Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Neutral DNS servers?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 99 posts

Re: Ask HN: Neutral DNS servers?

#41

Post by 0xbadcafebee »

DavideNL wrote: post #26
neilalexander wrote: post #2

You could just run a recursive resolver yourself by using the root hints. You don't need to delegate your DNS queries onto a third-party resolver like Quad9. https://www.iana.org/domains/root/files

Although querying the root servers directly is always unencrypted right? So your ISP can see and might manipulate all queries at will?

In theory if you got a resolver which could disable UDP queries, it would then default to TCP, and the ISP couldn't manipulate those. Don't know if any resolver supports disabling UDP though.

Re: Ask HN: Neutral DNS servers?

#43

Post by teejmya »

CaliforniaKarl wrote: post #31
DavideNL wrote: post #26

Earlier quoted context omitted.

Although querying the root servers directly is always unencrypted right? So your ISP can see and might manipulate all queries at will?

In addition to the root hints, you should also download the DNSSEC anchor key (available on the same site as the root hints). That will let you detect manipulations of records that are DNSSEC-signed. Otherwise, you could spin up your recursive resolver on your cloud, VPS, or other hosting provider of choice, and then use that.

And make sure it only resolves records for you. Don't leave it wide open or it will be used as an attack vector. https://www.cloudflare.com/learning/ddos/dns-amplification-d...

Re: Ask HN: Neutral DNS servers?

#44

Post by tambeb »

nmjohn wrote: post #22

Given you only mention censorship/chilling effect and not privacy - why isn't 8.8.8.8 sufficient? Have there been instances of domains it censored and stopped resolving that I'm not aware of? I guess I'm confused on the benefit (theoretical or practical) one would get by using that variety of resolvers. Is it just to prevent theoretical censorship at the DNS level?

My question exactly. In another comment here I asked for some examples for the claim that some .ru domains were being black holed.

Re: Ask HN: Neutral DNS servers?

#45

Post by moltke »

The DNS (as it exists today) is supposed to be the equivalent of Switzerland. The internet community has said over and over again they're not interested in censoring the internet or removing any group of people from it.

It sounds like what you really want is your own recursive resolver.

Re: Ask HN: Neutral DNS servers?

#46

Post by progval »

tptacek wrote: post #34
Arnavion wrote: post #33

Earlier quoted context omitted.

Right, DNSSEC will solve the "manipulate" problem, but it won't solve the "see" problem. But whether that's a concern is up to you. You could run your resolver on a VPS and speak DoT / DoH to that, which shifts the leak from your ISP to your VPS provider.

It doesn't solve the "manipulate" problem we're talking about here, either: nothing about DNSSEC prevents a DNS server (or middlebox) from denying results to a disfavored domain; it only (situationally) prevents them from redirecting it somewhere else. (And, of course, it only works if you're running your own recursive server; it does nothing whatsoever in the 8.8.8.8-type use case).

> nothing about DNSSEC prevents a DNS server (or middlebox) from denying results to a disfavored domain

But at least it is detectable thanks to NSEC and NSEC3 records.

Re: Ask HN: Neutral DNS servers?

#47

Post by endymi0n »

aaomidi wrote: post #36
NotAWorkNick wrote: post #3

Earlier quoted context omitted.

Thanks for that, appreciated. I'll be honest- I'm just a 'little guy' in the food chain so I always figured that doing something like that was for the ISP level folks One quick question though - After taking a quick skim of it the list seems to be extremely 'Western-Centric' (reference link https://www.internic.net/domain/named.root )

They are western centric, and unfortunately, in this current state of the web they're still essentially the authority on DNS. Alternatively, you can maintain the NSes for all the TLDs you are particularly interested in, and alert yourself if they change to something you don't recognize. Finally, keep in mind that whatever you do, you need to have multiple vantage points to the internet. There's not a lot stopping you…

> They are western centric, and unfortunately, in this current state of the web they're still essentially the authority on DNS.

I‘m curious to see your evidence on that or which future state you would see as a more fortunate one.

Re: Ask HN: Neutral DNS servers?

#49

Post by justsomehnguy »

0xbadcafebee wrote: post #41
DavideNL wrote: post #26

Earlier quoted context omitted.

Although querying the root servers directly is always unencrypted right? So your ISP can see and might manipulate all queries at will?

In theory if you got a resolver which could disable UDP queries, it would then default to TCP, and the ISP couldn't manipulate those. Don't know if any resolver supports disabling UDP though.

Unbound

Re: Ask HN: Neutral DNS servers?

#50

Post by kfrzcode »

tylersmith wrote: post #23
NotAWorkNick wrote: post #3

Earlier quoted context omitted.

Thanks for that, appreciated. I'll be honest- I'm just a 'little guy' in the food chain so I always figured that doing something like that was for the ISP level folks One quick question though - After taking a quick skim of it the list seems to be extremely 'Western-Centric' (reference link https://www.internic.net/domain/named.root )

The canonical DNS system itself is extremely Western-Centric.

As are many Western inventions
Post reply on HN