The Need for a More Aggressive Opportunistic Mode

Oct 13, 2025 by wbrum.org 17 views

Introduction

In today's digital age, the importance of secure and reliable internet connections cannot be overstated. One of the key components of a secure internet connection is the use of DNS-over-TLS (DoT), which encrypts DNS traffic to prevent eavesdropping and tampering. However, when connecting to the internet through a public WiFi with a captive portal, the initial TCP handshake issues can lead to a less-than-ideal experience. In this article, we will explore the concept of more aggressive opportunistic DNS-over-TLS in systemd-resolved and its potential benefits in dealing with initial TCP handshake issues.

The Problem with Opportunistic DNS-over-TLS

Opportunistic DNS-over-TLS is a mode of operation that allows a client to attempt to establish a TLS connection with a DNS server without prior knowledge of the server's support for DoT. While this mode provides a level of security, it can be problematic when connecting to a captive portal. When a captive portal is present, the DHCP server provides a DNS server address, which in this case is 8.8.8.8, a Google public DNS server that demands DoT. However, while the user is filling out the captive portal's authentication form, the systemd-resolved service has already started sending a lot of DNS requests from various applications (cloud, NTP, etc.). These initial DNS requests will only receive an 'RST' response from the captive portal, and therefore fall back on non-encrypted DNS through UDP.

The Need for a More Aggressive Opportunistic Mode

The current opportunistic mode of operation is not aggressive enough to handle situations like the one described above. The user is left with no choice but to use the dnsovertls=true setting, which forces the use of DoT for all DNS requests. However, this can lead to issues when connecting to networks that do not support DoT. A more aggressive opportunistic mode would allow the client to attempt to establish a TLS connection with the DNS server for every single DNS request, without falling back on non-encrypted DNS.

Benefits of a More Aggressive Opportunistic Mode

A more aggressive opportunistic mode would provide several benefits, including:

Improved security: By attempting to establish a TLS connection with the DNS server for every single DNS request, the client can ensure that all DNS traffic is encrypted, even in situations where the initial TCP handshake issues are present.
Reduced reliance on dnsovertls=true: With a more aggressive opportunistic mode, the user would not need to rely on the dnsovertls=true setting, which can lead to issues when connecting to networks that do not support DoT.
Increased flexibility: A more aggressive opportunistic mode would allow the client to adapt to different network conditions, without requiring the user to manually configure the DNS settings.

Implementation

To implement a more aggressive opportunistic mode in systemd-resolved, the following changes could be made:

Add a new configuration option: A new configuration option, such as aggressive-opportunistic, could be added to systemd-resolved to enable the more aggressive opportunistic mode.
Modify the DNS resolver: The DNS resolver in systemd-resolved would need to be modified to attempt to establish a TLS connection with the DNS server for every single DNS request, without falling back on non-encrypted DNS.
Implement a retry mechanism: A retry mechanism could be implemented to allow the client to attempt to establish a TLS connection with the DNS server at regular intervals, in case the initial attempt fails.

Conclusion

In conclusion, a more aggressive opportunistic DNS-over-TLS mode in systemd-resolved would provide several benefits, including improved security, reduced reliance on dnsovertls=true, and increased flexibility. By implementing a more aggressive opportunistic mode, systemd-resolved can better handle situations where the initial TCP handshake issues are present, and provide a more secure and reliable internet connection.

Future Work

Future work could include:

Testing and validation: Thorough testing and validation of the more aggressive opportunistic mode would be necessary to ensure that it works as intended and does not introduce any new issues.
Performance optimization: Performance optimization of the more aggressive opportunistic mode would be necessary to ensure that it does not consume excessive resources or bandwidth.
User interface improvements: Improvements to the user interface would be necessary to make it easier for users to configure and use the more aggressive opportunistic mode.

References

systemd-resolved
DNS-over-TLS
Opportunistic DNS-over-TLS
Q&A: More Aggressive Opportunistic DNS-over-TLS in systemd-resolved ====================================================================

Q: What is the current state of opportunistic DNS-over-TLS in systemd-resolved?

A: The current opportunistic mode of operation in systemd-resolved is not aggressive enough to handle situations where the initial TCP handshake issues are present. This can lead to a less-than-ideal experience when connecting to the internet through a public WiFi with a captive portal.

Q: What is the proposed solution to this issue?

A: The proposed solution is to implement a more aggressive opportunistic mode in systemd-resolved, which would allow the client to attempt to establish a TLS connection with the DNS server for every single DNS request, without falling back on non-encrypted DNS.

Q: What are the benefits of a more aggressive opportunistic mode?

A: The benefits of a more aggressive opportunistic mode include:

Improved security: By attempting to establish a TLS connection with the DNS server for every single DNS request, the client can ensure that all DNS traffic is encrypted, even in situations where the initial TCP handshake issues are present.
Reduced reliance on dnsovertls=true: With a more aggressive opportunistic mode, the user would not need to rely on the dnsovertls=true setting, which can lead to issues when connecting to networks that do not support DoT.
Increased flexibility: A more aggressive opportunistic mode would allow the client to adapt to different network conditions, without requiring the user to manually configure the DNS settings.

Q: How would a more aggressive opportunistic mode be implemented in systemd-resolved?

A: To implement a more aggressive opportunistic mode in systemd-resolved, the following changes could be made:

Add a new configuration option: A new configuration option, such as aggressive-opportunistic, could be added to systemd-resolved to enable the more aggressive opportunistic mode.
Modify the DNS resolver: The DNS resolver in systemd-resolved would need to be modified to attempt to establish a TLS connection with the DNS server for every single DNS request, without falling back on non-encrypted DNS.
Implement a retry mechanism: A retry mechanism could be implemented to allow the client to attempt to establish a TLS connection with the DNS server at regular intervals, in case the initial attempt fails.

Q: What are the potential challenges and limitations of a more aggressive opportunistic mode?

A: The potential challenges and limitations of a more aggressive opportunistic mode include:

Resource consumption: A more aggressive opportunistic mode could consume excessive resources or bandwidth, particularly if the client is attempting to establish a TLS connection with the DNS server for every single DNS request.
Performance optimization: Performance optimization of the more aggressive opportunistic mode would be necessary to ensure that it does not introduce any new issues or degrade the overall performance of the system.
User interface improvements: Improvements to the user interface would be necessary to make it easier for users to configure and use the more aggressive opportunistic mode.

Q: What is the expected timeline for implementing a more aggressive opportunistic mode in systemd-resolved?

A: The expected timeline for implementing a more aggressive opportunistic mode in systemd-resolved is not yet clear. However, it is expected that the development and testing of this feature will take several months to a year or more.

Q: How can users contribute to the development and testing of a more aggressive opportunistic mode in systemd-resolved?

A: Users can contribute to the development and testing of a more aggressive opportunistic mode in systemd-resolved by:

Providing feedback: Users can provide feedback on the proposed solution and suggest improvements.
Testing and validation: Users can test and validate the more aggressive opportunistic mode to ensure that it works as intended and does not introduce any new issues.
Reporting bugs: Users can report any bugs or issues that they encounter while using the more aggressive opportunistic mode.

Q: What are the next steps for implementing a more aggressive opportunistic mode in systemd-resolved?

A: The next steps for implementing a more aggressive opportunistic mode in systemd-resolved include:

Developing the feature: The development of the more aggressive opportunistic mode will begin, with a focus on implementing the necessary changes to the DNS resolver and adding a new configuration option.
Testing and validation: The more aggressive opportunistic mode will be tested and validated to ensure that it works as intended and does not introduce any new issues.
Releasing the feature: The more aggressive opportunistic mode will be released as part of a future version of systemd-resolved.