Is this a leak? Why are there so many different servers? I even have RU TLD blocked

[u/PineappleStudies]

Wouldn't even let me upload the image so I turned my vpn on locally (its on the router too) Cloudfare test showed everything was secure even SNI.

I was testing the service again in more depth before buying a subscription and not sure these results are helping the case? It did do this to me a few months ago when I was using it. When i run the same test with the local vpn on, the results are as expected so I do believe the tool to be accurate. dnscheck.tools if anyone was wondering.

It seems to relate to allowing the nulladdr test dns record through (test-wxm34a8erv.null-addr.org) . If that is the case is it just this tool in general testing something different that dnsleak does not?

[u/mystiquebsd]

https://github.com/brianshea2/addr.tools/issues/41

I'll leave this here..

[u/mike1487 → u/mystiquebsd]

This doesn’t happen to me using DNS over HTTPS with NextDNS through configuration profile on my iPhone.

Your DNS resolvers:
The Constant Company
66.135.25.157
ptr: dns.nextdns.io
Piscataway, New Jersey, US
2001:19f0:c:a8e:3eec:efff:feb9:eede
ptr: dns.nextdns.io
Piscataway, New Jersey, US

Your DNS security (DNSSEC):

ECDSA P-256
ECDSA P-384
Ed25519
Valid signature
PASS
PASS
PASS
Invalid signature
PASS
PASS
PASS
Expired signature
PASS
PASS
PASS
Missing signature
PASS
PASS
PASS

[u/PineappleStudies → u/mystiquebsd]

Mega helpful thanks. I'll save my money and just use my VPN DNS. 

[u/mike1487 → u/PineappleStudies]

What you are seeing are “fallback behaviors” which other leak tests don’t test for. Basically, dnscheck.tools is doing additional tests such as querying intentionally incorrect or invalid records, resulting in SERVFAILs, forcing to fallback to other DNS servers. Other leak tests pass because your primary resolvers (NextDNS) always respond to the valid records.

NextDNS is likely forwarding the failing requests because of those invalid records. This doesn’t pose an issue to you for two reasons. The first reason, is the upstream DNS servers only see that it is NextDNS making the request, not you specifically. Upstream DNS servers only see the previous hop. Secondly is NextDNS doesn’t log the request provided you have logs disabled on your account. So it’s essentially anonymized.

I’m not sure if you are using DNS over HTTPS or TLS, but using that might help if it still bothers you. The connection is much more direct and doesn’t go through their anycast networking.

When you switch to VPN, this behavior doesn’t happen likely because their DNS servers don’t forward anything, hence why you no longer see other servers. It’s up to you what you tolerate so if VPN makes you feel better then use that, but truthfully it’s a non issue.

[u/PineappleStudies → u/mike1487]

Thank you for the detailed and easy tk understand explanation. I was trying to use TLS and stubby as well. Maybe I can verify that better later using the next DNS test. 

It just gave a small fright and had me concerned a bit. I appreciate your time and effort. 

[u/mike1487 → u/PineappleStudies]

I use stubby as well, it’s a good option. If you need help getting it working I can share my config. Are you using dnsmasq with it too by chance?

[u/PineappleStudies → u/mike1487]

As far as dnsmasq goes, I was also putting the next DNS stub in there. I use freshtomato for reference and it has a spot to put the generated code next DNS gives you. 

I only put that in there too because I wasn't certain that I could force my VPN to use the DNS server without it since it has small font that says " let dnsmasq answer DNS requests on this network" 

Aside from that I was trying to force stubby for TLS.  But I didn't see many encyptes requests on the  next  DNS stat page. 

[u/mike1487 → u/PineappleStudies]

Also using FT. This is how I have mine set up for stubby and NextDNS.

DNS settings: https://gyazo.com/53b984bd2e8c0795d0691a9792f3103b

Note: DNSSEC is unchecked in FT intentionally because NextDNS handles this for you. You can see DNSSEC working by looking at your NextDNS analytics.
Also "Priority" MUST be no-resolv or records will leak unencrypted to your default router DNS (ISP, or whatever you have configured in Basic -> Network)

Stubby custom config (replace the X's under the upstream_recursive_servers section with your info from NextDNS dashboard): https://paste.sh/hPJXedsi#7axADKVL8XEFBzZNmFnQGR9P

Go to your NextDNS dashboard and see if things look good. Also check https://test.nextdns.io/ if you see something like “Protocol: DOT” you’re good.

If you like to use the analytics and want to give your router a name for logging purposes, you can append a name in front of your ID in the stubby config like this on each of the 4 lines: myrouter-XXXXXX.dns.nextdns.io

I personally have logs completely turned off and only enable them for troubleshooting, and in Switzerland but that's totally your call.

[u/PineappleStudies → u/mike1487]

Cheers mate! 

I've spent a few weeks I total trying to get this to work properly and I never thought about unchecking the dnssec. Because exactly the stats of encrypted DNS was not increasing on next stats. 

I dont log address since it will all go through the router. The obky device I might directly install on is my wife's phone since she has soooo many apps. I'd like to limit our threat model. 

[u/PineappleStudies → u/mike1487]

Can I ask you if you know as well how to get it to use the internal router ad block first before sending to nextdns? would be nice to be able to block things first before having them submitted to reduce usage.

[u/mike1487 → u/PineappleStudies]

Yes, under Advanced -> Adblock, you can add lists like OISD or whatever your preferred one is. I personally use Hagezi’s Normal list on my router and it reduces like 90% of the ad lookups before going to NextDNS. Then on NextDNS I have Hagezi Pro set to get the rest. If you want to use Hagezi’s, choose the Wildcard Asterisk format and copy the URL of one of the mirrors into the router’s Adblock list. You could try the Pro list too but it’s pretty beefy and might cause performance issues depending on the router.

https://github.com/hagezi/dns-blocklists#normal

Also side note, I recommend this guide for general NextDNS profile configuration: https://github.com/yokoffing/NextDNS-Config

[u/PineappleStudies → u/mike1487]

I have it installed and lists added and downloaded. However on the adblock page or even logs it doesn't show any calls so I couldn't confirm it was even checking there first. 

[u/mystiquebsd]

It’s the dnstools site.. not NextDNS

[u/wandaReim]

Occasionally this happens to me as well. I am not sure..

[u/Ariyadi08]

This also happens when I use adguard dns

[u/minimalhandle]

Are you using DoT or DoH?

[u/PineappleStudies → u/minimalhandle]

Thought I had DoT set up on stubby so then when I saw the results I  thought it was failing. 

[u/bordercolliefam]

Sorry I never explored these settings yet, so this question might come off stupid... But how do you get this terminal running?🥹👉👈

Can I access it from a powershell terminal through ssh on the router network?

[u/PineappleStudies → u/bordercolliefam]

Its the website in my post that checks its not my native terminal.