A couple of issues

[Opening-Button-8988]

Hi. I discovered RDNS recently and I'm loving it. I have a few issues though.

1. I can't access the internet when I set a custom dns provider in DNS Proxy settings. I followed the instructions on this link: https://mullvad.net/en/help/dns-over-https-and-dns-over-tls/. However, the app firewall failed and couldn't get internet. I set the IP address as "193.19.108.2" and used port 853, as described in the article. I also tried to use DNS over HTTPS using the url "https://adblock.doh.mullvad.net/", but I got an error message saying "Invalid URL".

2. When using RDNS Plus, I notice my DNS requests come from either Google or Cloudfare. Is RDNS using Google and Cloudfare for its servers, and if so, how bad is that for my privacy?

3. After testing, even when facebook.com is clearly blocked (using RDNS Plus with Social Media enabled in the Simple tab, as well as Facebook blocked in the Advanced tab), I can still access facebook.com and a few associated URLs (that are supposed to be blocked). Why is this?

4. I can't get Orbot to work with RDNS. Orbot works on its own, but when I activate it with RDNS, I can't get internet. I tweaked some settings to make it work with no luck (including disabling "Block any app not in use").

Besides the issues listed above, I absolutely love the design and controls of the app! By the way, is reddit.com/r/rethinkdns the official subreddit?

[ignoramous]

I also tried to use DNS over HTTPS using the url "https://adblock.doh.mullvad.net/", but I got an error message saying "Invalid URL".

I just tried to add this endpoint in DNS -> Configure -> Other DNS -> DoH -> + and it works. Make sure you don't forget the trailing slash / at the end of the url.

I set the IP address as "193.19.108.2" and used port 853

Port 853 is for DoT (DNS-over-TLS, which is encrypted just like DNS-over-HTTPS), which isn't supported by Rethink. DNS Proxy is for plain old DNS (the unencrypted kind).

When using RDNS Plus, I notice my DNS requests come from either Google or Cloudfare. Is RDNS using Google and Cloudfare for its servers, and if so, how bad is that for my privacy?

Sky (the default RDNS+ endpoint) uses Google and Cloudflare as upstream DNS resolvers. The requests to it look like: You -> Sky -> Google DNS / Cloudflare DNS. As in (and ignoring network analysis attacks), those upstreams have no info that it is You that's sending those requests.

Max (you can switch to it from DNS -> Configure -> Rethink DNS -> Look for Max at the top of the screen in v053k or later) runs our own recursive resolver, if you are uncomfortable with Sky using Google DNS / Cloudflare DNS.

After testing, even when facebook.com is clearly blocked (using RDNS Plus with Social Media enabled in the Simple tab, as well as Facebook blocked in the Advanced tab), I can still access facebook.com and a few associated URLs (that are supposed to be blocked). Why is this?

Not sure which blocklists you use, can you pls share the RDNS+ URL, if you're okay? The app lets you "copy" that URL when you tap on the "i" icon next to RDNS+ entry.

I can't get Orbot to work with RDNS. Orbot works on its own, but when I activate it with RDNS, I can't get internet. I tweaked some settings to make it work with no luck (including disabling "Block any app not in use").

It is perhaps Orbot DNS that isn't working. Go to DNS -> Configure and switch to any other DNS other than Orbot. We're going to drop support for Orbot DNS since it literally never works :( #665

[EvilWatermelon]

I have the same issue for reddit and some other websites. After changing to your proposed settings it still not works. Are there any blocklists that prevent to visit social media websites?

[ignoramous]

Switch to RDNS Default and see if those sites work.

• If so, then it was the previous DNS server blocking websites.
  • You can spot which domains were blocked in DNS Logs. These have red-coloured left-hand side border.
  • Tap on those blocked entries, and it should bring up a bottomsheet.
  • In that bottomsheet, trust / allow domains as needed.
• If not, check if some other rule (like universal (global) firewall rules or app-based rules are breaking the websites or apps)
  • Universal (global) rules are accessible from Configure -> *Firewall.
  • App-specific rules are in Configure -> Apps (search for the app that doesn't work, then tap on it to reveal the rules it may be subject to).
  • Bypass Universal is a good rule to make sure the app isn't subject to any Universal firewall rules.
  • Bypass DNS & Firewall, likewise, is a good blanket rule to have the app bypass all rules except its own rules. Enabling Bypass DNS & Firewall for even one app will be consume slightly a bit more battery than normal.
  • Exclude puts the app completely out of Rethink's monitoring. Sometimes, p2p (LAN based apps) like Syncthing only work if excluded.

[EvilWatermelon]

If I add some domain to the Firewall does not changes anything. Neither blocking nor allowing.
The logs for reddit in "Firefox Klar" say The trust domain rule works with Rethink's DNS only.
RDNS Default works but RDNS Plus not for reddit. I did not change local device blocking lists only the RDNS to default from Plus.