Jump to content

# Stubby

From ArchWiki

Related articles

- Domain name resolution

Stubby is an application that acts as a local DNS Privacy stub resolver (using DNS-over-TLS). Stubby encrypts DNS queries sent from a client machine (desktop or laptop) to a DNS Privacy resolver, increasing end user privacy.

## Installation

Install the stubby package.

## Configuration

To configure stubby, perform the following steps:

### Select resolver

Upon installation, Stubby has some default resolvers. They can be found and edited in `/etc/stubby/stubby.yml`. You can use the defaults, uncomment one of prewritten resolvers or find another resolver from this list.

Example of a valid resolver configuration:

    /etc/stubby/stubby.yml

    upstream_recursive_servers:

    ## Cloudflare servers
     - address_data: 1.1.1.1
       tls_auth_name: "cloudflare-dns.com"
     - address_data: 1.0.0.1
       tls_auth_name: "cloudflare-dns.com"
     - address_data: 2606:4700:4700::1111
       tls_auth_name: "cloudflare-dns.com"
     - address_data: 2606:4700:4700::1001
       tls_auth_name: "cloudflare-dns.com"

Note This example uses Cloudflare's public DNS resolver. Replace it with a DNS resolver you trust. See Domain name resolution#Third-party DNS services.

When you get warn log complaining wrong tls_pubkey_pinset, the tls_pubkey_pinset value may be wrong and the `value` of the `tls_pubkey_pinset` can be generated with:

    $ openssl s_client -connect address_data:tls_port </dev/null 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64

Note For further information on configuring Stubby see Configuring Stubby.

### Enable DNSSEC validation

Enable DNSSEC validation by uncommenting the following line in `/etc/stubby/stubby.yml`:

    /etc/stubby/stubby.yml

    ...
    dnssec: GETDNS_EXTENSION_TRUE
    ...

### Modify resolv.conf

After selecting a resolver, modify the resolv.conf file and replace the current set of resolver addresses with address for localhost:

    /etc/resolv.conf

    nameserver ::1
    nameserver 127.0.0.1
    options trust-ad

Other programs may overwrite this setting; see resolv.conf#Overwriting of /etc/resolv.conf for details.

### Start systemd service

Finally, start/enable the `stubby.service`.

## Tips and tricks

### Local DNS cache configuration

Stubby does not have a built-in DNS cache, therefore every single query is transmitted and resolved, which can slow down connections. Setting up a DNS cache requires installing and configuring a separate DNS cacher.

#### Change port

In order to forward to a local DNS cache, Stubby should listen on a port different from the default `53`, since the DNS cache itself needs to listen on `53` and query Stubby on a different port. Port number `54` is used as an example in this section.

Edit the value of `listen_addresses` as follows:

    /etc/stubby/stubby.yml

    listen_addresses:
      - 127.0.0.1@54
      -  0::1@54

##### dnsmasq

Configure dnsmasq as a local DNS cache. The basic configuration to work with Stubby is the following:

    /etc/dnsmasq.conf

    no-resolv
    proxy-dnssec
    server=::1#54
    server=127.0.0.1#54
    listen-address=::1,127.0.0.1

Restart `dnsmasq.service` to apply the changes.

##### Other DNS cachers

For more DNS cachers, see DNSCrypt#Local DNS cache configuration. The configurations should be similar if not identical.

Category:

- Domain Name System

Stubby
Add topic