Use DNSCrypt by default in Kicksecure? (not Whonix!)

[nurmagoz]

Its OS feature, and btw windows (optionally) doing it (specially windows 11).

Having it doesnt harm, any app which support it then it gonna support it if not then not, there is no downside to this (app wont be disconnected if it doesnt support DOH/ECH).

So if possible to have it then better to have it.

[Patrick]

If it’s possible + stable + improvement (+ free in effort + free in time) = yes, implement.

Obviously. But the technical details matter and that complexity cannot be brushed away. The topic of DNS security is complex… DNS Security - Kicksecure

dnscrypt-proxy is DNSSEC aware but dnscrypt-proxy at time of writing is DNSSEC non-validating. That I find weird. Therefore the answer for Use DNSCrypt by default in Kicksecure? (not Whonix!) for now is “no”.

When re-purposing this forum thread with a more general open question, “which DNS security improvements should Kicksecure deploy by default” the answer is unresolved too. First…

1. Choose an option.

• recursive, unencrypted, validating, caching
• iterative, encrypted (DoT), validating, caching

[Patrick]

Unbound fails to resolve DNS if the system has IPv6 enabled but IPv6 connectivity is broken

[Patrick]

I split the policy discussion from this and moved it here:

Default DNS Provider Discussion for Kicksecure (not Whonix!)

It’s not a simple as “yeah, enable DNSEC validation” and “yeah, add configuration option DNS_ENCRYPTION=true”, done, call it a day… A) B) Then a specific server needs to be chosen. It’s okay if the user decides to use such a setup and manually sets it up. The user is free to decide to stop using their default ISP’s DNS server and choose a specific one hosted by a specific organisation. But when considering to apply such a change by default for an operating system, which server (speak…