other workaround to make unbound reliable as you suggested.