Privacy & Query Minimization
Relevant source files
The following files were used as context for generating this wiki page:
The Privacy & Query Minimization feature in the DNS Hardening Parrot project is designed to reduce the amount of metadata leaked to upstream DNS resolvers and prevent tracking of user browsing habits. This is achieved through aggressive QNAME minimization, the disabling of logging for sensitive query data, and hiding server identity information.
This system ensures that the local Unbound resolver only sends the minimum necessary information to authoritative servers to resolve a request. Instead of sending the full domain name (e.g., www.example.com) to the root servers, it sends only the top-level domain (.com), followed by the next labels in subsequent steps.
Sources: configs/unbound.conf:24-25, README.md:92-95, DNS_Hardening_Complete_Guide.md:323-328
Query Name (QNAME) Minimization logic
The project implements QNAME minimization using the Unbound resolver. This mechanism is governed by two primary settings that enforce strict adherence to privacy standards during the recursive resolution process.
Configuration Parameters
The following table describes the specific configuration parameters used to enforce query minimization:
| Parameter | Value | Description |
|---|---|---|
qname-minimisation | yes | Enables the basic QNAME minimization logic. |
qname-minimisation-strict | yes | Enforces strict minimization, preventing the resolver from falling back to full QNAME if a server returns an error. |
Sources: configs/unbound.conf:24-25, README.md:93-94
Data Flow for Minimized Queries
This diagram illustrates how a query for sub.example.com is handled when minimization is active:
The flow demonstrates that the full QNAME is only revealed to the final authoritative nameserver, protecting user privacy at higher levels of the DNS hierarchy.
Sources: configs/unbound.conf:24-25, DNS_Hardening_Complete_Guide.md:327
Privacy Hardening & Identity Obfuscation
To further protect user privacy, the system disables all forms of query and reply logging. This prevents the creation of local metadata trails that could be used for forensic analysis or tracking. Additionally, the resolver is configured to hide its own identity and version strings to prevent fingerprinting by external entities.
Identity Protection Settings
The configuration explicitly hides server-specific metadata:
- hide-identity: Set to
yesto prevent responding toid.serverqueries. - hide-version: Set to
yesto prevent responding toversion.serverqueries.
Sources: configs/unbound.conf:75-76, README.md:120-121
Logging Suppression
The following settings ensure no query data is stored on the disk:
# Disable logging for privacy
verbosity: 1
log-queries: no
log-replies: no
log-servfail: no
Sources: configs/unbound.conf:28-32, DNS_Hardening_Complete_Guide.md:149-153
DNSSEC & Metadata Integrity
While query minimization protects the content of the query, DNSSEC validation ensures the integrity of the response metadata. By validating signatures, the system prevents DNS poisoning or spoofing attacks that could redirect users to malicious infrastructure, which is a critical component of overall privacy protection.
The presence of the ad flag in query results confirms that the data has not been tampered with.
Sources: UNBOUND_TLS_STATUS.md:20-25, scripts/dns_harden.sh:45
Anti-Fingerprinting & Case Randomization
The system utilizes use-caps-for-id (also known as 0x20 encoding) to provide an additional layer of protection against cache poisoning and fingerprinting. By randomizing the capitalization of letters in the query name (e.g., ExAmPlE.cOm), the resolver can verify that the response matches the exact bit-pattern of the query, adding entropy to the transaction ID.
Sources: configs/unbound.conf:82, README.md:127
Implementation Status Verification
The project includes scripts to verify that privacy and hardening features are active. Specifically, the dns_status.sh script checks if the local resolver is correctly configured as the primary nameserver in /etc/resolv.conf.
Verification Commands
| Component | Verification Method | Expected Result |
|---|---|---|
| Local Resolver | grep "127.0.0.1" /etc/resolv.conf | Must be the primary nameserver |
| DNSSEC | dig @127.0.0.1 +dnssec google.com | Should contain the ad flag |
| Hardening Status | ./scripts/dns_status.sh | Status: HARDENED |
Sources: scripts/dns_status.sh:25-30, UNBOUND_TLS_STATUS.md:20-25
Conclusion
Privacy & Query Minimization in this project is implemented through a multi-layered approach using Unbound's advanced features. By strictly minimizing QNAMEs, hiding server identity, and disabling logging, the system ensures that metadata leakage is kept to the absolute minimum required for functional DNS resolution. Citing strict configuration in unbound.conf and verification scripts, the project places the system in a high security posture globally.
Sources: README.md:231-236, DNS_Hardening_Complete_Guide.md:323-330