Can you provide EDNS Client Subnet support?

[panyichen48737]

Can you provide EDNS Client Subnet support? This is very important to me. Or tell me how to start this feature build

[madnuttah]

I'll take a look at it, thanks for getting in touch!

[madnuttah]

After some reading, I don't see any privacy issues if the module ain't explicitly enabled in the unbound.conf so the --enable-subnet option has been set in the canary build, please test. The image will be available at about 20:00 UTC.

Thank you.

[madnuttah]

Hey @panyichen48737, have you had a chance to test this? Thank you.

[moya2162]

@panyichen48737 I am curious into your use case for this feature. Please explain. 🤔

[madnuttah]

I welcome this discourse a lot, what are your opinions about this especially regarding privacy concerns?

[panyichen48737]

嘿@panyichen48737，你有机会测试这个吗？谢谢您。

I apologize for not getting back to you sooner. I've been swamped lately. I tried it out and it does the trick.

[panyichen48737]

@panyichen48737 I am curious into your use case for this feature. Please explain. 🤔

I am in China and there are many restrictions on accessing foreign websites in China. China's DNS is regulated by the Chinese government and often contaminates it, making access to foreign websites very slow. I use Google DNS to speed up access by making the DNS server return results closer to me via EDNS. That's all, I don't know if EDNS is any better for privacy

[madnuttah]

Out of curiosity, wouldn't it be sufficient to run this image recursively as it's intended with DNSSEC on? Or is the poisoning so heavy you can't reach any site at all then?

Would you mind if I reopen this for a discussion about the issues you are having? This could be of interest also to other people facing the same restrictions.

[panyichen48737]

Out of curiosity, wouldn't it be sufficient to run this image recursively as it's intended with DNSSEC on? Or is the poisoning so heavy you can't reach any site at all then?

Would you mind if I reopen this for a discussion about the issues you are having? This could be of interest also to other people facing the same restrictions.

It's okay.
The Chinese government does not just contaminate the transmission process, but every DNS provider in the country is under their control, and recently they used a firewall to block DNS requests like Google's, which resulted in requests being made only through non-standard or encrypted ports.
You know, Google pulled out of China a long time ago, and all of Google's websites were inaccessible in China, and even GitHub was affected, so I could only access it through VPN.
In addition to using a VPN, I had to get a correct IP address for normal access. Encrypting DNS requests is also required, of course.
The government's response: "To prevent Internet fraud and protect citizens' property safety"
I may have gone a little too far. 😂