Setting up your own DNS server with Pi-Hole

While looking through my custom DNS server settings you might have noticed I actually have 1.1.1.1 as my secondary DNS server with my local 192.168.x.x being first. I went a step further of setting up pi-hole's DNS server in my local network and am using it as my primary DNS server when at home.

DNS

Pi-Hole has stricter filtering rules than of the more neutral CloudFare's DNS server which in our day and age can't be too strict. Also since I'm in control of this DNS server I can trust it completely, unlike other public pi-hole servers which might be secure but also might be not. In case you have the option to setup your local DNS server - I highly recommend doing it, especially since pi-hole makes it easier to do, you'll just need a local server or even a VM to run it on. If you're using only one device, technically you can run it even off your machine and connect to it there as well, but having a separate solution is still nicer, especially so you can connect other device to your local ads filtering DNS server, and have faster and safer Internet in all the apps and services you use on all of your devices.

But what if you are browsing the web not from your home and still want to use all of the advantages of custom DNS servers, especially on iOS when there is no way of overriding your carrier's DNS? On Android using a local filtering VPN service is your best bet. There are few options for your desktop OS and only on iOS apparently the single solution is to use what is called DNSCrypt. But at least the option count on iOS is greater than zero 🙂

Custom DNS on iOS via DNSCrypt

DNSCrypt

In previous posts about adblockers and VPNs for iOS I covered all the pros and cons of both approaches. TLDR: on iOS adblockers help you only in the browser but barely improve your privacy, whereas VPNs do both well but at the expense of your Internet speed, both on cellular and Wi-Fi.

After going through blockers, I mentioned setting custom DNS servers as a mean of filtrating ads and trackers on the domain name level. And you can do that fairly easily on Mac, iOS and Android while being connected to the Internet via Wi-Fi but you can't do that on cellular.

...Actually there is a chance and it's called DNSCrypt. In short this is a way of communicating with a DNS server not via regular DNS protocols which your carrier and your mobile device don't let you adjust. The connection to a DNS server of your choice is established via HTTPS, so it's secure, and you can customize it. The only requirement is that your DNS provider of choice should support resolving domains via HTTPS (usually 443 port) in addition to the usual 53 DNS port.

Luckily, my 1.1.1.1 DNS server of choice (provided by CloudFlare) supports DNS queries via HTTPS as well. So the only thing I had to do is to install DNSCloak for iOS, find 1.1.1.1 in the supplied list of DNSCrypt-enabled DNS servers and push 'start'. That establishes a 'VPN' connection which is not actually VPN since it doesn't send all your traffic to another server, just the DNS queries. And as a result you get your ads and trackers filtered on a domain level, without the downside of speed decrease which all traditional VPNs have in common.

As a recommendation you can make your DNSCrypt connection to be more stable. To do that open Settings.app, then go to General -> VPN, tap the 'i' button next to 'DNSCloak' and then switch on 'Connect On Demand' at the bottom.

In case you have your own pi-hole DNS server facing the open Internet (which you should do carefully or don't do at all), or you know a public one you can trust - you can enable it in DNSCloak and have even more strict DNS filtering than Google or CloudFare provides. They are public DNS servers and they are more conservative on filtering out stuff not to accidentally block websites used by the general public (e.g. blocking Facebook's tracking 'like' buttons may block Facebook at all). But that doesn't mean your pi-hole DNS server of choice can't be more strict 🙂

Custom DNS Servers

In my summary of iOS adblockers I brought up a topic of using custom DNS servers as a better way of limiting ads and tracking and here's why. On iOS this method allows to limit them even outside Safari, which is very good news, since there are no actually working ways of keeping other apps and services from tracking you unless you jailbreak your device.

DNS

I'll be getting into details of setting custom DNS Servers and DNSCrypt on iOS since it's the most limited platform in terms of options. All of the steps below are available on Windows, Mac and Android as well, which makes it the most versatile option for the most devices possible.

So what is a DNS? DNS is abbreviated from Domain Name System - it's a special network of servers which purpose is just to resolve domains. What that means is that when you enter any address in your browser, or any app or service that you're using connects to its service via a domain, your device which allows that connection connects to its DNS server and asks for the IP address of the domain you're connecting to. If you open google.com, your computer or mobile phone asks the IP address of the domain, receives 216.58.215.78 and connects your browser to it. But if for some reason the DNS server doesn't resolve your DNS request, your browser won't know where to connect and as a result you won't see anything. This is exactly what can be used not to see ads.

DNS is a hierarchical network with few root servers at the top. The system is built to be fail safe with backup servers in each node, but from its nature there were times when a portion of them went down making parts of the Internet inaccessible to some users. For that reason ISPs (Internet service providers) have their own copies of the main DNS servers in case they might temporary fail. They keep those copies up to date with the main servers so when there's an outage the IPSs' users won't feel anything since their DNS queries will still resolve on the ISP servers. Also potentially resolving your DNS queries in place speeds up your loading speeds comparing to the situation when your DNS query would go further than your ISP servers which would just take longer to do.

Usually when you connect your device to any router, it will give you static IP addresses of the DNS servers the router is set up to share. The routers of your ISP are pre-set with their DNS servers, the same happens when your phone gets cellular connection - phone's DNS servers are also set for you. And most ISPs in order to keep users away from messing up with their Internet keep those DNS IP addresses hidden from change.

But why would you want to change your DNS servers? Well there are few reasons for that:

  1. Your DNS provider (most often your ISP) has his own non-objective interests in mind. If it's a governmental ISP in Russia, they might wanna block their subjectively harmful websites, and not resolving the DNS query for those domains is an easy way of doing it. Your browser would just tell you that it 'couldn't resolve host name'. Or if your ISP provides additional services, they might just block their online competitors that way, leaving you out only with the options they want you to have. These examples are a bit extreme, but worth mentioning since all of the scenarios are easily possible. Even though when blocking, ISPs do a bit further and just block all the traffic to specific resources and not just DNS queries. And in that case only VPNs are your only option to get around the limitations.
  2. Your DNS provider has less incentive than you on blocking ads and trackers since it sometimes might break the website you're watching or maybe your ISP shareholders are also partial owners of an advertising group, etc. And this is where your custom DNS server might help you out when your ISP won't, by setting up few rules not to resolve the domains which usually serve ads or track your online behavior and identity and afterwards sell that information again to advertisers.

As mentioned before the DNS system consists of root and other big servers that resolve people's queries from all over the world. But not only your ISP has a copy of the domain names and their IP addresses. Any private company or even regular people can set up their own DNS server. The only difference is that the root servers are operating mostly independently, following objective rules and are considered safe to be used by everyone, unlike some Joe's public DNS server. Big companies also have their own DNS servers, in particular Google with its 8.8.8.8 and CloudFare (cloud service provider) with 1.1.1.1. And even though Google is a trusted company, I wouldn't trust them to resolve my DNS queries, even though they probably filter out malicious ones for good reasons, but their core business is about ads, so they may be doing that for competitive reasons, filtering competition out, and leaving only their own domains responsible for tracking 🙂

That's why after CloudFare revealed their DNS few months ago I started using them right away, since their core business relies on making the Internet faster and safer not as a byproduct of serving ads. I couldn't switch my router to serve their DNS to all my home devices since my ISP hid the option, so I had to setup all my devices manually.

DNS-Mac

It's very easy doing it on Mac OS: you go to Settings.app -> Network, push 'Advanced' on your connection of choice (Wi-Fi, Ethernet, etc.) and on the 'DNS' tab add 1.1.1.1 and confirm the changes - that easy! You can repeat it on all of your Macs and PCs and this setting will stay even while connecting to other wireless or wired networks, neat!

On Android and iOS the DNS setting is per each wireless network. So if you use few on a constant basis - unfortunately you will have to repeat this process for each of the networks: open Settings.app -> Wi-Fi, tap on the 'i' icon next to your connected network and then on 'Configure DNS' at the bottom, select 'Manual' and enter 1.1.1.1 as well. Save changes, enjoy your faster and more secure Internet 🙂

DNS-iOS

The setup on Android is almost identical and I'm sure you will find it after going through the same sequence.