Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Neutral DNS servers?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 99 posts

Re: Ask HN: Neutral DNS servers?

#31

Post by CaliforniaKarl »

DavideNL wrote: post #26
neilalexander wrote: post #2

You could just run a recursive resolver yourself by using the root hints. You don't need to delegate your DNS queries onto a third-party resolver like Quad9. https://www.iana.org/domains/root/files

Although querying the root servers directly is always unencrypted right? So your ISP can see and might manipulate all queries at will?

In addition to the root hints, you should also download the DNSSEC anchor key (available on the same site as the root hints). That will let you detect manipulations of records that are DNSSEC-signed.

Otherwise, you could spin up your recursive resolver on your cloud, VPS, or other hosting provider of choice, and then use that.

Re: Ask HN: Neutral DNS servers?

#32

Post by nfriedly »

egamirorrim wrote: post #29
nfriedly wrote: post #9

I know this isn't quite what your asking for, but one idea is to set up a Pi-hole + unbound: https://docs.pi-hole.net/guides/dns/unbound/ Unbound is basically your own private DNS resolver and then Pi-hole lets you filter out whatever "junk" you don't want.

I don't know if it's an obvious question or not, but how does performance compare with your own unbound vs quad1/8/9? I imagine it's slower in general?

I'm not personally running unbound, just a Pi-hole that up-stream's to my ISP's DNS, so I can't answer you from first-hand experience. But, according to drexlspivey, unbound will pre-fetch common queries, so it probably ends up being faster on average - https://news.ycombinator.com/item?id=30646020

Re: Ask HN: Neutral DNS servers?

#33

Post by Arnavion »

CaliforniaKarl wrote: post #31
DavideNL wrote: post #26

Earlier quoted context omitted.

Although querying the root servers directly is always unencrypted right? So your ISP can see and might manipulate all queries at will?

In addition to the root hints, you should also download the DNSSEC anchor key (available on the same site as the root hints). That will let you detect manipulations of records that are DNSSEC-signed. Otherwise, you could spin up your recursive resolver on your cloud, VPS, or other hosting provider of choice, and then use that.

Right, DNSSEC will solve the "manipulate" problem, but it won't solve the "see" problem. But whether that's a concern is up to you. You could run your resolver on a VPS and speak DoT / DoH to that, which shifts the leak from your ISP to your VPS provider.

Re: Ask HN: Neutral DNS servers?

#34

Post by tptacek »

Arnavion wrote: post #33
CaliforniaKarl wrote: post #31

Earlier quoted context omitted.

In addition to the root hints, you should also download the DNSSEC anchor key (available on the same site as the root hints). That will let you detect manipulations of records that are DNSSEC-signed. Otherwise, you could spin up your recursive resolver on your cloud, VPS, or other hosting provider of choice, and then use that.

Right, DNSSEC will solve the "manipulate" problem, but it won't solve the "see" problem. But whether that's a concern is up to you. You could run your resolver on a VPS and speak DoT / DoH to that, which shifts the leak from your ISP to your VPS provider.

It doesn't solve the "manipulate" problem we're talking about here, either: nothing about DNSSEC prevents a DNS server (or middlebox) from denying results to a disfavored domain; it only (situationally) prevents them from redirecting it somewhere else. (And, of course, it only works if you're running your own recursive server; it does nothing whatsoever in the 8.8.8.8-type use case).

Re: Ask HN: Neutral DNS servers?

#35

Post by celsoazevedo »

walrus01 wrote: post #25
celsoazevedo wrote: post #17

If you already run your own DNS resolver, query the root servers directly. No need to trust DNS providers when you can do the same thing yourself.

based on the OP's description of yandex and what I presume to be their location it's not impossible that some time in the future unencrypted 53/udp traffic leaving and entering the country may be blocked or messed with

In that case maybe something like DNSCrypt[0] and a 3rd party provider makes sense. On top of the encrypted connection, DNSCrypt has the option to proxy queries to improve privacy.

This only helps if they're not doing any advanced blocking though. If I remember correctly, when Russia blocked Telegram, they were blocking their IPs, not just DNS queries. If the rumours of a "RuNet" are true, then they probably need something more advanced (eg: a VPN with traffic obfuscation, Tor, etc).

---

[0] https://github.com/DNSCrypt/dnscrypt-proxy

Re: Ask HN: Neutral DNS servers?

#36

Post by aaomidi »

NotAWorkNick wrote: post #3
neilalexander wrote: post #2

You could just run a recursive resolver yourself by using the root hints. You don't need to delegate your DNS queries onto a third-party resolver like Quad9. https://www.iana.org/domains/root/files

Thanks for that, appreciated. I'll be honest- I'm just a 'little guy' in the food chain so I always figured that doing something like that was for the ISP level folks One quick question though - After taking a quick skim of it the list seems to be extremely 'Western-Centric' (reference link https://www.internic.net/domain/named.root )

They are western centric, and unfortunately, in this current state of the web they're still essentially the authority on DNS.

Alternatively, you can maintain the NSes for all the TLDs you are particularly interested in, and alert yourself if they change to something you don't recognize.

Finally, keep in mind that whatever you do, you need to have multiple vantage points to the internet. There's not a lot stopping your ISP from not delivering you to the right host when you try to talk to it. E.g. your ISP can fake the DNS responses.

Re: Ask HN: Neutral DNS servers?

#37

Post by Arnavion »

tptacek wrote: post #34
Arnavion wrote: post #33

Earlier quoted context omitted.

Right, DNSSEC will solve the "manipulate" problem, but it won't solve the "see" problem. But whether that's a concern is up to you. You could run your resolver on a VPS and speak DoT / DoH to that, which shifts the leak from your ISP to your VPS provider.

It doesn't solve the "manipulate" problem we're talking about here, either: nothing about DNSSEC prevents a DNS server (or middlebox) from denying results to a disfavored domain; it only (situationally) prevents them from redirecting it somewhere else. (And, of course, it only works if you're running your own recursive server; it does nothing whatsoever in the 8.8.8.8-type use case).

Yes, that's true.

Re: Ask HN: Neutral DNS servers?

#38

Post by aaomidi »

nimbius wrote: post #30

Google DNS should at this point be considered harmful. Devs love to hardcode it in resolvd because 'user experience' but there's ample evidence its just analytics. Quad 1 cloudflare is reliable doh but comes from a company with a history of bloviating nonsense about internet freedom only to eagerly capitulate to Twitter lynchmobs and blacklist a customer or ten. https://dnscrypt.info/public-servers/ will give you a n…

I know what you're referring to (systemd-resolved "defaulting" to Google DNS). That "default" is a compile-time value, if you use something like gentoo you get to be in full control of what that default value is.

Re: Ask HN: Neutral DNS servers?

#39

Post by lapinot »

egamirorrim wrote: post #29
nfriedly wrote: post #9

I know this isn't quite what your asking for, but one idea is to set up a Pi-hole + unbound: https://docs.pi-hole.net/guides/dns/unbound/ Unbound is basically your own private DNS resolver and then Pi-hole lets you filter out whatever "junk" you don't want.

I don't know if it's an obvious question or not, but how does performance compare with your own unbound vs quad1/8/9? I imagine it's slower in general?

I never measured anything, but i'm running a recursive resolver on my laptop since a couple years (knot resolver) and never had any performance problem.

Re: Ask HN: Neutral DNS servers?

#40

Post by vetinari »

jiveturkey wrote: post #12

huh. Why aren't you simply querying the roots and from there the SOA for any domain?

It is very easy to hijaack port 53 traffic, so you might not talk to DNS server you think you do.

Heck, I did that at home for Chromecast and other devices that hardcode their DNS.

Post reply on HN