DNSSEC tests fail when connected to sites thru Eddie

[Baryshnikov 2]

Been a happy AirVPN user for going on 5 years now. I only user your service occasionally for accessing certain sites, but recently became aware of what I think may be an issue. 

First off, when not on VPN all DNS queries run thru Quad9 as primary and Cloudfare as secondary (both are configured on router so the entire family benefits). 

DNSSEC results pass all tests when off of VPN.
DNSSEC results pass 1 test when on VPN.

DNSSEC tests are performed with https://dnscheck.tools
Help file for dnscheck.tool is at https://dnscheck.tools/help

Is this expected behavior? Ive attached screenshots with and without EddieVPN connection.

thanks,
festus

[Treading6603 0]

I have the same question too. 

[Staff 10692]

Hello,

yes, this is expected. When you are connected through Eddie, your DNS queries go to the DNS resolver of the VPN server you are connected to, and this resolver does not perform DNSSEC validation. dnscheck.tools checks whether your resolver rejects records with invalid or missing signatures; ours does not, while Quad9 and Cloudflare do, hence the different results.

This is intentional. Our resolvers modify some answers on purpose: the block lists and custom answers you can configure on the DNS page of the Client Area, the OpenNIC TLDs and some names used by our own services. Altering answers is exactly what DNSSEC is designed to detect and reject, so DNSSEC validation would break these features.

DNSSEC validation is not strictly necessary while you are connected to the VPN. Between your device and our resolver, queries and answers travel inside the encrypted tunnel, so they cannot be forged by your local network or by your ISP. Moreover, for connections protected by TLS, such as HTTPS, a forged answer leads to a certificate error, not to a silent redirection.

If you want DNSSEC validation anyway, you can run your own validating recursive resolver (for example Unbound) and let its queries go through the VPN tunnel. Please note that it must resolve recursively by itself: if it forwards queries to our resolver, validation will fail, because our resolver does not return DNSSEC signatures. You would also lose our block lists, custom answers and OpenNIC resolution.

Kind regards