---
title: "Stubby: DoT DNS client on OpenBSD (EXPERIMENTAL) "
date: 2018-03-22T14:21:09+01:00
description: "Stubby installation experimentation, a DoT and DNSSEC client, on OpenBSD (6.3)."
draft: false
lastmod: 2018-10-11T21:24:09+01:00
tags: ["OpenBSD", "stubby", "experimental", "DNS", "DoT", "DNSSEC"]
---
## Description
[Stubby](https://github.com/getdnsapi/stubby) is a DNS client, using secure protocol *({{< abbr DoT "DNS-over-TLS" >}})*.
This encrypts DNS queries sent from your machine to a DNS resolver, or an authoritative DNS server to increase the confidentiality.
It can request queries according DNSSEC protocol, too.
{{< note warning >}}
Warning: it does not act as DNS cache resolver, nor as an authoritative DNS server; it's only a DNS client!
In addition, there is no package, nor port on OpenBSD stable.
Hence is the reason of title "EXPERIMENTAL". We're going to retrieve sources, compil, install and configure them.
{{< /note >}}
## Installation
The **stubby** client is/will be installed on OpenBSD stable.
* at this day, now: 6.3
### Prerequisite
* `OpenSSL` : install by default
* `Libyaml` : to install…
* `autoconf`, `automake` : to install to configure, and build before installation.
{{< code "sys-openbsd-stubby-pkg-add-autoconf-automake" sh >}}
Then, we will follow the official installation recommandations from [sources](https://dnsprivacy.org/wiki/pages/viewpage.action?pageId=3145786), by adapting them to OpenBSD, step by step.
### Download
{{< code "sys-openbsd-stubby-git-clone" sh >}}
The second command `git` permits us to get/obtain the most recent sources .
### Configuration
{{< code "sys-openbsd-stubby-config-src" sh >}}
### Compilation
`$ make`
`# make install`
Of course, if you had configured *{{< man doas >}}*, you can executed the ultimate command, as:
`$ doas make install`
### resolv.conf
It's necessary to modify your `/etc/resolv.conf` file in order to communicate directly with stubby:
`nameserver 127.0.0.1`
`nameserver ::1`
### stubby.yml
The stubby's configuration file is: `/usr/local/etc/stubby/stubby.yml`.
You can create your personal, as `~/.stubby.yml`. It will be read in first.
## Execution
To execute **stubby**, run as:
{{< code "sys-openbsd-stubby-start" sh >}}
Some interesting informations, about flags:
* `-C`: to specify other configuration file.
* `-g`: to run in background mode.
* `-i`: to check the configuration!
* `-l`: to log. Actually, the output is only on the standard `stdout`!
### Test
We use `dig`:
=> IPv4
{{< code "sys-openbsd-stubby-test-ipv4" sh >}}
=> IPv6 :
{{< code "sys-openbsd-stubby-test-ipv6" sh >}}
------------------------------------------------------------------------