From bd93da0d4722c24fb82121eafae32506168a60b2 Mon Sep 17 00:00:00 2001 From: Daniel Micay Date: Fri, 28 Feb 2020 21:47:22 -0500 Subject: [PATCH] clarification about DHCP --- static/faq.html | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/static/faq.html b/static/faq.html index 7954b391..ab6b74cb 100644 --- a/static/faq.html +++ b/static/faq.html @@ -368,11 +368,11 @@

By default, in the automatic mode, the Private DNS feature provides opportunistic encryption by using DNS-over-TLS when supported by the DNS server IP addresses - provided by the network or the static IP configuration. Opportunistic encryption - provides protection against a passive listener, not an active attacker, since they can - force falling back to unencrypted DNS by blocking DNS-over-TLS. In the automatic mode, - certificate validation is not enforced, as it would provide no additional security and - would reduce the availability of opportunistic encryption.

+ provided by the network (DHCP) or the static IP configuration. Opportunistic + encryption provides protection against a passive listener, not an active attacker, + since they can force falling back to unencrypted DNS by blocking DNS-over-TLS. In the + automatic mode, certificate validation is not enforced, as it would provide no + additional security and would reduce the availability of opportunistic encryption.

When Private DNS is explicitly enabled, it uses authenticated encryption without a fallback. The authentication is performed based on the hostname of the server, so it