DNS Privacy Daemon - Stubby
‘Stubby’ is an application that acts as a local DNS Privacy stub resolver (using DNS-over-TLS). Stubby encrypts DNS queries sent from a client machine (desktop or laptop) to a DNS Privacy resolver increasing end user privacy.
Stubby is developed under the getdns project, has it’s own github repo and issue tracker but dnsprivacy.org currently hosts the online documentation for Stubby. For more background and FAQ see our About Stubby page.
As announced over the last 6 months, the dnsovertls*.sinodun.com nameservers were decommissioned on 9th Septemter 2022. See this announcement.
The command line version of Stubby is suitable for technical/advanced users. Work on more a user friendly GUI called Stubby Manager is underway - see below!
Why Use Stubby?
Read about the problem with DNS Privacy and how Stubby helps
Key Features
- Runs as a daemon listening on the loopback addresses (127.0.0.1, ::0)
- Sends all outgoing DNS queries received on those addresses out over TLS
- Uses a default configuration which provides Strict Privacy and uses a subset of the available DNS Privacy servers
- Has additional servers available for activation in the configuration file (e.g. Cloudflare, Quad9)
Stubby uses getdns, it is recommended to use at least the 1.6 release of getdns, and preferably the latest getdns stable release.
A future release of Stubby is expected to support the following:
- DNS-over-HTTPS (DOH)
- Configuration of servers using authentication name only
Source Code
As of August 2017 Stubby has moved to its own repository and getdns is a library dependancy!
Source code is available on github: https://github.com/getdnsapi/stubby
Lastest release
See the Stubby github repo for the latest release tarball or the getdns releases page.
Installation
Packages
Various packages are available, see repology for
Stubby.
Note1: A debian package is also available but doesn’t show up in the above because the version number is currently incorrect (it picks up the getdns version, not the stubby version). Working to fix this!
Note2: The chocolatey package called ‘stubby’ as of March 2019 is for Stubby - the name was previously used for a package named stubby4net but that has now been renamed to stubby4net.
Installation Guides
- Linux
- Build from source
- Running a service
- Great tutorial on using stubby on Ubuntu desktop - thanks linuxbabe.com!
- macOS
- Homebrew
- Stubby Manager GUI (prototype) for macOS (note, this project is no longer maintained. Support for macOS in the new Stubby Manager GUI is a work in progress).
- Windows
- Windows installer for command line Stubby (MSI, zip file and Chocolatey package available)
- Windows installer for Stubby Manager GUI (development release)
Docker Images
- See this tweet for an example of using Stubby + Quad9
- See this link for an example of using BIND as a local caching forwarder and stubby for upstream TLS
Mobile
We hope to have support on mobile platforms in the future:
Note that Android has announced that it will support a native implementation of DNS-over-TLS in an upcoming official release (it is already available in developer releases). This does not share any code with Stubby but we applaud Android for this development!
Configuration
See our Stubby configuration guide.
Note that some users use Stubby in combination wtih Unbound - Unbound provides a local cache and Stubby manages the upstream TLS connections (since Unbound cannot yet re-use TCP/TLS connections). And example configuration is available on this page.
Support
Bugs or feature requests can be directed to either
- MAILING LIST: the getdns users mailing list
- BUG TRACKER: the Stubby github issue tracker
How can I contribute to the getdns/Stubby projects?
- Run and test stubby. Give feedback and report bugs!
- Contribute code to or https://github.com/getdnsapi/stubby or https://github.com/getdnsapi/getdns
- Running a DNS privacy resolver
Other options
See DNS Privacy Clients.