DNS TXT verification is done over plain text DNS query
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 9.2k
- Forks
- 1.3k
- Avg merge
- 12h 58m
- Merged PRs (30d)
- 56
Description
My home network intentionally dropped any outgoing dport=53 packet. This seems to cause issue verifying DNS TXT record from Android client.
Digging further, it looks like the code uses Google DNS server: https://github.com/keybase/client/blob/master/go/pvl/interp.go#L460-L464
There are multiple issues:
- The DNS server configured on my Android phone was ignored. This should always be preferred. On my phone, I'm using my own DNS over TLS server (feature available on Android P and above).
- Even if you decide to use Google DNS, you should either use DNS over TLS or DNS over HTTPS to ensure the query is encrypted (I didn't look further, but I assume you are doing DNSSec verification. Even with DNSSec, many domains does not have that enabled)
- It would be great if we can customize the DNS server.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at go/pvl/interp.go lines 460-464 and trace how DNS TXT verification is performed for the Android client. Compare that behavior with the device's configured DNS settings and the requested DNS-over-TLS or DNS-over-HTTPS options. Done means verification no longer depends on an unencrypted port 53 query, while the requested DNS preference or customization behavior is defined and tested.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, go
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100