How a device finds encrypted DNS by itself
How a device finds encrypted DNS by itself
设备如何自动发现加密 DNS
A device is normally configured with a single IP address for its DNS resolver. That address reaches the resolver over plain, unencrypted DNS, which is all a bare IP address can describe. Encrypted DNS requires more: a hostname to check the certificate against, a port, and a protocol. None of that fits in the settings box, and none of it can be worked out from the address already sitting there.
设备通常配置有单个 IP 地址作为其 DNS 解析器。该地址通过明文、未加密的 DNS 访问解析器，而纯 IP 地址只能提供这些信息。加密 DNS 则需要更多内容：用于校验证书的主机名、端口以及协议。这些信息无法填入现有的设置框中，也无法从已有的地址中推导出来。
DDR, short for Discovery of Designated Resolvers, gives a resolver a way to publish those details to any device already talking to it.
DDR（Discovery of Designated Resolvers，指定解析器发现协议）为解析器提供了一种方式，向任何与其通信的设备发布这些详细信息。
How the question works
查询的工作原理
The question is a lookup for _dns.resolver.arpa, a name reserved for this purpose and answered by whichever resolver the device is currently using. It amounts to asking whether an encrypted version exists, and where it can be reached.
该查询是对 _dns.resolver.arpa 的查找，这是一个为此目的保留的域名，由设备当前使用的解析器进行响应。这相当于询问是否存在加密版本，以及可以在何处访问它。
A resolver that has one replies with the hostname, port, and protocol of each encrypted endpoint it offers, and marks each with a preference. A device that speaks several protocols follows that preference order; a device that speaks one takes the endpoint matching it. The endpoints on offer are usually some mix of DoH, DoT, and DoQ, which an earlier post compares. Where a resolver offers no encrypted endpoints, the reply says so explicitly.
如果解析器支持加密，它会回复其提供的每个加密端点的主机名、端口和协议，并为每个端点标记优先级。支持多种协议的设备会遵循该优先级顺序；仅支持一种协议的设备则选择匹配的端点。提供的端点通常是 DoH、DoT 和 DoQ 的组合（此前文章曾对此进行过比较）。如果解析器不提供加密端点，回复会明确说明。
The device then opens a connection to whichever endpoint it picked, and every query from that point on is encrypted. Windows 11 and Apple devices send the question automatically when they join a network.
随后，设备会连接到它所选定的端点，此后的所有查询都将进行加密。Windows 11 和 Apple 设备在加入网络时会自动发送此查询。
What comes back
返回的内容
The contents of that reply depend on how the resolver is built. A resolver that applies the same filtering to everybody publishes one set of endpoints, and every device receives an identical answer.
回复的内容取决于解析器的构建方式。如果解析器对所有用户应用相同的过滤规则，它会发布一组端点，每个设备收到的答案都是相同的。
A resolver that keeps per-profile settings can answer with endpoints belonging to the profile that asked, so the blocking rules, allow lists, and logging settings configured on that profile apply from the first encrypted query onward.
如果解析器维护基于配置文件的设置，它可以根据发起查询的配置文件返回相应的端点，从而确保在该配置文件上配置的拦截规则、白名单和日志记录设置从第一次加密查询开始就生效。
Answering that way depends on the resolver identifying the profile behind the question. A query arriving over an existing encrypted connection identifies itself, because the profile is part of how that connection was established in the first place. A query arriving over plain DNS carries no such marker, leaving its source address as the only available signal, so that address has to be linked to the profile in advance. Queries from an unlinked address get a reply listing no endpoints.
这种响应方式取决于解析器能否识别查询背后的配置文件。通过现有加密连接到达的查询可以自我识别，因为配置文件是建立该连接的基础。而通过明文 DNS 到达的查询不携带此类标记，源地址成为唯一可用的信号，因此该地址必须预先与配置文件关联。来自未关联地址的查询将收到不包含任何端点的回复。
The reply also includes the IP addresses of the endpoints it names, which saves the device a second lookup to resolve the hostname it has just been handed. That lookup would otherwise travel over the same unencrypted connection the device is trying to leave.
回复还包含所命名端点的 IP 地址，这节省了设备解析刚刚获取的主机名所需的第二次查询。否则，该查询将不得不通过设备试图摆脱的同一个未加密连接进行传输。
Where it helps most
最有帮助的场景
A device that is already encrypted. A browser on DoH or a phone on DoT can send the same question and learn that DoH3 and DoQ are available. The exchange happens inside a connection that is already encrypted and certificate-verified, so the upgrade inherits that verification. A device identified by name on its existing connection keeps that name across the switch, since the name travels with the connection.
已经加密的设备。 使用 DoH 的浏览器或使用 DoT 的手机可以发送相同的查询，并获知 DoH3 和 DoQ 是否可用。交换过程发生在已经加密且经过证书验证的连接内，因此升级过程继承了这种验证。在现有连接上通过名称识别的设备在切换后仍保留该名称，因为名称随连接一同传输。
A device limited to plain DNS. Televisions, consoles, and appliances that accept an IP address and nothing else can be moved onto an encrypted connection with no configuration of their own.
仅限于明文 DNS 的设备。 电视、游戏机和仅接受 IP 地址的家电等设备，无需进行任何自身配置即可切换到加密连接。
What it does not do
它无法做到的事
An upgrade starting from plain DNS begins with an unencrypted exchange, which the network can read and alter. A network operator intent on keeping DNS unencrypted can strip or rewrite the reply, and the device has no way to detect it. Clients treat this route as opportunistic for that reason, taking the upgrade when it succeeds and continuing on plain DNS when it fails. Stricter clients go further and require the designated endpoint’s certificate to name the IP address they started from, declining the upgrade when it does not.
从明文 DNS 开始的升级始于未加密的交换，网络可以读取并篡改这些信息。意图保持 DNS 明文的网络运营商可以剥离或重写回复，而设备无法检测到这一点。因此，客户端将此路径视为“机会主义”的：成功时进行升级，失败时则继续使用明文 DNS。更严格的客户端会进一步要求指定端点的证书中必须包含它们最初连接的 IP 地址，如果不匹配则拒绝升级。
Configuring an encrypted resolver directly on a device remains the stronger option wherever the settings allow it, since the connection is verified from the first query and travels with a laptop or phone onto any network. Many routers can configure one on behalf of everything behind them. DDR covers the devices that neither route reaches.
在设置允许的情况下，直接在设备上配置加密解析器仍然是更稳妥的选择，因为连接从第一次查询起就经过了验证，并会随笔记本电脑或手机进入任何网络。许多路由器可以代表其后的所有设备进行配置。而 DDR 则覆盖了上述两种方式都无法触及的设备。