pdnsd配合PRCDNS搭建DNS防止DNS劫持

PRCDNS是一个Google DNS代理，使用DNS-over-HTTPS接口，保证DNS的纯洁性，同时使用TCP保证运营商不会劫持DNS结果。

DNS解析流程

客户端 => pdnsd => PRCDNS => Google DNS 接口

PRCDNS的搭建流程可以参考github上的文档

pdnsd安装配置

sudo apt install pdnsd
sudo vim /etc/pdnsd.conf

配置文件参考

global {
	perm_cache=2048;
	cache_dir="/var/cache/pdnsd";
	run_as="pdnsd";
	server_ip = 0.0.0.0;  // Use eth0 here if you want to allow other
	server_port = 53;	// machines on your network to query pdnsd.
	status_ctl = on;
  	paranoid=on;
	query_method=tcp_only;	// pdnsd must be compiled with tcp 只用tcp协议
	min_ttl=1d;       // Retain cached entries at least 15 minutes.
	max_ttl=1w;	   // One week.
	timeout=10;        // Global timeout option (10 seconds).
	par_queries=1;  一定要加，否则会同时查询114，114会抢答查询结果
}
server {
	label = "prcdns"; //设置PRCDNS作为上游服务器
	ip = 23.106.151.177;
	timeout = 10;
	port = 3535; 
}
server {
	label = "114dns"; //备用114DNS作为上游服务器
	ip = 114.114.114.114,114.114.115.115;
	timeout = 10;
	port = 53; 
}