DNS Over TLS Connectivity Checks

rclemmer

Is there any plans to stop Googles connectivity checks via DoT?
When I check NextDNS I see multiple connections to *dnsotls-ds.metric.gstatic.com
From what I have researched, the OS is making connectivity checks to random Google servers to verify a connection via DoT. It may or may not be a privacy/security concern, but connecting to Google in any way concerns me.

GrapheneOS

rclemmer That's incorrect. You're viewing a log of DNS queries, not connections. Connections can be made without making DNS queries and DNS queries can be made without making connections based on the result as is the case here. These are connections to your DNS resolver, not a connection to a Google service as you're incorrectly stating above. We're still in the process of replacing the names when in the GrapheneOS connectivity check mode so that users don't wrongly think there are connections that aren't being made rather than any real purpose. No connections are made based on the result of these DNS queries. It solely exists to test that the DNS-over-TLS or DNS-over-HTTPS resolver is able to resolve an arbitrary name. The queried names are samples and the result is unused beyond verifying that the results includes at least one IP.

rclemmer

I see "dnsotls-ds.dnscheck.grapheneos.org" but I also see Google requests as well

matchboxbananasynergy

All actual connections that are made by default are documented here:

https://grapheneos.org/faq#default-connections