I'm really annoyed that we can't input DoT/DoQ/DoH in ProtonVPN
It annoys me so much that only Android gives me the flexibility and power of ProtonVPN and NextDNS together without any compromises done through native settings. Proton with superior VPN service and NextDNS straight in Android with superior filtering service. Which I can't use easily on Windows without running multiple programs together like ProtonVPN+YogaDNS which I don't like.
Why can we only input unencrypted IP4 and/or IP6 DNS address into ProtonVPN, but we can't simply input encrypted DoT/DoQ/DoH DNS address and retain filtering capability through customizable profiles offered by the DNS service?
Sure, there is NetShield that works, but I have absolutely no idea how effective really is and I have no monitoring capability of actually seeing what my connection is doing. Beecause of this I'm forced to use HaGeZi DNS server that only runs Pro block list which is weaker than the Ultimate that I otherwise use and I have no monitoring oversight over my connection with it.
All this could be entirely solved if we could just input DoT/DoQ/DoH of the DNS directly into ProtonVPN. Come on Proton, please add this already to your VPN.
5 replies
DoT/DoQ/DoH can cause trouble in a VPN connection and slow it down. AdguardVPN offers the option and they wrote their own protocol called TrustTunnel (it is open source since beginning of this year). I used AdguardVPN for a while and it regularly slows down the connection a lot. I activate DoH in my browser when I think I need it. Also, using a different DNS Server can be a way to help fingerprinting you. I also were keen to find a VPN with DoT/DoQ/DoH but now I'm glad Proton puts security and speed over one feature that can cause a lot of problems. And yes, they could try to put TrustTunnel in their service. But as many people always come back to the Russian connection of Adguard this will also give a backslash. There as to be a good reason why Mullvad and IVPN also don't offer to change the DNS Server to DoT/DoQ/DoH.
If you use MacOS or iOS you can try Passepartout from the App Store. You can set up a wireguard connection and also set a DNS Server with encryption. But often you manually have to change the wireguard profile to make it work. And this also with some downsides. Check the reddit forum for support.
Also, if you use a VPN it should be quite difficult to identify you if you use a non encrypted DNS server. You have to trust Proton already that they don't protocol your connection. And the DNS server only sees the Proton IP address. If you are based in Europe you can try https://dnsforge.de/ with the hard option. This includes HaGeZi Ultimate.
( I don't work for Proton and have no connection to them other than using their products. )
The reason why unencrypted DNS is useless is because you can't bind a profile to it (like NextDNS or AdGuard ones). You'd have to bind your IP to it in order to function and that won't work for obvious reasons because you aren't exposing your IP to outside world. With DoT, you're calling a specific address which in itself does the linking. That's why I want that. So I can have control and insight on my traffic, something I currently don't have and can't have. And I don't want to use multiple apps to achieve it either.
The business packages for AdguardDNS and NextDNS include a IP4 address. Or you try AdguardVPN, I thing 2GB per month are free. But it still can cause trouble. VPNs are not made for encrypted DNS. They are made to cover up your identity.
AFAIK NextDNS does have IPv6 addresses specifically for your profile.
But only IPv6 which is useless since most traffic is still on IPv4...