silence dns response comments?

[hyder365]

Is it possible to disable these additional comments dnscrypt-proxy is handing out? @jedisct1

$ host example.com
example.com has address 93.184.216.34
example.com host information "AAAA queries have been locally blocked by dnscrypt-proxy" "Set block_ipv6 to false to disable that feature"

$ host doubleclick.net
doubleclick.net host information "This query has been locally blocked" "by dnscrypt-proxy"

[jedisct1]

No, but why?

These are very useful in order to understand why something doesn't work as expected.

Incidentally, that very message helped me last week to understand why I couldn't reach an IPv6-only website, after initially thinking it was a DNS configuration error on their side.

[hyder365]

This seems like a misfeature. I don't want the users to know exactly what software is running on the host, similar to unbound's "hide identity" option.

It would be better in my case if the users did not know why something was "wrong" because nothing is actually wrong in this setup.

Would you consider an opt-in or opt-out config option so users can decide?

[lifenjoiner]

Maximum anonymity?

[jedisct1]

Using open source software is not a shame.

[lifenjoiner]

I guess you want:

dnscrypt-proxy/dnscrypt-proxy/example-dnscrypt-proxy.toml

Lines 141 to 146 in d48c811

	## Response for blocked queries. Options are `refused`, `hinfo` (default) or
	## an IP response. To give an IP response, use the format `a:<IPv4>,aaaa:<IPv6>`.
	## Using the `hinfo` option means that some responses will be lies.
	## Unfortunately, the `hinfo` option appears to be required for Android 8+
	# blocked_query_response = 'refused'

But, block_ipv6 doesn't follow this. Don't know it is a negligence or intentional.

dnscrypt-proxy/dnscrypt-proxy/plugin_block_ipv6.go

Lines 37 to 44 in d48c811

	hinfo := new(dns.HINFO)
	hinfo.Hdr = dns.RR_Header{
	Name: question.Name, Rrtype: dns.TypeHINFO,
	Class: dns.ClassINET, Ttl: 86400,
	}
	hinfo.Cpu = "AAAA queries have been locally blocked by dnscrypt-proxy"
	hinfo.Os = "Set block_ipv6 to false to disable that feature"
	synth.Answer = []dns.RR{hinfo}

[hyder365]

@lifenjoiner Thank you for the helpful reply. That's definitely an improvement! This does seem like a bug if it's missing for the IPv6 block function.

[hyder365]

blocked_query_response = 'a:0.0.0.0'
block_ipv6 = true

This combination gives me two unneeded lines of output on a blocked domain:

$ host doubleclick.net
doubleclick.net has address 0.0.0.0
doubleclick.net has IPv6 address ::ffff:0.0.0.0
doubleclick.net host information "This query has been locally blocked" "by dnscrypt-proxy"

I think the second one is definitely a bug too. There shouldn't be any v6 response.