DNS Leaks

Check for DNS leak using Wireshark

• One of the most effective methods to check for a DNS leak is to capture and analyze your network's outgoing traffic using Wireshark.

• Just enter dns into the display filter field and review the captured packets.

• If your VPN/proxy is configured correctly or if you're relying on encrypted DNS protocols like DNS over HTTPS (DoH) or DNS over TLS (DoT) you should see no packets matching this filter.

DNS leaks via systemd-resolved

Check DNS Configuration and Leaks

Check systemd-resolved status

systemctl status systemd-resolved
resolvectl status

Check DNS servers being used

cat /etc/resolv.conf
resolvectl dns

Test for DNS leaks

dig @1.1.1.1 whoami.cloudflare TXT +short
nslookup myip.opendns.com resolver1.opendns.com

Secure DNS Configuration

Option 1: Use DNS over HTTPS with systemd-resolved

sudo mkdir -p /etc/systemd/resolved.conf.d
sudo tee /etc/systemd/resolved.conf.d/dns-over-tls.conf << EOF
[Resolve]
DNS=1.1.1.1#cloudflare-dns.com 1.0.0.1#cloudflare-dns.com
DNSOverTLS=yes
DNSSEC=yes
FallbackDNS=
EOF

# Restart services
sudo systemctl restart systemd-resolved

Option 2: Use Unbound for better control

sudo pacman -S unbound
sudo tee /etc/unbound/unbound.conf << 'EOF'
server:
    interface: 127.0.0.1
    port: 53
    do-ip4: yes
    do-ip6: yes
    do-udp: yes
    do-tcp: yes
    access-control: 127.0.0.0/8 allow
    hide-identity: yes
    hide-version: yes
    harden-glue: yes
    harden-dnssec-stripped: yes
    use-caps-for-id: yes
    prefetch: yes

forward-zone:
    name: "."
    forward-tls-upstream: yes
    forward-addr: 1.1.1.1@853#cloudflare-dns.com
    forward-addr: 1.0.0.1@853#cloudflare-dns.com
EOF

sudo systemctl enable --now unbound
sudo systemctl disable --now systemd-resolved

Update resolv.conf

echo "nameserver 127.0.0.1" | sudo tee /etc/resolv.conf
sudo chattr +i /etc/resolv.conf