Configuring Stubby with CleanBrowsing
How to leverage the open source Stubby DNS resolver with CleanBrowsing.
What is Stubby
'Stubby' is an application (daemon) that runs on your network and allows you to proxy local DNS requests to external DNS resolvers leveraging DNS over TLS. Stubby encrypts DNS queries sent from a client machine (desktop or laptop) to a DNS Privacy resolver increasing end user privacy.
More details is available on their website.
If you are using Stubby, we assume that you are technically inclined. All the changes required to work with Stubby will done in the stubby.yml file, located here: /etc/stubby/stubby.yml.
You will make your edits at the bottom of the config file, inside the upstream_recursive_servers section.
You need to remove the entries that are configured and use the ones for CleanBrowsing. If you are on our paid plans, you can find the DNS over TLS Auth name on this page.
For example, for my account I use:
upstream_recursive_servers: - address_data: 126.96.36.199 tls_auth_name: "custom-dns154.cleanbrowsing.org" tls_pubkey_pinset: digest: "sha256" value: rb2O6hMTZZ/go/vOqyVLY2lATD9DkD6+BkKfJwYYMFw=
Note that you must include the tls_pubkey_pinset when adding the your upstream resolvers. If, for whatever reason, you get a warning that reads: Verify failed : Transport=TLS - *Failure* - (20) "unable to get local issuer certificate you will want to verify the tls_pubkey_pinset value.
Verify the tls_pubkey_pinset value by using OpenSSL:
echo | openssl s_client -connect '188.8.131.52:853' 2>/dev/null |
openssl x509 -pubkey -noout | openssl pkey -pubin -outform der |
openssl dgst -sha256 -binary | openssl enc -base64
This will provide you the right tls_pubkey_pinset value.
Restart stubby when you're done: systemctl restart stubby. That should just work.
If you are using one of our Free Filters, try one these configs:
Free Family Filter:
upstream_recursive_servers: - address_data: 184.108.40.206 tls_auth_name: "family-filter-dns.cleanbrowsing.org" tls_pubkey_pinset: digest: "sha256" value: rb2O6hMTZZ/go/vOqyVLY2lATD9DkD6+BkKfJwYYMFw=
Free Adult Filter:
upstream_recursive_servers: - address_data: 220.127.116.11 tls_auth_name: "adult-filter-dns.cleanbrowsing.org" tls_pubkey_pinset: digest: "sha256" value: rb2O6hMTZZ/go/vOqyVLY2lATD9DkD6+BkKfJwYYMFw=
Free Security Filter:
upstream_recursive_servers: - address_data: 18.104.22.168 tls_auth_name: "security-filter-dns.cleanbrowsing.org" tls_pubkey_pinset: digest: "sha256" value: rb2O6hMTZZ/go/vOqyVLY2lATD9DkD6+BkKfJwYYMFw=
Reach out to us at firstname.lastname@example.org if you have any questions.