Original URL: http://www.theregister.co.uk/2011/12/08/dns_crypt/
OpenDNS puts crypto in beta
DNSCrypt tries to block snooping
While the world slowly implements DNSSec in the backbone of the Internet, OpenDNS has put forward its solution to securing the user-side of DNS, with the preview version of a DNS encryption tool.
DNSCrypt only works on Macs at the moment. According to OpenDNS, the idea is to encrypt all users’ DNS requests, preventing nasties like man-in-the-middle attacks, and snooping of DNS traffic (such as would be mandated by any government seeking to block citizens’ access to a particular class of Website, whether over concerns about decency or piracy).
Schemes that demand site-blocking based on an ISP failing to resolve the site, for example, would fail if the user’s request is sent encrypted to OpenDNS as the resolver.
OpenDNS emphasizes that it’s not trying to replace DNSSec. The latter provides authentication of the DNS record returned to the user, along with a chain of trust back to the source record. DNSCrypt, the company says, is just a cryptographic wrapper around communications between its customers and its servers.
The preview release is available here. ®