Is it a better practise to use DNSCrypt over Tor or is it useless?

Question

DNSCrypt already gives you a protection layers against Man-in-the-middle attacks and should obscure your the traffic your ISP sees.. is it, combined with Tor, a good extra protection or does Tor already cover that and could go in conflict?

Answer 1

DNSCrypt does not give you protection against man-in-the-middle attacks, it just moves where the man-in-the-middle would need to be. For example, if the man-in-the-middle existed between your upstream resolver and the authoritative DNS servers for the domain or between them and some recursive resolver or between their upstream recursive resolver and the authoritative DNS resolver for the traffic. You're not removing the risk, you're just changing where they'd have to be to perform it.

It will stop your local ISP from seeing your DNS lookups but it does mean that whoever is running the DNSCrypt server will see them instead, you're not removing the information of what you resolve and when from being linked to you, you're just changing who sees it.

Tor itself can perform resolves for A, AAAA and PTR records. For most desktop use cases this is a sufficient set of DNS record types to operate with. You can set this up using the DNSPort option in your torrc and setting your DNS resolvers to be 127.0.0.1, for example.

If however you have requirements that mean you need other DNS record types or you think that DNSSec is actually useful or practical and secure (lol) and you want to ensure that what you resolve and when isn't known to your ISP and ensure that the DNSCrypt server operator doesn't know who is resolving what or when, then you should run DNSCrypt over Tor. Note that even this isn't protecting you from man-in-the-middle attacks, you're still just as vulnerable to them as you are from using DNSCrypt without Tor, this just unlinks you from the resolves.

Also note that DNSCrypt tunnels that are made will link all your resolves together, so if you resolve a series of sites like your bank, your place of employement and your personal webpage then your secret forum where you plot to sell delicious cookies on the derpwebs then people might conclude: All these requests came from one entity, the list of candidates is very short and includes you, and therefor you are a strong candidate for being the derpweb cookie vendor.