letsdane VS rethink-app

The easiest way to do this is to use letsdane https://github.com/buffrr/letsdane

Easiest way would be to deploy LetsDane and then allow a user to set the DoH server for the LetsDane proxy to use: https://github.com/buffrr/letsdane

P.S. Does anyone know why "humbly/" isn't working with HTTPS either? It's the same error that I'm getting. According to https://github.com/buffrr/letsdane, 3b/, letsdane/, proofofconcept/ and humbly/ all have DANE enabled. "humbly" appears to be configured properly (DNSSEC, SSL cert w/ matching TLSA), but I get the same SSL error when trying to resolve with Fingertip. Anybody else??

To securely access an HNS domain using DANE, extra software is required (until we get DANE browser integration!): https://github.com/buffrr/letsdane

Yes but you need a HNS resolver, which can also resolve legacy DNS names. So I have hsd installed on a raspberry pi on my home network, and another running on a VPS -- I set all my devices to make DNS requests from those servers. Set once and forget: now I can visit all HNS names as well as every DNS website. There some caveats to this, and the biggest issue is SSL / TLS / https but we have a solution for that as well: https://github.com/buffrr/letsdane All web browsers work fine with HNS names, but until a major browser implements native DANE verification, the middleware proxy is required.

We are aware of connectivity issues with WireGuard (ref) that we've fixed in yet-to-release version v055b. Please wait until that's out (2 days? 3?) (:

Noted. Thanks.

Also, crafting nice UI isn't our strong suit. One look at our github issue tracker (ex) and you'd know. We try our best, though (:

sky is a stub resolver, which after stripping out all request information, forwards the dns query to both Cloudflare and Google DoH servers (code), and replies from which ever responds back the fastest. Both the client app and the resolver (server) are open source, so if you find any leaks and know what's up, we're open to changes.

Could, but it'd clutter the Settings screen? Probably, Rethink could let expert users enter arbitrary IP subnets to exclude / not route? This setting will be a footgun, though! Regardless, I've noted it: https://github.com/celzero/rethink-app/issues/899

I believe it is a bug with okhttp, a library we use internally for blocklist updates: https://github.com/celzero/rethink-app/issues/875

NetGuard can block tracker and ad (albeit very basic), so you can use it on its own without Blokada. Or you can use the AdGuard app instead which has both firewall and (complete) adblocking feature. If you prefer open source app then check Rethink https://github.com/celzero/rethink-app

First one is Rethink DNS: https://github.com/celzero/rethink-app to manage and block domains when apps connecting to internet (similar to Blokada, Adguard...). Here that calculator app connects to googletagmanager after installing and opening.

In v054b, we're planning to switch back to the old behaviour -- of domain names blocked during DNS name resolution instead of (translating it to IP rules) at TCP / UDP connection time -- if the user has not set any per-app domain name rules and if the user is not using Bypass DNS and Firewall setting for any app: https://github.com/celzero/rethink-app/issues/817