<blockquote>
<p>Does querying the DNS Seeds via TOR return .onion addresses?</p>
</blockquote>
<p>Sometimes. Before the Bitcoin Core PR (<a href="https://github.com/bitcoin/bitcoin/pull/25678" rel="nofollow noreferrer">#25678</a>) you would expect to fall back to relying on the .onion addresses in the hardcoded seeds though you may get onion addresses if you are lucky to connect to a peer that happens to offer these.</p>
<p>As lightlike says in the comment:</p>
<blockquote>
<p>For Tor Bitcoin Core currently first does an AddrFetch connection (a short-lived connection with the goal of getting addresses) via Tor exit nodes to an address each DNS seed resolves to, violating the -onlynet option. This may result in some onion addresses, but only if we are lucky to connect to a peer that happens to offer these. #25678 suggests to change that behavior to skip the DNS seed step and immediately resort to hardcoded peers</p>
</blockquote>
<p>With regards to the second question:</p>
<blockquote>
<p>Additionally, are the DNS queries encrypted or in plain-text for IP nodes?</p>
</blockquote>
<p>Messages between nodes are currently not encrypted but there is ongoing <a href="https://gist.github.com/dhruv/5b1275751bc98f3b64bcafce7876b489" rel="nofollow noreferrer">work</a> to change this in future.</p>

CC BY-SA 4.0
2022-08-10T22:20:51.217Z
See the OP of #25678, for Tor Bitcoin Core currently first does an AddrFetch connection (a short-lived connection with the goal of getting addresses) via Tor exit nodes to an address each DNS seed resolves to, violating the -onlynet option. This may result in some onion addresses, but only if we are lucky to connect to a peer that happens to offer these.
#25678 suggests to change that behavior to skip the DNS seed step and immediately resort to hardcoded peers.
Lightlike
CC BY-SA 4.0
2022-08-14T12:25:51.857Z
@Lightlike: Thanks for the correction and the additional detail. Feel free to post your  own alternative answer in future in cases like this. Your answer is much better than mine :)
Michael Folkson
CC BY-SA 4.0
2022-10-05T15:48:43.400Z
"Messages between nodes are currently not encrypted but there is ongoing work to change this in future."

I'm not very familiar with exactly how DNS is used in Core but afaik these queries are not between nodes, but rather between a node and a DNS server so I don't think BIP324 applies?
stickies-v
CC BY-SA 4.0
2022-08-08T09:49:51.400Z
2022-08-14T12:23:03.910Z
2022-08-14T12:23:03.910Z
Michael Folkson
<p>Does querying the DNS Seeds via TOR return .onion addresses? If not, then if my node is a TOR only node, does it always get the .onion addresses to connect to, from the hard-coded list?</p>
<p>Additionally, are the DNS queries encrypted or in plain-text for IP nodes?</p>

<bitcoin-core><tor><p2p><peer-discovery><dns>
DNS Seeds for TORv3
Vinay Shetty
# DNS Seeds for TORv3

(Asked by: username_0 on 2022-08-08)

Does querying the DNS Seeds via TOR return .onion addresses? If not, then if my node is a TOR only node, does it always get the .onion addresses to connect to, from the hard-coded list?

Additionally, are the DNS queries encrypted or in plain-text for IP nodes?

**Tags:** bitcoin-core, tor, p2p, peer-discovery, dns


---

## 1 answers

### Answer by username_1 on 2022-08-08. Score: 2 | Accepted answer

> Does querying the DNS Seeds via TOR return .onion addresses?

Sometimes. Before the Bitcoin Core PR ([#25678](https://github.com/bitcoin/bitcoin/pull/25678)) you would expect to fall back to relying on the .onion addresses in the hardcoded seeds though you may get onion addresses if you are lucky to connect to a peer that happens to offer these.

As lightlike says in the comment:

> For Tor Bitcoin Core currently first does an AddrFetch connection (a short-lived connection with the goal of getting addresses) via Tor exit nodes to an address each DNS seed resolves to, violating the -onlynet option. This may result in some onion addresses, but only if we are lucky to connect to a peer that happens to offer these. #25678 suggests to change that behavior to skip the DNS seed step and immediately resort to hardcoded peers

With regards to the second question:

> Additionally, are the DNS queries encrypted or in plain-text for IP nodes?

Messages between nodes are currently not encrypted but there is ongoing [work](https://gist.github.com/dhruv/5b1275751bc98f3b64bcafce7876b489) to change this in future.

> **Comments:**
> **username_2**: See the OP of #25678, for Tor Bitcoin Core currently first does an AddrFetch connection (a short-lived connection with the goal of getting addresses) via Tor exit nodes to an address each DNS seed resolves to, violating the -onlynet option. This may result in some onion addresses, but only if we are lucky to connect to a peer that happens to offer these. #25678 suggests to change that behavior to skip the DNS seed step and immediately resort to hardcoded peers.  
> **username_1**: @username_2: Thanks for the correction and the additional detail. Feel free to post your  own alternative answer in future in cases like this. Your answer is much better than mine :)  
> **username_3**: "Messages between nodes are currently not encrypted but there is ongoing work to change this in future."  I'm not very familiar with exactly how DNS is used in Core but afaik these queries are not between nodes, but rather between a node and a DNS server so I don't think BIP324 applies?  

---

