3 Best Alternatives to DNSCrypt to Secure your DNS in 2020

Internet surveillance is on the rise, and anyone online should take steps to restore their security and retain their privacy. Most people don’t consider the vulnerabilities of DNS requests; however, it can be an area for concern.

Before being taken offline, DNSCrypt.org was an effective protocol for authenticating DNS comms, ensuring the response is always from the DNS resolver and hasn’t been modified.

Why you should secure your DNS 

As DNS is a foundation of the internet, it is a global database utilized by every application communicating over a network.

However, it’s also a protocol designed without security mechanisms like encryption, authentication, or protection from modification, leaving it vulnerable to attacks. Without securing DNS queries, they are susceptible to interception.

The result of this can impact on security and privacy, as not only does it facilitate the interception of online activity, which can include access to personal accounts and information, but, false DNS responses can instigate the spreading of malware, and more.

DNS Cache Snooping is the name given to the most common type of DNS attack and involves a rouge IP address being injected into a request to redirect traffic to an alternative website rather than the genuine, intended one.

Is a VPN enough? 

Specific operating systems have a tool called “Smart Multi-Homed Name Resolution,” which fetches the IP address queried for from other non-standard servers DNS servers don’t respond quickly enough, resulting in a DNS leak.

Therefore, a VPN is only adequate if it has DNS Leak protection and uses its own DNS servers, which, in most cases, are usually Zero-knowledge DNS servers that do not store any user information or activities.

ExpressVPN, NordVPN, and CyberGhost VPN all provide this level of security and have even adopted IPv2 for future protection.

Is HTTPS enough? 

HTTPS is an extension of the Hypertext Transfer Protocol HTTP that uses TLS to encrypt web traffic and other communications from devices. HTTPS is helpful in the authentication of websites, and it also provides privacy and integrity of the data exchanged.

However, HTTPS only secures web traffic and other comms, not DNS queries; therefore, HTTPS does not in any way secure your DNS traffic.

Best Alternatives for DNSCrypt 

1 A VPN with DNS Leak Protection and DNS servers

A VPN is an online privacy and security tool that encrypts traffic and facilitates internet access via a secure proxy server. By doing this, you assume an alternative public IP address, and third-parties are unable to see the sites you access, files you download, or resources you use.

However, many VPNs can’t guarantee DNS security due to DNS Leaks.

VPNs like ExpressVPN, NordVPN, and CyberGhost VPN have addressed this flaw by implementing DNS leak protection, which ensures that DNS queries are always forced to the secure VPN DNS servers.

Although you can manually change your ISP DNS servers to an alternative, like Google’s 8.8.8.8., many of them are utilized for data collection, which can be passed on to advertising networks.

Additionally, you will be able to take advantage of the other benefits a VPN can provide, like bypassing geo-restrictions, geo-spoofing for digital purchases, torrenting safely, better net neutrality, etc.

2 DNS-over-TLS

DNS over TLS (DoT) is a security protocol that protects DNS from manipulation, like Man-in-the-middle attacks, via the Transport Layer Security (TLS) protocol. TLS in itself has been in existence for a while, and it is a cryptographic protocol that secures data transfer.

As more people realize the importance of securing DNS, DNS-over-TLS has become very popular. Even Frank Denis, the creator of DNSCrypt-proxy, now recommends using DNS-over-TLS instead of any other encrypted DNS.

DNS-over-TLS is a protocol some large companies have taken advantage of to provide a secure service, including Cloudflare, Quad9, and Google (Android 9 Pie and above).

3 Other DNS-over-TLS services

• Tenta
• DNSDist from PowerDNS
• BIND (through stunnel)
• Unbound

If you want to secure DNS on Android devices, Tenta provides an excellent service, as they have a private and secure Android browser that uses DNS-over-TLS. Though we recommend that you use a secure VPN for your activities, you can use this browser as an alternative.

Be advised that there are different versions of TLS available, and 1.0 is currently being phased out as 1.2 is adopted.

How to run a DNS Leak test 

For demonstrating purposes, we have used ExpressVPN, but alternative VPNs should operate similarly.

1. Download and install the VPN client app
2. Ensure DNS Leak Protection and IPV6 leak protection are enabled. Protection of other common leaks is usually enabled by default
   
3. Connect to one of the available servers
   
4. Now you need to initiate a DNS leak test.

ExpressVPN provides a DNS leak test on their website; however, we recommend using a more impartial service if testing various VPNs, and one of the best tools currently available can be found at www.astrill.com/dns-leak-test.

Final thoughts 

Without any certainty about how long DNSCrypt will continue operating, users need an alternative way of securing DNS comms. However, it’s not DNS queries alone that should be your concern, as third-parties will still be able to observe traffic unless further precautions are taken.

Consider subscribing to a premium VPN in conjunction with a secure DNS service, anti-virus, or any other security tools.

GuideHaven recommends ExpressVPN, NordVPN, and CyberGhost VPN, and three of the most efficient and effective services on the market.