Hacker News Reader

Run an iterative resolver somewhere, then connect to it either via DoT or some VPN (wireguard, openvpn...) from your router or the OS stub resolver.

Depending on your threat model you could also run the iterative resolver locally.

View on HN

Interesting... or a simpler method is to always use a VPN.

Or will the resolver somehow see the original IP?

To extend your idea, if that "resolver located somewhere" would be shared by more than one user then mapping a dns query to a specific user/IP would be much harder, hence further improving the privacy

Then you're back to where they have to trust the operator. The purpose of this exercise is to reduce the number of parties that have to be trusted, not increase them.

Ideally iterative resolver - autheoritative nameserver traffic would also be encrypted, then we wouldn't have to "hide in the herd" (as much).

I get the "trust the operator problem", I was thinking about sharing this for several devices I own or possibly with family assuming that "trust the operator" would not be an issue then, while increasing privacy a bit by disabling the ability to match a DNS query to specific user/IP. If this was to be shared publicly then of course you are right and this not only solves nothing but makes it worse as it introduces another node to be "trusted"

Reply on news.ycombinator.com