<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>Bright Star, thank you for your elaborate explanation!</div><div><br></div><div>On Sep 10, 2013, at 09:45 , Bry8 Star wrote:</div><div><blockquote type="cite"><div>Set your Recursive/caching DNS-Server portion in BIND to listen on<br>127.0.0.1:53, And set your machine's Network adapter's DNS-Server<br>settings to use only 127.0.0.1 as your DNS-Server, then all local<br>software can use your own DNS-Server, running on 127.0.0.1 ip-address.<br></div></blockquote></div></div><div><div><br></div></div><div>That is how I have configured BIND now. I use the registrars' DNS server to resolve my exit nodes' name, so I don't have to expose port 53 publicly.</div><div><br></div><div><blockquote type="cite"><div>Best is to turn off any logging/recording in BIND/unbound dns<br>software, unless you are troubleshooting something.<br></div></blockquote><br></div><div>I have logging enabled because I am seeing a lot of these in /var/log/syslog:</div><div><br></div><div><div>Sep 8 22:13:59 tor-exit named[11467]: lame server resolving 'www.example.hk' (in 'example.hk'?): 123.123.123.123#53<br>Sep 8 22:14:17 tor-exit named[11467]: error (connection refused) resolving 'www.example.com/A/IN': 123.123.123.123#53<br>Sep 8 22:14:18 tor-exit named[11467]: validating @0x123456789abc: <a href="http://www.example.com/">www.example.com</a> A: no valid signature found<br>Sep 8 22:14:32 tor-exit named[11467]: error (unexpected RCODE REFUSED) resolving 'www.example.de/A/IN': 123.123.123.123#53<br></div></div><div><br></div><div>Are that many errors to be expected when operating a Tor exit (and thus resolving a lot of unusual domainnames)? Once someone can reassure me this is "normal", I will disable logging.</div><div><br></div><div>Moreover, I noticed a lot of wierd upper/lowercase variants, like "<a href="http://wwW.eXAmPLe.CoM">wwW.eXAmPLe.CoM</a>". Domainnames are case-insensitive, but the original spelling is forwarded through all resolvers, so this would enable adversaries to do some tracking/tracing if people have misconfigured their Tor client and suffer DNS leakage. May I suggest that Tor converts all domainnames to lowercase before trying to resolve them?</div><div><br></div><div>// Yoriz</div><div><br></div></body></html>