I am finally at network where ISP hijacks DNS and I can test IPfire on this network. I hoped I will see that when I use IPfire, I can reach DNS without censorship but it seems it doesn’t work, DNS is still hijacked.
My IPfire is version 183 and running at RPI. It has enabled one DNS server, “dns.quad9.net”, DNS server is 9.9.9.9. When I run validation test, I see green OK and note that DNS server is DNSSEC validating.
I know that ISP is transparently hijacking DNS traffic, I hope they do that to protect customers from some viruses those modify DNS configuration.
There is a simple test to check if DNS is hijacked:
$ host on.quad9.net 9.9.9.9
Using domain server:
Name: 9.9.9.9
Address: 9.9.9.9#53
Aliases:
on.quad9.net is an alias for no.quad9.net.
no.quad9.net has address 216.21.3.104
no.quad9.net has IPv6 address 2620:0:871:9000::104
When the answer has line on.quad9.net is an alias for no.quad9.net., it is a sign that DNS traffic is hijacked. When DNS traffic is not hijacked, I see on.quad9.net has address a.b.c.d
I hoped that when I will login to IPfire console and run host on.quad9.net, I will receive answer that shows that DNS traffic was not hijacked (because DNS of IPfire was configured to use “QUAD9 DNS server”. Unfortunately, I see answer with on.quad9.net is an alias for no.quad9.net, DNS traffic is still hijacked… 
IPfire doesn’t solve the problem of hijacked DNS traffic. The computers in the LAN connected to IPfire cannot pass test at page “https://on.quad9.net/”
Do I miss something?
Other test for DNS hijacking is this one:
dig +short ch txt id.server. @9.9.9.9
When the command returns empty answer, DNS traffic is hijacked…
Details are described in the FAQ
Other interesting observation. It seems like IPfire cannot resolve “.net” hosts when I disable all DNS servers in IPfire; I force IPfire to DNS recursive mode. I am not sure what is source of this problem, it could be related to the issue that DNS traffic is hijacked by the ISP. DEMO:
I cannot resolve “.net”:
[root@rpifire ~]# host quad9.net
Host quad9.net not found: 2(SERVFAIL)
I can resolve it when I use other well known DNS; well known is important, some small DNS servers are blocked by ISP…
[root@rpifire ~]# host quad9.net 1.1.1.1
Using domain server:
Name: 1.1.1.1
Address: 1.1.1.1#53
Aliases:
quad9.net has address 216.21.3.77
quad9.net has IPv6 address 2620:0:871:9000::77
quad9.net mail is handled by 5 mx1.quad9.net.
quad9.net mail is handled by 20 mx2.quad9.net.
quad9.net mail is handled by 10 mx4.quad9.net.
When I try other domain, like ‘.one’, no issue:
[root@rpifire ~]# host one.one.one.one
one.one.one.one has address 1.1.1.1
one.one.one.one has address 1.0.0.1
one.one.one.one has IPv6 address 2606:4700:4700::1111
one.one.one.one has IPv6 address 2606:4700:4700::1001
The same for .org:
[root@rpifire ~]# host linux.org
Host linux.org not found: 2(SERVFAIL)
[root@rpifire ~]# host linux.org 1.1.1.1
Using domain server:
Name: 1.1.1.1
Address: 1.1.1.1#53
Aliases:
linux.org has address 172.67.73.26
linux.org has address 104.26.14.72
linux.org has address 104.26.15.72
linux.org has IPv6 address 2606:4700:20::681a:e48
linux.org has IPv6 address 2606:4700:20::681a:f48
linux.org has IPv6 address 2606:4700:20::ac43:491a
linux.org mail is handled by 10 mx1.improvmx.com.
linux.org mail is handled by 20 mx2.improvmx.com.
UPDATE. I fixed it! I missed something important. My IPfire was using UDP protocol to query DNS servers. I switched DNS to TLS mode and I see that my queries are not hijacked anymore. Good… I run my IPfire on RPI without battery, I assume I will have a serious problem after next reboot, when correct time will be lost and IPfire will not be able to fetch correct time from the internet because TLS protocol requires correct time at host to resolve DNS name of NTP server…
DNS was switched to TLS mode and I can pass “quad9” hijacking test:
[root@rpifire ~]# host on.quad9.net
on.quad9.net has address 216.21.3.77
on.quad9.net has IPv6 address 2620:0:871:9000::77
Host on.quad9.net not found: 2(SERVFAIL)
