obscura/research/dns-trackingobscura/research/dns-tracking

Overview

DNS is one of the simplest and most effective layers for blocking tracking and fingerprinting domains. Before any HTTP connection, there is a DNS lookup.

How DNS Blocking Helps

By resolving known tracking/fingerprinting domains to 0.0.0.0 or 127.0.0.1, the client never connects to those servers:

Client DNS Query  Obscura DNS  0.0.0.0 (blocked)
                             
                    Blocklist (domains)

This prevents:

• Third-party tracking scripts from loading
• Fingerprinting JS from executing
• Analytics beacons from sending data
• Ad networks from serving content

Blocklists

Fingerprinting-Specific Domains

Some domains are exclusively used for fingerprinting:

fingerprintjs.com
fingerprint.com
fingerprintjs.net
fpjs.io
*.metrics.*
*.analytics.*

Implementation Approaches

Approach 1: Local DNS Resolver

Run a DNS server inside the container (e.g., coredns, dnscrypt-proxy):

• Responds to DNS queries from clients
• Checks domain against blocklists
• Returns NXDOMAIN or 0.0.0.0 for blocked domains
• Forwards non-blocked queries to upstream DNS (e.g., Cloudflare, Quad9)

Approach 2: DNS-over-HTTPS/TLS Upstream

Forward queries to encrypted DNS to prevent ISP from seeing domain lookups:

Client  Obscura DNS  [DNS-over-HTTPS]  Upstream

Approach 3: Hosts File Injection

Inject /etc/hosts entries into client devices via DHCP options. Less flexible but zero-config for clients.

Limitations

• DNS blocking only works on full domains, not subpaths
• Some trackers use IP-direct connections (no DNS lookup)
• Can't block first-party analytics (same domain as content)
• Some fingerprinting scripts are served from CDNs that also serve legitimate content

Conclusions

• DNS blocking is the lowest-effort, highest-impact mitigation
• Must be a core feature of Obscura
• Combine with HTTP-level blocking for comprehensive coverage
• Regular blocklist updates are required