{"id":10263,"date":"2023-02-27T20:31:00","date_gmt":"2023-02-27T19:31:00","guid":{"rendered":"https:\/\/monodes.com\/predaelli\/?p=10263"},"modified":"2023-02-27T08:32:22","modified_gmt":"2023-02-27T07:32:22","slug":"knot-dns","status":"publish","type":"post","link":"https:\/\/monodes.com\/predaelli\/2023\/02\/27\/knot-dns\/","title":{"rendered":"Knot DNS"},"content":{"rendered":"

I’ve just read the interesing “Replace PowerDNS by Knot DNS and Knot Resolver+supervisor with DNSSEC, DNS over TLS and domain name spoofing<\/a>” from ….<\/em><\/p>\n

I didn’t knew KnotDNS<\/a>. It may be a wiser choice than MaraDNS<\/p>\n

<\/p>\n

\n
\n

Replace PowerDNS by Knot DNS and Knot Resolver+supervisor with DNSSEC, DNS over TLS and domain name spoofing<\/h1>\n
<\/i>yeupou<\/a><\/span><\/span><\/i>1 Comment<\/a><\/span><\/div>\n<\/header>\n
\n

I was considering using Knot DNS since a while<\/a>. Switching to DNS over TLS for the resolver queries was the push needed. Turns out that transposing my setup with Knot DNS is very easy and fast.<\/p>\n

Knot Resolver does not provide init scripts and suggests to use supervisor as an alternative to systemd omnipresent features. Wary with this idea, turns out that supervisor<\/a> is very easy to put in place and I might use it more, replace some xinetd, in the future.<\/p>\n

For the record, my setup is as follow: there is a local DNS server to serve the local area network HERE.ici domain and is a resolver that cache requests. All requests are sent to the resolver and this one, if he cannot answer, then ask the relevant DNS server. Nothing too fancy, even if sometimes LAN are set up the other way around, where people query the local DNS server by default and this one query the local resolver if he can\u2019t answer.<\/p>\n

Install require the following:<\/p>\n

\n
\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n<\/td>\n
\n
\n
apt <\/code>install<\/code> knot<\/code>\/testing<\/code><\/div>\n
apt <\/code>install<\/code> knot-resolver supervisor<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n

DNS for the local area network<\/h2>\n

The Knot DNS server will not be queried directly but by the Knot Resolver and DHCPd. Edit \/etc\/knot\/knot.conf by adding:<\/p>\n

\n
\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n
16<\/div>\n
17<\/div>\n
18<\/div>\n
19<\/div>\n<\/td>\n
\n
\n
server:<\/code><\/div>\n
    <\/code># meant to be called only on loopback<\/code><\/div>\n
    <\/code># by knot-resolver and dhcpd on update<\/code><\/div>\n
    <\/code>listen: 127.0.1.1@53<\/code><\/div>\n
<\/div>\n
acl:<\/code><\/div>\n
  <\/code>- id: update_acl<\/code><\/div>\n
    <\/code># restrict by IP is enough, no need for a ddns key stored on the same host<\/code><\/div>\n
    <\/code>address: 127.0.0.1<\/code><\/div>\n
    <\/code>action: update<\/code><\/div>\n
<\/div>\n
zone:<\/code><\/div>\n
  <\/code>- domain: HERE.ici<\/code><\/div>\n
    <\/code>dnssec-signing: on<\/code><\/div>\n
    <\/code>acl: update_acl<\/code><\/div>\n
<\/div>\n
  <\/code>- domain: 10.in-addr.arpa<\/code><\/div>\n
    <\/code>dnssec-signing: on<\/code><\/div>\n
    <\/code>acl: update_acl<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n

Create the zones (edit serverhostname and HERE.ici according to your setup):<\/p>\n

\n
\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n
16<\/div>\n<\/td>\n
\n
\n
invoke-rc.d knot restart<\/code><\/div>\n
<\/div>\n
knotc zone-begin HERE.ici<\/code><\/div>\n
knotc zone-<\/code>set<\/code> HERE.ici @ 7200 SOA serverhostname hostmaster 1 86400 900 691200 3600<\/code><\/div>\n
knotc zone-<\/code>set<\/code> HERE.ici serverhostname 3600 A 10.10.10.1<\/code><\/div>\n
knotc zone-<\/code>set<\/code> HERE.ici @ 3600 NS serverhostname<\/code><\/div>\n
knotc zone-<\/code>set<\/code> HERE.ici @ 3600 MX 10 mx.HERE.ici<\/code><\/div>\n
knotc zone-<\/code>set<\/code> HERE.ici jeden 3600 CNAME serverhostname<\/code><\/div>\n
knotc zone-commit HERE.ici<\/code><\/div>\n
<\/div>\n
knotc zone-begin 10.<\/code>in<\/code>-addr.arpa<\/code><\/div>\n
knotc zone-<\/code>set<\/code> 10.<\/code>in<\/code>-addr.arpa @ 7200 SOA serverhostname.HERE.ici. hostmaster.HERE.ici. 1 86400 900 691<\/code><\/div>\n
200 3600<\/code><\/div>\n
knotc zone-<\/code>set<\/code> 10.<\/code>in<\/code>-addr.arpa 10.10.10.1 3600 PTR serverhostname<\/code><\/div>\n
knotc zone-<\/code>set<\/code> 10.<\/code>in<\/code>-addr.arpa @ 3600 NS serverhostname.HERE.ici.<\/code><\/div>\n
knotc zone-commit 10.<\/code>in<\/code>-addr.arpa<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n

Zone will to be updated by the DHCP server, in this case ISC dhcpd. Edit \/etc\/dhcp\/dhcpd.conf accordingly:<\/p>\n

\n
\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n
16<\/div>\n
17<\/div>\n
18<\/div>\n
19<\/div>\n
20<\/div>\n
21<\/div>\n
22<\/div>\n
23<\/div>\n
24<\/div>\n
25<\/div>\n<\/td>\n
\n
\n
# dynamic update<\/code><\/div>\n
ddns-updates on;<\/code><\/div>\n
ddns-update-style standard;<\/code><\/div>\n
ignore client-updates; <\/code># restrict to domain name<\/code><\/div>\n
<\/div>\n
# option definitions common to all supported networks...<\/code><\/div>\n
option domain-name <\/code>"HERE.ici"<\/code>;<\/code><\/div>\n
option domain-search <\/code>"HERE.ici"<\/code>;<\/code><\/div>\n
# you can add other extra name servers if you consider acceptable <\/code><\/div>\n
# direct external queries in case the resolver is dead<\/code><\/div>\n
option domain-name-servers 10.0.0.1;<\/code><\/div>\n
option routers 10.0.0.1;<\/code><\/div>\n
default-lease-<\/code>time<\/code> 600;<\/code><\/div>\n
max-lease-<\/code>time<\/code> 6000;<\/code><\/div>\n
update-static-leases on;<\/code><\/div>\n
authoritative;<\/code><\/div>\n
<\/div>\n
 <\/code>[...]<\/code><\/div>\n
<\/div>\n
zone HERE.ici. {<\/code><\/div>\n
  <\/code>primary 127.0.1.1;<\/code><\/div>\n
}<\/code><\/div>\n
zone 10.<\/code>in<\/code>-addr.arpa. {<\/code><\/div>\n
  <\/code>primary 127.0.1.1;<\/code><\/div>\n
}<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n

No dynamic update keys, everything goes through the loopback. You might want erase DHCPd leases (usually in \/var\/lib\/dhcp\/) so it does not get confused.<\/p>\n

DNS Resolver<\/h2>\n

The Knot Resolver will handle all clients queries, contacting Internet DNS over TLS if need be and caching results. Edit \/etc\/knot-resolver\/kresd.conf to contain:<\/p>\n

\n
\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n
16<\/div>\n
17<\/div>\n
18<\/div>\n
19<\/div>\n
20<\/div>\n
21<\/div>\n
22<\/div>\n
23<\/div>\n
24<\/div>\n
25<\/div>\n
26<\/div>\n
27<\/div>\n
28<\/div>\n
29<\/div>\n
30<\/div>\n
31<\/div>\n
32<\/div>\n
33<\/div>\n
34<\/div>\n
35<\/div>\n
36<\/div>\n
37<\/div>\n
38<\/div>\n
39<\/div>\n
40<\/div>\n
41<\/div>\n
42<\/div>\n
43<\/div>\n<\/td>\n
\n
\n
-<\/code>-<\/code> Network interface configuration<\/code><\/div>\n
-<\/code>-<\/code> (knot dns should be using <\/code>127.0<\/code>.<\/code>1.1<\/code>)<\/code><\/div>\n
net.listen(<\/code>'127.0.0.1'<\/code>, <\/code>53<\/code>, { kind <\/code>=<\/code> 'dns'<\/code> })<\/code><\/div>\n
net.listen(<\/code>'127.0.0.1'<\/code>, <\/code>853<\/code>, { kind <\/code>=<\/code> 'tls'<\/code> })<\/code><\/div>\n
net.listen(<\/code>'10.0.0.1'<\/code>, <\/code>53<\/code>, { kind <\/code>=<\/code> 'dns'<\/code> })<\/code><\/div>\n
net.listen(<\/code>'10.0.0.1'<\/code>, <\/code>853<\/code>, { kind <\/code>=<\/code> 'tls'<\/code> })<\/code><\/div>\n
<\/div>\n
-<\/code>-<\/code> drop privileges (check <\/code>\/<\/code>var<\/code>\/<\/code>lib<\/code>\/<\/code>knot<\/code>-<\/code>resolves modes<\/code>\/<\/code>owner)<\/code><\/div>\n
user(<\/code>'knot-resolver'<\/code>, <\/code>'knot-resolver'<\/code>)<\/code><\/div>\n
<\/div>\n
-<\/code>-<\/code> Load useful modules<\/code><\/div>\n
modules <\/code>=<\/code> {<\/code><\/div>\n
   <\/code>'hints > iterate'<\/code>,  <\/code>-<\/code>-<\/code> Load <\/code>\/<\/code>etc<\/code>\/<\/code>hosts <\/code>and<\/code> allow custom root hints<\/code><\/div>\n
   <\/code>'stats'<\/code>,            <\/code>-<\/code>-<\/code> Track internal statistics<\/code><\/div>\n
   <\/code>'predict'<\/code>,          <\/code>-<\/code>-<\/code> Prefetch expiring<\/code>\/<\/code>frequent records<\/code><\/div>\n
   <\/code>'view'<\/code>,         <\/code>-<\/code>-<\/code> require to limit access<\/code><\/div>\n
}<\/code><\/div>\n
<\/div>\n
-<\/code>-<\/code> Cache size<\/code><\/div>\n
cache.size <\/code>=<\/code> 500<\/code> *<\/code> MB<\/code><\/div>\n
<\/div>\n
-<\/code>-<\/code> whitelist queries identified by subnet<\/code><\/div>\n
view:addr(<\/code>'127.0.0.0\/24'<\/code>, policy.<\/code>all<\/code>(policy.PASS))<\/code><\/div>\n
view:addr(<\/code>'10.0.0.0\/24'<\/code>, policy.<\/code>all<\/code>(policy.PASS))<\/code><\/div>\n
-<\/code>-<\/code> drop everything that hasn't matched<\/code><\/div>\n
view:addr(<\/code>'0.0.0.0\/0'<\/code>, policy.<\/code>all<\/code>(policy.DROP))<\/code><\/div>\n
<\/div>\n
-<\/code>-<\/code> Custom hints: local spoofed address <\/code>and<\/code> antispam<\/code>\/<\/code>ads<\/code><\/div>\n
hints.add_hosts(<\/code>"\/etc\/knot-resolver\/redirect-spoof"<\/code>)<\/code><\/div>\n
hints.add_hosts(<\/code>"\/etc\/knot-resolver\/redirect-ads"<\/code>)<\/code><\/div>\n
<\/div>\n
-<\/code>-<\/code> internal domain: use knot dns listening on loopback<\/code><\/div>\n
internalDomains <\/code>=<\/code> policy.todnames({<\/code>'HERE.ici'<\/code>, <\/code>'10.in-addr.arpa'<\/code>})<\/code><\/div>\n
policy.add(policy.suffix(policy.FLAGS({<\/code>'NO_CACHE'<\/code>}), internalDomains))<\/code><\/div>\n
policy.add(policy.suffix(policy.STUB({<\/code>'127.0.1.1@53'<\/code>}), internalDomains))<\/code><\/div>\n
<\/div>\n
-<\/code>-<\/code> forward <\/code>in<\/code> TLS                   <\/code><\/div>\n
policy.add(policy.<\/code>all<\/code>(policy.TLS_FORWARD(<\/code><\/div>\n
             <\/code>{<\/code>'208.67.222.222'<\/code>, hostname<\/code>=<\/code>'dns.opendns.com'<\/code>},<\/code><\/div>\n
             <\/code>{<\/code>'208.67.220.220'<\/code>, hostname<\/code>=<\/code>'dns.opendns.com'<\/code>},<\/code><\/div>\n
             <\/code>{<\/code>'1.1.1.1'<\/code>, hostname<\/code>=<\/code>'cloudflare-dns.com'<\/code>},<\/code><\/div>\n
             <\/code>{<\/code>'1.0.0.1'<\/code>, hostname<\/code>=<\/code>'cloudflare-dns.com'<\/code>},<\/code><\/div>\n
})))<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n

redirect-spoof and redirect-ads at \/etc\/hosts format: it allows domain spoofing or ads domains filtering. It replaces conveniently the extra lua script that my setup was using with PowerDNS.<\/p>\n

Update Feb 19 2023: Check recent files on gitlab<\/a>, I know use RPZ instead of hints\/hosts file to block hostile domains. No real change in principle but knot-resolver seems to handle better very long lists in this form.<\/p>\n

Finally, the resolver need to be started by the supervisord, with a \/etc\/supervisor\/conf.d\/knot-resolver.conf as such:<\/p>\n

\n
\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n
16<\/div>\n
17<\/div>\n<\/td>\n
\n
\n
[program:knot-resolver]<\/code><\/div>\n
command<\/code>=<\/code>\/usr\/sbin\/kresd<\/code> -c <\/code>\/etc\/knot-resolver\/kresd<\/code>.conf --noninteractive<\/code><\/div>\n
priority=0<\/code><\/div>\n
autostart=<\/code>true<\/code><\/div>\n
autorestart=<\/code>true<\/code><\/div>\n
stdout_syslog=<\/code>true<\/code><\/div>\n
stderr_syslog=<\/code>true<\/code><\/div>\n
directory=<\/code>\/var\/lib\/knot-resolver<\/code><\/div>\n
<\/div>\n
[program:knot-resolver-gc]<\/code><\/div>\n
command<\/code>=<\/code>\/usr\/sbin\/kres-cache-gc<\/code> -c <\/code>\/var\/lib\/knot-resolver<\/code> -d 120000<\/code><\/div>\n
user=knot-resolver<\/code><\/div>\n
autostart=<\/code>true<\/code><\/div>\n
autorestart=<\/code>true<\/code><\/div>\n
stdout_syslog=<\/code>true<\/code><\/div>\n
stderr_syslog=<\/code>true<\/code><\/div>\n
directory=<\/code>\/var\/lib\/knot-resolver<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n

Restart the supervisor, check logs. Everything should be fine. You can cleanup.<\/p>\n

\n
\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n<\/td>\n
\n
\n
rc-update add supervisor<\/code><\/div>\n
rc-update add knot<\/code><\/div>\n
apt --purge remove pdns-*<\/code><\/div>\n
<\/div>\n
# check if there is still traffic on DNS port 53 on the public network interface (should be none)<\/code><\/div>\n
tcpdump -ni eth0 -p port  53<\/code><\/div>\n
# check if there is trafic on DNS over TLS port 853 (should be whenever there is a query outside of the cache and LAN)<\/code><\/div>\n
tcpdump -ni eth0 -p port  853<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n

(My default files are my rien-host<\/a> package; if you have on your network a mail server using DNS blacklist which will inevitably blocked, you might want to install knot-resolver also on this server, in recursive mode)<\/p>\n<\/div>\n<\/blockquote>\n","protected":false},"excerpt":{"rendered":"

I’ve just read the interesing “Replace PowerDNS by Knot DNS and Knot Resolver+supervisor with DNSSEC, DNS over TLS and domain name spoofing” from …. I didn’t knew KnotDNS. It may be a wiser choice than MaraDNS<\/p>\n

Read more →<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"link","meta":{"inline_featured_image":false,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"activitypub_content_warning":"","activitypub_content_visibility":"","activitypub_max_image_attachments":4,"activitypub_interaction_policy_quote":"anyone","activitypub_status":"","footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[52,14],"tags":[333],"class_list":["post-10263","post","type-post","status-publish","format-link","hentry","category-software","category-software-libero","tag-dns","post_format-post-format-link"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p6daft-2Fx","jetpack-related-posts":[{"id":144,"url":"https:\/\/monodes.com\/predaelli\/2015\/05\/14\/fix-dns-issues-with-local-addresses-on-ms-domain\/","url_meta":{"origin":10263,"position":0},"title":"Fix DNS issues with .local addresses on MS domain","author":"Paolo Redaelli","date":"2015-05-14","format":false,"excerpt":"I can't believe it is that simple Fix linux DNS issues with .local addresses on MS domain B.L.U.F.: Microsoft uses .local as the recommended root of internal domains, and serves them via unicast dns. Linux uses .local as the root of multicast dns. If you're stuck on a broken MS\u2026","rel":"","context":"In "Senza categoria"","block_context":{"text":"Senza categoria","link":"https:\/\/monodes.com\/predaelli\/category\/senza-categoria\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":4912,"url":"https:\/\/monodes.com\/predaelli\/2018\/11\/13\/1-1-1-1-the-internets-fastest-privacy-first-dns-resolver\/","url_meta":{"origin":10263,"position":1},"title":"1.1.1.1 \u2014 the Internet\u2019s Fastest, Privacy-First DNS Resolver","author":"Paolo Redaelli","date":"2018-11-13","format":false,"excerpt":"\u270c\ufe0f\u270c\ufe0f Browse a faster, more private internet. Source: 1.1.1.1 \u2014 the Internet\u2019s Fastest, Privacy-First DNS Resolver","rel":"","context":"In "Senza categoria"","block_context":{"text":"Senza categoria","link":"https:\/\/monodes.com\/predaelli\/category\/senza-categoria\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":8010,"url":"https:\/\/monodes.com\/predaelli\/2021\/01\/04\/geektalk-debian-postfix-docker-ed-il-ruolo-degli-sviluppatori-nel-devops-con-marco-ditri-youtube\/","url_meta":{"origin":10263,"position":2},"title":"GeekTalk: DEBIAN, POSTFIX, Docker ed il ruolo degli sviluppatori nel DEVOPS con Marco d’Itri – YouTube","author":"Paolo Redaelli","date":"2021-01-04","format":"video","excerpt":"Postfix: \"il codice di POSTFIX dovrebbe essere usato a fini didattici, \u00e8 un grande design. Scritto molto bene, chiaro e sicuro. Un buon esempio di come si scrive C eccellente\" Dnsmasq per resolver domestico Knot DNS PowerDNS","rel":"","context":"In "Senza categoria"","block_context":{"text":"Senza categoria","link":"https:\/\/monodes.com\/predaelli\/category\/senza-categoria\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1887,"url":"https:\/\/monodes.com\/predaelli\/2016\/11\/13\/linux-per-tutti-cambiare-dns-su-linux-e-quali-scegliere\/","url_meta":{"origin":10263,"position":3},"title":"Linux per tutti: Cambiare DNS su Linux e quali scegliere","author":"Paolo Redaelli","date":"2016-11-13","format":false,"excerpt":"Linux per tutti: Cambiare DNS su Linux e quali scegliere - TechnoBlitz.it Google DNS 8.8.8.8 8.8.4.4 SecureDNS 8.26.56.26 8.20.247.20 OpenDNS 208.67.222.222 (Resolver1.OpenDNS.com) 208.67.220.220 (Resolver2.OpenDNS.com) 208.67.222.220 208.67.220.222 Norton DNS 198.153.192.1 198.153.194.1","rel":"","context":"In "Documentations"","block_context":{"text":"Documentations","link":"https:\/\/monodes.com\/predaelli\/category\/documentations\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":12821,"url":"https:\/\/monodes.com\/predaelli\/2025\/02\/21\/7-reasons-you-should-turn-your-raspberry-pi-into-a-dns-server\/","url_meta":{"origin":10263,"position":4},"title":"7 reasons you should turn your Raspberry Pi into a DNS server","author":"Paolo Redaelli","date":"2025-02-21","format":"link","excerpt":"If you aren't using your Raspberry Pi as a DNS server for your home network, there are plenty of reasons why you should Source: 7 reasons you should turn your Raspberry Pi into a DNS server","rel":"","context":"In "Senza categoria"","block_context":{"text":"Senza categoria","link":"https:\/\/monodes.com\/predaelli\/category\/senza-categoria\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":4368,"url":"https:\/\/monodes.com\/predaelli\/2018\/06\/06\/a-cartoon-intro-to-dns-over-https-mozilla-hacks-the-web-developer-blog\/","url_meta":{"origin":10263,"position":5},"title":"A cartoon intro to DNS over HTTPS \u2013 Mozilla Hacks \u2013 the Web developer blog","author":"Paolo Redaelli","date":"2018-06-06","format":"link","excerpt":"Sorgente: A cartoon intro to DNS over HTTPS \u2013 Mozilla Hacks \u2013 the Web developer blog","rel":"","context":"In "Senza categoria"","block_context":{"text":"Senza categoria","link":"https:\/\/monodes.com\/predaelli\/category\/senza-categoria\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/monodes.com\/predaelli\/wp-content\/uploads\/sites\/4\/2018\/06\/03_04-500x249.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]}],"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/monodes.com\/predaelli\/wp-json\/wp\/v2\/posts\/10263","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/monodes.com\/predaelli\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/monodes.com\/predaelli\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/monodes.com\/predaelli\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/monodes.com\/predaelli\/wp-json\/wp\/v2\/comments?post=10263"}],"version-history":[{"count":0,"href":"https:\/\/monodes.com\/predaelli\/wp-json\/wp\/v2\/posts\/10263\/revisions"}],"wp:attachment":[{"href":"https:\/\/monodes.com\/predaelli\/wp-json\/wp\/v2\/media?parent=10263"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/monodes.com\/predaelli\/wp-json\/wp\/v2\/categories?post=10263"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/monodes.com\/predaelli\/wp-json\/wp\/v2\/tags?post=10263"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}