DNS Query Data Flow
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
The DNS Query Data Flow within the dns-hardening-parrot project represents a secured path for domain name resolution on Parrot OS. The system is designed to intercept local DNS queries and route them through a hardened, local Unbound instance that performs DNSSEC validation and encrypts upstream traffic using DNS over TLS (DoT).
The primary goal of this data flow is to prevent DNS-based attacks such as spoofing, hijacking, and Man-in-the-Middle (MITM) while enhancing user privacy through query minimization and the elimination of local logging. This architecture places the system in a high-security posture by ensuring that queries never leave the local machine in plaintext.
Sources: DNS_Hardening_Complete_Guide.md:3-14, README.md:5-15
Local Ingress and Resolution Logic
The flow begins when a system application initiates a DNS request. The system configuration ensures that all local requests are directed to the loopback interface where the Unbound resolver listens.
Primary Path: Localhost Interception
The system's /etc/resolv.conf is configured to point to 127.0.0.1. This file is protected by an immutable flag (chattr +i) to prevent modification by services like NetworkManager or Portmaster, ensuring the integrity of the ingress point.
The diagram shows how local applications are forced through the local Unbound resolver before any external communication occurs.
Sources: scripts/dns_harden.sh:34-45, configs/unbound.conf:5-11, DNS_Hardening_Complete_Guide.md:162-170
Access Control and Interface Binding
Unbound is configured to bind strictly to the local interface, refusing any queries that do not originate from the local machine.
| Parameter | Value | Description |
|---|---|---|
interface | 127.0.0.1 | Binds Unbound to localhost only. |
port | 53 | Standard DNS port for local interception. |
access-control | 127.0.0.0/8 allow | Permits local subnet queries. |
access-control | 0.0.0.0/0 refuse | Drops all external or unauthorized queries. |
Sources: configs/unbound.conf:6-14
Upstream Encryption: DNS over TLS (DoT)
When a query is not found in the local cache, Unbound initiates an upstream request. Unlike standard DNS, this project enforces DNS over TLS (DoT) on port 853 to ensure that the query remains encrypted until it reaches the upstream provider.
Encrypted Forwarding
The forward-zone configuration defines specific upstream resolvers (Cloudflare and Quad9) that support TLS. Unbound uses a certificate bundle to verify the authenticity of these upstream servers.
Sequence illustrating the encrypted handshake and data exchange between the local resolver and high-security upstream providers.
Sources: configs/unbound.conf:78-95, UNBOUND_TLS_STATUS.md:6-12
Security Hardening Measures
During the upstream flow, several privacy and security features are applied:
- QNAME Minimisation: Only the minimum necessary part of the query is sent to each level of the DNS hierarchy.
- DNSSEC Validation: Authenticity is verified using the root key located at
/var/lib/unbound/root.key. - Privacy Protections: Identity and version strings are hidden to prevent fingerprinting.
Sources: configs/unbound.conf:17-23, configs/unbound.conf:53-61
Emergency Fallback and Restoration
The project includes a contingency flow for situations where the hardened setup fails (e.g., loss of connectivity to DoT providers).
Manual Restoration Flow
The dns_restore.sh script automates the transition from a hardened state to a functional emergency state. This involves:
- Stopping the
unboundandsystemd-resolvedservices. - Removing the immutable flag from
/etc/resolv.conf. - Injecting basic public resolvers (1.1.1.1, 9.9.9.9, 8.8.8.8) directly into the system configuration.
The fallback process bypasses local encryption to restore immediate internet connectivity.
Sources: scripts/dns_restore.sh:55-83, DNS_Hardening_Complete_Guide.md:41-94
Monitoring and Alerting Data Flow
Continuous checks are performed to ensure the integrity of the data flow. Monitoring scripts evaluate the status of the immutable flag and the presence of the Unbound service.
| Component | Logic | Target Log |
|---|---|---|
dns_alert.sh | Checks if 127.0.0.1 is the primary nameserver. | /var/log/dns_hardening_alerts.log |
dns_tls_monitor.sh | Verifies active connections on port 853. | /var/log/dns_hardening_alerts.log |
dns_status.sh | Validates current resolution via nslookup. | Standard Output |
Sources: scripts/dns_alert.sh:18-35, scripts/dns_tls_monitor.sh:26-35, scripts/dns_status.sh:12-45
Conclusion
The DNS Query Data Flow in this project transforms a standard, insecure lookup process into a managed, encrypted, and validated pipeline. By forcing traffic through a local Unbound instance with chattr +i protected configuration and upstream DNS over TLS, the system significantly reduces the attack surface for DNS-based exploits while maintaining a robust recovery path for connectivity emergencies.