Why I test dns servers with tor and always show google dns or open dns

Question

Why I test dns servers with tor and always show google dns or open dns? is it mean tor is not anonymous any more?

Answer 1

A Tor client does not know where or how any DNS record will be resolved. It hands off this resolving to some exit relay. Infact, in the best case scenario (because it's less likely to result in applications leaking DNS) the client doesn't even care about DNS, it simply hands off the hostname and lets the other side handle it.

From tor-spec.txt:

6.2. Opening streams and transferring data

To open a new anonymized TCP connection, the OP chooses an open circuit to an exit that may be able to connect to the destination address, selects an arbitrary StreamID not yet used on that circuit, and constructs a RELAY_BEGIN cell with a payload encoding the address and port of the destination host.

[...SNIP...]

Upon receiving this cell, the exit node resolves the address as necessary, and opens a new TCP connection to the target port.

Alternatively, it's possible to explicitly request an exit relay to resolve an address:

6.4. Remote hostname lookup

To find the address associated with a hostname, the OP sends a RELAY_RESOLVE cell containing the hostname to be resolved with a NUL terminating byte. (For a reverse lookup, the OP sends a RELAY_RESOLVE cell containing an in-addr.arpa address.) The OR replies with a RELAY_RESOLVED cell containing any number of answers.

This means that the mechanism for resolving hostnames is entirely entirely at the exit node. Tor uses libevent's eventdns as an asynchronous, caching DNS resolver internally and by default that will use the operating systems DNS resolver, although this can be managed through the ServerDNSResolvConfFile option in torrc.

There are definite problems with one entity seeing large portions of Tor circuit destinations and there are further still problems with public DNS providers applying censorship and even NXDOMAIN hijacking, resulting in degradation or denial of service for Tor users.

There have been multiple calls to various mailing lists and even the Tor Project wiki to ask users to diversify their DNS servers but unfortunately it's often not heeded or it's overlooked, and so defaults prevail.

For further reading, I'd recommend Philipp Winter's summary of various studies and effects.

Answer 2

If they are not explicitly set on your system, then - in case of utilization of Tor's DNSPort internal resolver - it uses the actual resolver of the exit node, and it's a quite common case to set Google DNS or other open DNS solution servers on a server. It has it's security concerns, mentioned here, for example - but it's not a serious issue.

As for my personal opinion - a local recursive DNS without ISP forwarding is a good solution for exit nodes.