Resolving names with Tor

The DNS protocol has some time, the RFC which define it, 1034 (concepts and facilities) and 1035 (im­ple­men­ta­tion and spec­i­fi­ca­tion) are from 1987 and like in all the protocols of that time, security in the co­mu­ni­ca­tion wasn't a priority, anyone sniffing the network can see which domains visit everyone, let alone the providers of the DNS service, but it has little solution in the short run, Internet depends on this name sistem and there isn't another better with the required in­fra­struc­ture, right?

Well, it seems that the Tor SOCKS proxy interface offers a non standard option (point 2) which allows to use this network to resolve names, this func­tion­al­i­ty can be accessed from the command line through tor-resolve, this capability can be exploited to build a private DNS server which don't filter the domain name lookups to the network.

Using Twisted is simple to build a this DNS server to use the Tor network as a resolver backend (is going to be limited to the A and AAAA records), this is im­ple­ment­ed in Onion-dir (At Gitorious | At Github).

This may be used adding the parameter DNSPort 53 to the /etc/tor/torrc file, the per­for­mance may look like an issue but after testing it the results were pretty good, to a local bind9 server it takes ~52s to solve every IP from the "100 most popular webs" and Tor does it in ~58s (both times with the cache empty), with cached results it takes ~2.8s for both.

But there is some problems looking up domains like _xmp­p­con­, the Google XMPP server, domains which on the other hand actually doesn't exists.

$ dig @

; <<>> DiG 9.8.1-P1 <<>> @
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 54080
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;        IN  A

;; AUTHORITY SECTION:      60  IN  SOA 1523590 21600 3600 1209600 300

;; Query time: 87 msec
;; WHEN: Fri Jun 14 19:44:34 2013
;; MSG SIZE  rcvd: 97

And that seems the main problem left...