Dns leaks P8 rdns mullvad

Onlyfun

Hi! Can someone with a p8 and working rdns advanced wireguard(mullvad) share how to set this up so no dns queries leak?
My issue is that mostly every time I check connection on mullvad site dns test shows google mixed with proper mullvad servers.

Onlyfun

Onlyfun
editi.
Just installed a newer version of rdns, did same test, no leaks showing. Issue might be gone, but not necessary, before no leaks tests sometimes happened too. If issue remains will report back.

Onlyfun

Issue remains as suspected, same symptom mullvad connection check returns multiple google servers in dns leak test.

Anybody faced this please share how to correct it!

I believe in my case issue is somewhere on my pixel. Additionally

DeletedUser713

Onlyfun I'm sorry if this is a stupid question, but what exactly is rdns? I only know rDNS as in reverse DNS, but that's not something you can install. If you could clarify this point, I'd be glad to help!

Onlyfun

DeletedUser713 sure. my bad, i did not know there is rDns abbreviation already. By rdns I mean Rethink dns app.

GrapheneOS

Onlyfun You should have the VPN lockdown mode toggle enabled (leak blocking) and Private DNS set to Off.

GrapheneOS

Onlyfun It's a configuration issue or an app bug, not an OS or hardware issue.

DeletedUser713

Onlyfun ah okay, that makes sense.

Well, you'll be surprised probably, but I just installed RethinkDNS on my old Samsung A50 and imported my Mullvad config. And guess what? Leaky DNS. It uses the one I have configured in AdGuard Home, so RethinkDNS doesn't actually respect the Wireguard DNS for some reason. So this pretty much confirms this isn't a GrapheneOS issue.

Onlyfun

GrapheneOS You should have the VPN lockdown mode toggle enabled (leak blocking) and Private DNS set to Off.

Yes indeed.

GrapheneOS It's a configuration issue or an app bug, not an OS or hardware issue.

Absolutely,.

DeletedUser713 I am sure it is an application problem or my misconfiguration. Graphene OS is out of question here, as once rethink is excluded everything works as expected.

With this new version another minor issue is that every reboot a notification 'Warning. Rethink was disabled' appears and network connection does not reestablish itself. Now it needs user to open rethink dns app and press the start button.

Onlyfun

I wasn't able to finish earlier message, so here are few more notes:
I figure that issue is in rdns, cause when I switch dns to 'system dns' queries are routed as expected. Additionally discovered couple anomalies with Cromite browser that i installed recently, to compare dns checks. Somehow Cromite yields positive results much less often than Vanadium, and basing on personal perception the checks complete notably faster. Every launch Cromite asks for memory dcl, which is ignored.

Anomalies are:

Hardened malloc was set to disabled(default) despite system wide it is set to enabled(default).
Site settings> on-device site data(toggled off) there is an exception already which I did not add(actually havent done anything except reaching mullvad site few times). It is a misspelled amazon domain I guess: 'amaznom.com' with a remark below 'http'.

Cromite sourced from official github and is verified by appverifier, via ir's internal d-base.

DeletedUser713

Onlyfun the application doesn't matter at this point. My A50 is running an old Android version, but it still has VPN lockdown mode and Private DNS toggles which are configured similarly.

I can confirm that the device is leaking DNS queries to my underlying resolver. It just straight up uses DHCP option 6 instead of what is set in the .conf.

I find this concerning and would love to hear from @ignoramous what is going on.

ignoramous

DeletedUser713 I can confirm that the device is leaking DNS queries to my underlying resolver ... would love to hear from @ignoramous what is going on.

How are you testing what's leaking queries to the underlying resolver?

Rethink v055o onwards (the current version is v055t) shows ALL DNS queries it itself makes in Configure -> Logs -> DNS. The queries going to underlying resolver are marked with "🦆" (duck emoji) in that UI.

Additionally, on Android 12+, Rethink (the app) can track per-app DNS queries pretty accurately. Searching for the string "rethink" in the search bar in Configure -> Logs -> DNS should filter out queries sent by Rethink (the app). These are usually sent to the underlying resolver by default unless Configure -> Network -> Fallback DNS is set to either Google (dns.google), Cloudflare (one.one.one.one), Quad9 (dns11.quad9.net), or Rethink (the DoH resolver hosted at zero.rethinkdns.com).

DeletedUser713 Well, you'll be surprised probably, but I just installed RethinkDNS on my old Samsung A50 and imported my Mullvad config. And guess what? Leaky DNS.

What Android version? If running WireGuard in Advanced mode on Rethink v055o or later, you'd need to enable Configure -> DNS -> Split DNS to have Rethink route DNS queries to respective WireGuards. On Android 12+, Split DNS has been enabled by default. On Android 11 & below, Configure -> DNS -> Advanced DNS filtering must also be turned ON for Split DNS to work.

DeletedUser713

ignoramous How are you testing what's leaking queries to the underlying resolver?

By checking my AdGuard Home logs.

ignoramous Rethink v055o onwards (the current version is v055t) shows ALL DNS queries it itself makes in Configure -> Logs -> DNS. The queries going to underlying resolver are marked with "🦆" (duck emoji) in that UI.

Yup, I can confirm that pretty much every request (apart from the failed ones) shows a duck emoji.

ignoramous Fallback DNS

Fallback DNS is set to "System"

ignoramous What Android version? If running WireGuard in Advanced mode on Rethink v055o or later, you'd need to enable Configure -> DNS -> Split DNS to have Rethink route DNS queries to respective WireGuards

It's on Android 11. Wireguard is set to "Simple/Easy", not advanced. Thus, DNS is set to "Wireguard" without any option to change it. Split DNS is enabled anyway, but makes no difference.

Onlyfun

DeletedUser713 the application doesn't matter at this point

Which apllication you mean, the browser or rethink dns? In my case browser seems to matter, for some reason Cromite shows less leaks checking on mullvad site.

ignoramous ok, I am checking for dns leaks on mullvad site, there i get multiple google servers mixed with mullvad's. Dns is set to mullvad(extended) fallback is set to rethink. Split dns is on.
By the way, don't split dns and never proxy dns settings conflict if both set to on? Just asking, I have never proxy off.

I also per your advice checked log>search>rethink. All lines contain the duck emoji in the end .Could you clarify what is meant by "system dns” ? Cause whatever it means, it wont explain google servers in my tests. I dont have dns set to google anywhere, not on pixel and not on router(mullvad wireguard there). Secure dns is off in Vanadium and Cromite. Private dns on pixel is off . I just cant come with an idea of what makes my dns queries to be sent to google. By the way, not that long ago I was getting microsoft in same dns tests, not anymore.

Additional question is how sometimes the same test on same browser with same all setting gives clean result with no leaks? For example right now typing this text i checked - no leaks.

DeletedUser720

DeletedUser713 Fallback DNS is set to "System"

so then choose some other, requests that for some reason can't be sent (delay, etc) to your custom dns (if you use that one and not the one provided by vpn) will be served by fallback

DeletedUser720

Onlyfun Additional question is how sometimes the same test on same browser with same all setting gives clean result with no leaks? For

I guess that's environment-cause, at the time of typing, your upstream dns was reachable

DeletedUser720

Onlyfun

What do you have in Configure -> DNS -> Type? (System, Other, Rethink, Smart)?
If it's "smart", then rdns rotates upstream resolvers.

DeletedUser720

ignoramous The queries going to underlying resolver are marked with "🦆" (duck emoji) in that UI.

"underlying" doesn't necessarily mean "system" (dhcp of the underlying network), right?
In my case I see the duck every time the request is resolved by Fallback DNS (rethink or cloudflare, it depends), so I guess if you have some "bypassed" apps, they can drop there.

DeletedUser713

DeletedUser720 I don't understand your approach: Rethink won't use my Mullvad resolver (while it's working fine for literally every other device and app) and you suggest to change my fallback DNS? How is that supposed to help with the initial problem?

DeletedUser720

DeletedUser713

Setting your Configure->DNS->Type and Configure->Network->Fallback DNS won't solve the "underlying problem" whatever it is (environment or the rdns app), it will mitigate your leak to Google or dhcp infra till the moment the root cause is diagnosed/found.
Disclaimer: I'm a regular rdns user, not affiliated with this great foss app.