Why does defaultDNS use Quad9's "Unsecured" service? (dns10/9.9.9.10 as opposed to dns/9.9.9.9)

[af3556]

The default upstream DNS server [defaultDNS](internal/dnsforward/dnsforward.go) uses https://dns10.quad9.net/dns-query, which Quad9 describe as:

Unsecured: No Malware blocking, no DNSSEC validation (for experts only!)

I'm wondering what benefits dns10 have over the "secured" https://dns.quad9.net/dns-query for AGH?

[schzhn]

By default, blocking DNS requests should be the responsibility of AdGuard Home, not the upstream DNS server.
Related #1451

[af3556]

FTR, I had been running dns.quad9.net for a few weeks, but hit a couple of hiccups where names were being blocked and it was rather unclear where - whether by AGH or upstream (turns out it was upstream). So I've reverted back to using the default dns10.quad9.net to eliminate one source of confusion, and can now see it's a sensible default ;-).

[0xpsyduck]

How do we enable DNSSEC validation when using Quad9's unsecured dns10.quad9.net service?
I have enabled DNSSEC checkbox in DNS Settings but {Invalid, Expired, Missing} signatures are not resulting in SERVFAIL, checked with dnscheck.tools.
Am I missing something?

[af3556]

According to https://quad9.net/service/service-addresses-and-features/ - dns10 (9.9.9.10) is "Unsecured: No Malware blocking, no DNSSEC validation (for experts only!)". (my emphasis)

Presumably you want dns11.quad9.net.

[0xpsyduck]

I don't want Malware blocking and dns10.quad9.netis the only option but it is a non DNSSEC validating resolver.
So I am wondering why DNSSEC validation doesnt work locally with AGH if I explicitly enable that.
It is not that dns10.quad9.net doesnt respond to RRSIG queries, it just doesn't auto verify them and retun SERVFAIL automatically downstream.
So in my understanding AGH should be able to perform DNSSEC itself locally.

[johnhtodd]

Hi - I'm with Quad9. There might be a good middle ground here - we do mark blocks with a special bit that could make them show up in the AdGuard interface as being external blocks. See discussion here: #7986