Router: domain and TLS certificate requirements

[alfredonodo]

Hello,
I am sorry for disturbing you. I have a glinet router and I found that it has adguard home installed. I just wonder to know why it requires a domain and a TLS certificate in order to use encrypted DNS. What is the difference compared to the other services that do not use it? Can I avoid to use it?
Thank you

[tk1475]

There are two different "encrypted DNS" directions, and only one of them needs a domain and certificate.

1. AdGuard Home acting as an encrypted DNS server (Settings > Encryption settings). Here your devices connect to AdGuard Home over DoH/DoT/DoQ. Those protocols run on TLS, so the server has to present a certificate that matches a name the clients connect to, the same way any HTTPS website does. That is why it asks for a domain and a cert (Let's Encrypt works fine). The wiki also notes it does not make much sense to set this up only for your own LAN, it is mainly for using your AdGuard Home from outside your network: https://github.com/AdguardTeam/AdGuardHome/wiki/Encryption

2. AdGuard Home talking encrypted DNS to its upstream (Settings > DNS settings > Upstream DNS servers). This needs no domain or certificate on your side. Just use encrypted upstream addresses, for example:

https://dns.cloudflare.com/dns-query
tls://dns.quad9.net
quic://dns.adguard-dns.com

Supported formats are listed here: https://github.com/AdguardTeam/AdGuardHome/wiki/Configuration#upstreams

So yes, you can skip the Encryption settings entirely. Devices on your LAN keep using the router as plain DNS (that traffic never leaves your home), and AdGuard Home encrypts everything it sends out to the internet. The public services you are comparing with already have their own domain and certificate, which is why you never had to provide one there.

[tk1475]

The bootstrap servers are expected to stay. They are only used to look up the IP address of your DoH/DoT upstream hostnames (for example dns.quad9.net), not to answer your normal queries. That is why the field can't be empty when you use encrypted upstreams.

For the plain entries in the Query Log, the Upstream address in the details tells you where they went:

• Your router or another private IP, usually on reverse lookups like x.x.168.192.in-addr.arpa: those are private PTR requests. They go to Private reverse DNS servers (same settings page), or to your OS resolvers if that is empty. They stay inside your network, so plain DNS is fine for them.
• A public plain address like 9.9.9.9:53: then that server is still listed under Upstream DNS servers, so remove any line there that doesn't start with https://, tls:// or quic://.

If you can share one of those log entries (the domain and the Upstream value), it is easy to tell which case it is.

[alfredonodo]

You can find some screenshots here.

[Dynamic5912]

You can find some screenshots here.

They all look fine

[Dynamic5912]

Plain DNS is how it is being received from the client.

The client is sending it as Plain DNS to AGH, but it is resolving externally via DoT/DoH servers you have specified.

[alfredonodo]

Thank you, so I suppose you’ve answered all my questions.

[alfredonodo]

Thank you very much for your detailed reply. I had misunderstood what encrypted DNS meant. Glinet is now showing me that I am using the DoT and DoH servers I selected on adguard home. My final question is: how can I actually check whether I am really using these DNS servers, or whether a fallback is being used instead?

[alfredonodo]

The router indicates that I am using the correct server; however, both the query log and https://dnsleaktest.com/ show that I am not using an encrypted DNS. All queries are in plaintext, and the website lists i3D.net as my ISP.
I have tried using several browsers, including firefox and brave, with built-in DoH disabled. If I enable built-in DoH, the web site correctly identifies, for example, cloudflare or nextDNS.

[Dynamic5912]

What is it showing when using Quad9 in AdGuard Home?

It should show Woodynet as the DNS servers.

[alfredonodo]

It shows me i3D.net as ISP.

[Dynamic5912]

Is that the DNS servers?

A screenshot would really help.....

[alfredonodo]

I found that i3D.net is of quad9.