维基媒体DNS

主机名	wikimedia-dns.org
IP地址（IPv4）	185.71.138.138
IP地址（IPv6）	2001:67c:930::1
支持的协议	DoH和DoT

Tracked in Phabricator:
Task T252132

简要解释：维基媒体的wiki们会被封锁、或者用户编辑时会被追踪。此为维基媒体基金会SRE/Traffic团队解决这些问题的一个尝试。

Wikimedia DNS（曾被称为Wikidough）是由基金会Site Reliability Engineering（Traffic）团队运作的一个缓存、递归的公共DNS-over-HTTPS（DoH）和DNS-over-TLS（DoT）解析器。Wikimedia DNS通过保护DNS查询来防止对我们的wiki们的监视和审查。

这份文档解释了此服务是什么、SRE/Traffic团队运作它的原因以及它能为维基媒体社群带来的好处。我们欢迎任何关于此项目的讨论在条目讨论页。

DNS的简介

What is DNS?

The Domain Name System (DNS) is the phonebook of the internet. It provides a lookup of domain names (such as wikipedia.org) to their IP addresses (208.80.154.224). Whenever you visit a resource on the internet like a website, a DNS resolver — typically run by your Internet Service Provider (ISP) — resolves the domain to an IP address and is the first step in the creation of a connection to a website. Without the IP address you won't be able to find the right website. This process happens in the background and because of the way the internet works, most people automatically connect to their ISP's DNS resolver to perform these DNS queries.

DNS是互联网的关键组成部分，无论您想访问哪个资源或从哪里访问（移动设备或电话），都会发生DNS查询。

基于DNS的监视和审查

尽管域名系统（DNS）已经存在数十年了，但一个DNS查询（“wikipedia.org的IP地址是什么？”）和响应（“IP地址是208.80.154.224”）并没有加密。这是一个严重的隐私和安全风险。一个路径上的观察者——比如你所在的咖啡馆、互联网服务提供商或你的政府——可以观察你的DNS查询/响应，并建立一个你访问互联网资源的列表，更糟糕的是，他们可以通过阻止你访问他们认为不可接受的内容来审查你。

由于我们主要关注运动背景下的审查，维基百科和其他维基媒体项目已经通过DNS遭到审查，这在我们开展活动的多个国家都有观察到。DNS审查易于实施，可有效扩展，而且由于DNS是连接到远程资源的第一步，大多数互联网服务提供商和政府都使用DNS审查来阻止人们访问互联网上的内容。

举例来说，审查对“\*.wikipedia.org”的查询以阻止人们访问任何语言版本的维基百科，在大多数DNS解析器软件中实现起来非常简单，只需要一行代码。

DNS加密

To solve the problem of surveillance and censorship of DNS, various DNS encryption protocols have been proposed over the years. Due to various reasons including a lack of a standard, adaptability, implementation, none of the proposed protocols have seen mass adoption until DNS-over-HTTPS was proposed and standardized in 2018. The Mozilla Firefox browser helped push adoption of DoH by enabling it by default for US users in 2020 and has since rolled this out to other countries as well.

DoH和DoT

DNS-over-HTTPS, also called DoH, encrypts DNS by sending queries and getting responses over HTTPS, thus preventing censorship and surveillance: because an on-path observer can no longer see the queries or the responses, they cannot censor it or build a profile of the data. DoH works by sending DNS queries over a secure HTTPS channel.

DNS-over-TLS, also called DoT, is a related DNS encryption protocol offering encryption over just TLS. It hasn't seen the same rate of adoption DNS-over-HTTPS has seen for various reasons that we will discuss later. Nevertheless, we consider both of these protocols related for the purpose of this discussion and the Wikimedia DNS service, even though there are differences between them at the protocol level.

要使用新的DNS加密技术，你需要一个启用了DoH或DoT的客户端以及解析器。

维基媒体DNS

Wikimedia DNS is a public DNS-over-HTTPS and DNS-over-TLS resolver service. For users who wish to secure their DNS lookups to prevent surveillance or to circumvent DNS-based censorship, Wikimedia DNS helps protect your DNS queries/responses by providing encryption of the same. For a user securing their DNS lookups via Wikimedia DNS, all that an on-path observer or a censor can see is a connection to the Wikimedia DNS service but not the content of the DNS queries or responses.

维基媒体DNS的历史

The SRE/Traffic team in the Wikimedia Foundation is tasked with running the Wikimedia proxy servers and data centers. We are also interested in understanding where and how our websites are censored on a technical level. HTTPS makes it impossible for censors to block access to specific articles, thus forcing them to choose between blocking nothing or the entire website. We are not concerned with censorship of the content of the articles — even though that's related — but rather the website/ecosystem as a whole.

In studying and researching censorship of Foundation websites, we discovered that the most common form of this censorship was through filtering the DNS. The idea of running a secure, encrypted DNS service thus stemmed from those observations. The annual plan for FY 2022–23, under its goal for Safety and Inclusion, talks about "Implement technical improvements to strengthen security and privacy of volunteers on-wiki, protect against surveillance, and enhance the communities' ability to effectively govern themselves and address disinformation and human rights risks." You can follow the task on Phabricator.

维基媒体 DNS 常见问题

维基媒体为何运作此服务？

出于多种原因，我们不推荐使用外部解析器服务，例如Google、Cloudflare、Quad9等提供的服务。我们无法控制这些服务的运行方式或记录哪些私人数据。即使这些服务中的大多数都有明确的隐私政策，它们也会记录一些数据，而我们对此没有任何控制权或了解。

另外，他们一些还有内容过滤。Cloudflare的家庭DNS服务之前被发现封锁LGBTQ内容。其他或多或少也有内容过滤。

站点可靠性工程（SRE）团队非常适合运行此类服务，并且可以为营利性公司运营的安全DNS解析器服务提供可靠的替代方案。

此项目解决能所有互联网审查问题吗？

不能。尽管DoH和DoT等协议加密了你的客户端（比如Firefox）和解析器（Wikimedia DNS）的查询，旁路的观测者（比如你的ISP/政府）仍然可以识别你连接到的网站通过ClientHello消息中（当前未被加密）的Server Name Indication (SNI)字段、或者通过目标网站的IP地址。尽管如此，鉴于基于DNS的审查和监视是最方便实现的，保护你的DNS是改进隐私和对抗审查的第一步。

TLSv1.3的Encrypted Client Hello扩展 (ECH; 之前叫做Encrypted SNI)加密了SNI字段并且，基于其工作方式，ECH需要加密DNS才有效果。这两种技术能够解决互联网用户的、长期存在的隐私问题。尽管这不能解决所有我们的问题，我们也需要加密DNS令以后的对抗监视和审查的工作有效果。

防火墙难道不能封锁该服务本身吗？

是的，审查者可以封锁Wikimedia DNS。但是我们相信加密DNS和Encrypted Client Hello（依赖于加密DNS）的组合能让封锁网站变得更加困难，因此能够降低Wikimedia DNS被封锁的概率，因为审查者不会借此就能够窥探SNI。而且，大部分审查者一般不封锁DNS解析器，从1.1.1.1和8.8.8.8的流行度和使用率可以看到。

维基媒体DNS并非应对所有审查问题的完整解决方案。它只是我们反审查策略的一部分，虽然它可能无法帮助所有地方的所有用户，但它将有助于保护绝大多数用户的DNS查询安全，并为即将到来的协议奠定基础。

能否介绍更多关于ECH和Client Hello？

假设你要打开en.wikipedia.org。第一步是DNS解析，这样DNS解析器会返回给你en.wiki域名的IP地址供你建立连接到。下一步是，当你要连接到该IP地址时，你还需要指定Server Name Indication或称SNI，在此处就是en.wikipedia.org。此SNI字段，和DNS一样，一直以来都未被加密，因此检查你的流量的审查器能看出你在连接到en.wiki，然后阻止建立连接。

SNI-based censorship is the most common form of restricting access to websites (not just ours) after DNS, the difference being that it requires more resources in the form of specialized blocking equipment that does deep-packet inspection on the traffic so not every censor is motivated to pursue it or has the equipment to be able to do so.

Encrypted Client Hello (formerly called Encrypted Server Name Indication, or ESNI), encrypts this SNI field, preventing a censor from blocking traffic based on the SNI field. ECH depends on encrypted DNS to be effective as the key distribution for ECH happens over DNS HTTPS resource records. In the absence of encrypted DNS, a censor could simply filter or poison the DNS result, making ECH ineffective. The Firefox browser for example will not enable ECH if encrypted DNS is also not enabled.

Thus the work on Wikimedia DNS not only secures DNS but also lays the foundation for future implementations of internet security protocols such as ECH.

我需要安装额外的软件来使用吗？

All major desktop and mobile operating systems and browsers support either DoH or DoT in 2023. Users will need to point their browser/OS to Wikimedia DNS but no extra software is required.

There are no discovery mechanisms for DoH and DoT yet, so the configuration is still manual; the hostname or IP address of the service is all that is required for someone to use the service.

如果你不想使用维基媒体DNS，对你来说不会任何改变。

我需要什么才能使用它？

1. 支持 DoH 或 DoT 的客户端。您可以在此处找到列表。
2. 服务的URL(https://wikimedia-dns.org/dns-query)或IP地址，IPv4: 185.71.138.138或IPv6: 2001:67c:930::1。
3. 或者DNS Stamp：sdns://AgcAAAAAAAAADjE4NS43MS4xMzguMTM4ABF3aWtpbWVkaWEtZG5zLm9yZwovZG5zLXF1ZXJ5（通过IPv4连接）或sdns://AgcAAAAAAAAAEVsyMDAxOjY3Yzo5MzA6OjFdABF3aWtpbWVkaWEtZG5zLm9yZwovZG5zLXF1ZXJ5（通过IPv6连接）。

这是不是VPN？

不是。使用Wikimedis DNS并不中转通信内容，也不会改变用户的IP地址。它只保护元数据，此处其属于DNS查询。

你为什么不开一个VPN服务？

Running a VPN service requires a lot more resources and carries with a lot more liability, as we would be relaying the contents of the transmission as well, not just the metadata.

VPN也存在可用性和可访问性问题。那些知道VPN是什么并且能够配置它们的人会使用它们，而大多数其他用户则无法做到这一点。因此，如果我们提供一种规避审查的工具，它应该适用于所有人，虽然我们尚未实现DoH或DoT，但这些协议比设置和运行VPN客户端更标准化且更易于使用。

这会影响 IP 掩盖或任何其他反破坏工具吗？

不会。维基媒体DNS不会以任何方式影响这些工具。如果监督员、管理员和其他用户使用维基媒体DNS，他们仍然可以像不使用时一样访问关于编辑者的相同信息。

Does this require a username/password or some other form of authentication?

不，只有主机名或IP地址。这是一项公共服务，任何人都可以使用。

此服务能否被限制为仅能在维基媒体社群内部使用？

不，我们没有限制访问该服务的技术手段。任何知道主机名/IP地址的人都可以使用它。

这是否会使互联网上的不良行为者能够保护他们的DNS查找？

是的，维基媒体DNS，就像任何其他DNS服务（甚至包括你的互联网服务提供商运行的服务一样），可以允许不良行为者执行DNS解析并保护他们的DNS查找。请注意，维基媒体DNS只提供通信的元数据（“电话号码”），但它不参与实际的通信本身（“电话通话”）。因此，当不良行为者拥有更好的工具来保护通信内容本身时，例如许多免费和商业VPN服务或其他代理，维基媒体DNS为他们提供的效用是相当有限的。

维基媒体DNS是现有商业DNS提供商的替代方案，并非唯一的此类服务。大多数人仍然会使用谷歌和Cloudflare来保护他们的DNS查找，由于它们的运营规模，这些服务将比我们的更快。

我已经配置了该服务。如何确保我正在使用它？

设置好维基媒体DNS后，您可以访问https://check.wikimedia-dns.org/ 以确认您的DNS查询是通过维基媒体DNS而不是您本地/ISP的解析器进行的。

您也可以直接从命令行访问API：curl https://${RANDOM}.check.wikimedia-dns.org/check。

DoH vs DoT. 我应该使用哪个？

维基媒体DNS通过TCP/443端口支持DoH，并通过TCP/853端口支持DoT。用户可以选择任一协议来保护其DNS安全，因为DoH和DoT在维基媒体DNS中具有相同的隐私和安全保障，请用户注意协议本身的区别。

• 运行在443端口的DoH更难被屏蔽，因为审查者将不得不屏蔽潜在的所有HTTPS流量。DoT运行在专用端口853上，因此更容易被屏蔽。

• Typically, DoH support is in the browser (thus securing DNS lookups only from within that browser), while DoT lookups happen at the OS level, for all applications. DoT might be more preferable in that sense unless censorship is an issue.

步骤说明

要开始使用Wikimedia DNS，请查看Wikimedia DNS指南页面。

隐私政策

Wikimedia DNS is still being beta-tested and evaluated both internally and with our community. As such, there are no guarantees of the reliability or future availability of the service, and there is no formal privacy policy published yet. That said, our current configuration (visible here: dnsdist.conf.erb and recursor.conf.erb) does not currently log anything.

We currently intend, in broad strokes, to adhere to the Foundation's long-standing values around privacy-related issues, as well as to Mozilla's TRR policy, when and if this service is more-formally launched in the future.

技术细节

You can find a more exhaustive list of technical features on the Wikitech page but here is a summary:

• This is an anycasted service, running on all seven of our data centers. You should in most cases connect to the data center nearest you, even when you configure it with the IP address.

• 维基媒体DNS支持强加密：DoH使用TLSv1.3和TLSv1.2（仅限AEAD密码），DoT使用 TLSv1.3。对于移动客户端（或其他优先考虑它的客户端），维基媒体DNS优先使用ChaCha20-Poly1305。

• This is meant to be a secure DNS service and we don't support unencrypted DNS over either UDP or TCP and have no plans to do so.

• IPv6完全支持。

源代码

The deployment of Wikimedia DNS corresponds to the source code in our Puppet repository. The dnsdist module covers setting up and configuring a dnsdist instance, the dnsrecursor module does the same for a PowerDNS Recursor instance, and both of these are called by the Wikidough (codename) role and profile and customized with the configuration data from wikidough.yaml.

The configuration files for dnsdist can be found at dnsdist.conf.erb and for PowerDNS Recursor at recursor.conf.erb.

当前部署

维基媒体DNS目前部署在所有的六个数据中心，运行在两台ECMP 负载均衡的Ganeti虚拟机上（总共12台虚拟机）。此外，还有十二台虚拟机用于检查服务 (check.wikimedia-dns.org)。

联系方式

维基媒体 DNS 项目由 SRE/流量团队负责。我们欢迎在讨论页上提出关于该项目的问题、意见和讨论。

关于该项目的技术讨论，请加入我们在Libera Chat上的IRC频道：#wikimedia-traffic。团队的电子邮件联系方式是：wikimedia-dns@wikimedia.org。