Name Services provides an overview of ways the box can be reached from the public Internet: domain name, Tor Onion Service, and Pagekite. For each type of name, it is shown whether the HTTP, HTTPS, and SSH services are enabled or disabled for incoming connections through the given name. It also shows and allows configuring how FreedomBox performs domain name resolutions.
From release 24.19, FreedomBox uses systemd-resolved as caching DNS resolver and replaces resolvconf for managing DNS server configuration. This improves privacy and security. Newer installations will come with systemd-resolved and older machines will automatically switch after an upgrade to this new release.
systemd-resolved automatically acquires DNS servers from Network Manager, the default and recommended way to configure networks on FreedomBox. However, if you are manually managing network configuration by editing /etc/network/interfaces, you will need to ensure that the DNS servers acquired are passed on to systemd-resolved. Otherwise, Fallback DNS servers will be used. See below.
systemd-resolved supports DNS-over-TLS. This protocol allows encrypting DNS communication between FreedomBox and the DNS server if your DNS server (typically provided by your ISP, sometimes a separate service) has support for it. This improves both privacy and security as it makes it harder for intermediaries to see the communication or manipulate it. New settings for enabling DNS-over-TLS are available at the global level (for all network interfaces) in Name Services app and at the per-connection level in the Networks app's connection settings.
systemd-resolved supports DNSSEC. This standard allows website owners to sign their DNS records allowing clients to authenticate them. This improves security by making it harder to manipulate DNS responses. If your DNS server supports this feature, it can be turned on. New setting for enabling DNSSEC is available in the Name Services app.
You can detect whether your current DNS supports DNS-over-TLS and DNSSEC by turning them on in the settings one at a time and running the diagnostics for the Names app. There is a diagnostic check which detects whether you can successfully resolve the domain name deb.debian.org.
If your current DNS server provided by your ISP does not support DNS-over-TLS or DNSSEC features, is censoring some domains names, or if you don't trust them enough, you can instead use one of the publicly available DNS servers. This can be done by editing network connections in the Networks app and adding DNS servers manually. You will need to deactivate and re-activate the network connection (or restart FreedomBox) for the settings to become active. After this, Names app will show you the currently configured DNS servers.
In some cases, when internet connection is available to the system by no DNS servers are known to systemd-resolved, the fallback DNS servers are used. This may happen, for example, due to misconfiguration when manually managing network configuration instead of using FreedomBox's default, the Network Manager. These fallback DNS servers, as defaulted by the upstream systemd project, include servers from Cloudflare and Google DNS servers. This has privacy implications but we felt that it was important to avoid FreedomBox from becoming unreachable due to misconfiguration. It was a difficult decision. Once you have proper DNS configuration and you know that it works, you can turn off fallback DNS servers using a new setting in the Privacy app. There is also a renewed notification in the web interface that will attract your attention towards this. You may also edit the list of Fallback DNS servers by creating a configuration file for systemd-resolved. See systemd-resolved documentation.