#language en

##TAG:TRANSLATION-HEADER-START
~- [[DebianWiki/EditorGuide#translation|Translation(s)]]: [[FreedomBox/Manual/NameServices|English]] - [[es/FreedomBox/Manual/NameServices|Español]] - [[uk/FreedomBox/Manual/NameServices|Українська]] -~
##TAG:TRANSLATION-HEADER-END

<<TableOfContents()>>

## BEGIN_INCLUDE

== Name Services ==

Name Services provides an overview of ways the box can be reached from the public Internet: domain name, Tor Onion Service, and Pagekite. For each type of name, it is shown whether the HTTP, HTTPS, and SSH services are enabled or disabled for incoming connections through the given name. It also shows and allows configuring how !FreedomBox performs domain name resolutions.

=== systemd-resolved ===

From release 24.19, !FreedomBox uses systemd-resolved as caching DNS resolver and replaces resolvconf for managing DNS server configuration. This improves privacy and security. Newer installations will come with systemd-resolved and older machines will automatically switch after an upgrade to this new release.

systemd-resolved automatically acquires DNS servers from Network Manager, the default and recommended way to configure networks on !FreedomBox. However, if you are manually managing network configuration by editing /etc/network/interfaces, you will need to ensure that the DNS servers acquired are passed on to systemd-resolved. Otherwise, Fallback DNS servers will be used. See below.

=== Support for DNS-over-TLS and DNSSEC ===

systemd-resolved supports DNS-over-TLS. This protocol allows encrypting DNS
communication between !FreedomBox and the DNS server if your DNS server
(typically provided by your ISP, sometimes a separate service) has support for
it. This improves both privacy and security as it makes it harder for
intermediaries to see the communication or manipulate it. New settings for
enabling DNS-over-TLS are available at the global level (for all network interfaces) in Name Services app and at the per-connection level in the Networks app's connection settings.

systemd-resolved supports DNSSEC. This standard allows website owners to sign
their DNS records allowing clients to authenticate them. This improves security
by making it harder to manipulate DNS responses. If your DNS server supports
this feature, it can be turned on. New setting for enabling DNSSEC is available
in the Name Services app.

You can detect whether your current DNS supports DNS-over-TLS and DNSSEC by turning them on in the settings one at a time and running the diagnostics for the Names app. There is a diagnostic check which detects whether you can successfully resolve the domain name deb.debian.org.

=== Setting a custom DNS server ===

If your current DNS server provided by your ISP does not support DNS-over-TLS or DNSSEC
features, is censoring some domains names, or if you don't trust them enough,
you can instead use one of the publicly available DNS servers. This can be done by
editing network connections in the Networks app and adding DNS servers manually.
You will need to deactivate and re-activate the network connection (or restart
!FreedomBox) for the settings to become active. After this, Names app will show you the
currently configured DNS servers.

=== Fallback DNS servers ===

In some cases, when internet connection is available to the system by no DNS servers are known to systemd-resolved, the fallback DNS servers are used. This may happen, for example, due to misconfiguration when manually managing network configuration instead of using !FreedomBox's default, the Network Manager. These fallback DNS servers, as defaulted by the upstream systemd project, include servers from Cloudflare and Google DNS servers. This has privacy implications but we felt that it was important to avoid !FreedomBox from becoming unreachable due to misconfiguration. It was a difficult decision. Once you have proper DNS configuration and you know that it works, you can turn off fallback DNS servers using a new setting in the Privacy app. There is also a renewed notification in the web interface that will attract your attention towards this. You may also edit the list of Fallback DNS servers by creating a configuration file for systemd-resolved. See [[https://www.freedesktop.org/software/systemd/man/latest/systemd-resolved.html|systemd-resolved documentation]].

## END_INCLUDE

Back to [[FreedomBox/Features|Features introduction]] or [[FreedomBox/Manual|manual]] pages.


<<Include(FreedomBox/Portal)>>

----
CategoryFreedomBox
