DNS encryption

Over the last decades, privacy on the internet has become a race. Users protect their privacy with encryption and with tools like Little Snitch, while government agencies and Big Tech companies try to get as much information as they can out of what remains visible.

It turns out that the list of websites you visit alone says a lot about your interests and beliefs. Governments want this information to assess what risk you might pose. Big Tech uses it to win your attention.

After the revelations by Edward Snowden, most internet traffic moved to encrypted transfers with HTTPS, made possible on a large scale by free certificates from Let’s Encrypt. But one step was neglected for a long time: before your Mac can request a web page, even an encrypted one, it must look up the IP address of the hostname with DNS. And these lookups have hardly changed since the beginning of the internet. By default, they aren’t encrypted, so anyone along the way can see the names of the websites that you visit. DNS encryption closes this gap.

How it works

For DNS encryption, Little Snitch uses a DNS Proxy network extension. When an app registers such an extension, macOS sends all unencrypted DNS lookups to it. macOS recognizes these lookups by their port number, 53, and hands them over regardless of which DNS server they were meant for and which process sent them.

Little Snitch takes each lookup, wraps it in an encrypted protocol that your resolver supports, and sends it to the resolver that you selected. When the answer arrives, Little Snitch decrypts it and returns it as if it came from the original DNS server.

Little Snitch sends the lookups to a primary resolver, an encrypted DNS server. If the primary resolver fails or takes longer than 200 ms to answer, Little Snitch uses a secondary resolver. The Dashboard shows how both resolvers perform, and its log shows the details of each lookup.

You set up DNS encryption in Settings > DNS: turn it on or off, choose the primary and secondary resolvers, add exceptions, and test the encryption. To open the Dashboard from there, click the status of a resolver, then click Full Metrics.

Encryption protocols

Little Snitch supports three protocols for DNS encryption:

DNS over TLS (DoT): Encrypts the usual DNS protocol of port 53 with TLS.
DNS over HTTPS (DoH): Packs DNS packets into encrypted web requests. DoH works even where a company firewall blocks DoT, because the firewall can’t easily tell DoH apart from normal web traffic.
DNS over QUIC (DoQ): Like DoT, but uses the newer and faster QUIC protocol instead of TCP and TLS. QUIC has encryption built in.

Make sure that your resolver supports the protocol that you choose.

Whom do you trust?

With DNS encryption, nobody along the way can read your lookups, except one: the provider of the resolver. It sees exactly the information that you want to keep private, so you have to trust it to use that information only in your interest. So whom do you trust? Google? Cloudflare? It’s no coincidence that Big Tech companies offer this service for free.

Little Snitch comes with a list of predefined resolvers. In the DNS settings, the submenu of each resolver has the items Open Provider’s Website and Jurisdiction. These criteria help you choose a provider:

How available and fast the provider is in your region.
Which laws apply to the provider, and which government makes these laws.
Whether the provider has an interest in your data.
What the provider’s privacy policy says about how it stores and uses your data.

Limitations

macOS accepts only one DNS Proxy network extension. If another app on your Mac already provides one, you can’t turn on DNS encryption in Little Snitch.
Your usual DNS server may know private names that aren’t in the public DNS, for example for your printer or TV. The encrypted resolver doesn’t know them. To keep using them, configure an exception.
Little Snitch sends all lookups to your resolver, whatever DNS server they were meant for. Some apps use DNS to query special servers, for example DNS-based blocklists. These apps can fail.
Your Mac can still reveal hostnames in other ways, for example in the Server Name Indication (SNI) of TLS, the protocol behind HTTPS.