3

I want to perform tasks other than web browsing over Tor, for example XMPP chat. I don't want to have to rely on a Tor implementation in the applications themselves, but I do want to avoid leaking my IP address directly or via DNS lookups. (I understand that I'll still be relying on the application and protocol to not disclose my identity/location in other ways, e.g. fingerprinting.)

If I access remote servers using only .onion addresses (hidden services), will I avoid any leaks? In other words, because it's a .onion address there won't be any regular DNS lookups, IP accesses, etc.

Improve this question

2 Answers 2

Reset to default
6

No, .onion's are not exempt from DNS leaks.

Since it's possible for people to run local DNS gTLDs, DNS infrastructure will generally respect and dutifully perform lookups for invalid domain names. DNS itself is agnostic to the gTLD being valid or not, with a few exceptions (for example .invalid should always fail).

There is an RFC covering .onion which should stop DNS leaks from propagating, RFC 7686 but it isn't widely implemented yet (anyone except Firefox?) and even if it were I wouldn't rely on the implementation of it in some software to stop DNS leaks. Even if the upstream DNS did drop the request because of it's .onion gTLD, it has still already leaked:

A legacy client may inadvertently attempt to resolve a .onion name through the DNS. This causes a disclosure that the client is attempting to use Tor to reach a specific service. (RFC 7686)

If DNS leaks are a concern you should take appropriate steps to ensure that they cannot happen in the first place, by using a packet filter (e.g. blocking outbound 53/{tcp,udp} and using Tor's DNSPort) or any other suitable means.

Improve this answer
1
  • agreed! actually, dot-onions are JUST a naming conventions/protocols... And they're protecting your leaks the very same-best like dot-com's
    – Alexey Vesnin ♦
    Commented May 23, 2017 at 21:26
-1

Tor makes use of hashed TLDs and this makes the DNS query secure but not leak proof , the usr ultimately has to rely on the relay nodes in every case

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .