* * deny — ~/lab/dns-leak

What a DNS query leaks

The connection you make after the lookup is fully encrypted. The lookup itself, by default, is not — the hostname sits in the packet as plain ASCII, and you can read it with a hex viewer. Build the query below, then switch the transport and watch which observers lose the name. One of them never does. Everything is simulated in this tab: no name is resolved, nothing is sent anywhere.

terms, quickly

Five words this lab uses, in case any of them are new. Skip if not.

  • stub resolver — the small piece of your operating system that applications ask when they need a name resolved. It does not do the work itself; it asks a recursive resolver and caches the answer.
  • recursive resolver — the server your device is configured to ask. It chases the answer down for you, from the root to the top-level domain to the servers that hold the record, and hands back the result. This is the thing DoH and DoT encrypt the path to.
  • authoritative server — the server that actually holds the records for a domain. It is the end of the chain and the source of truth for that zone.
  • QNAME — the query name: the field in a DNS packet that holds the hostname you are asking about. It is stored as length-prefixed labels, which is a formatting choice, not a security one. It is not encoded, hashed or hidden.
  • Do53 / DoT / DoH — the three ways to carry that packet. Plain DNS on port 53, DNS over TLS on port 853, DNS over HTTPS on port 443. Same message inside all three.
transport

Flip the transport and re-run to compare. The query bytes are encoded from the RFC 1035 wire format, the addresses come from the ranges reserved for documentation, and the resolver is an invented name — this lab has no opinion about whose resolver you should use, and names none of them. The ciphertext in the encrypted modes is deterministic filler standing in for a real record body. For a real capture, use Wireshark.

The caveats

Encrypted DNS is worth turning on. It is also the single easiest thing on this site to overstate, so these are here to keep the demo above honest.

Where this comes from

Protocol behavior, not any vendor's implementation. The wire format below is the one every DNS implementation speaks.

Related

This is the first layer a request passes through. The next one is TLS — what TLS inspection actually sees picks up exactly where this lab stops, with the same hostname going out in the clear again in the handshake. On the routing side, the PAC file tester covers how a browser decides where to send the connection in the first place, and the PAC mistakes post gets into dnsResolve, which is this lab's subject wearing a different hat.