51–60 of 99 posts
I know this isn't quite what your asking for, but one idea is to set up a Pi-hole + unbound: https://docs.pi-hole.net/guides/dns/unbound/ Unbound is basically your own private DNS resolver and then Pi-hole lets you filter out whatever "junk" you don't want.
Earlier quoted context omitted.
Although querying the root servers directly is always unencrypted right? So your ISP can see and might manipulate all queries at will?
In theory if you got a resolver which could disable UDP queries, it would then default to TCP, and the ISP couldn't manipulate those. Don't know if any resolver supports disabling UDP though.
Earlier quoted context omitted.
It doesn't solve the "manipulate" problem we're talking about here, either: nothing about DNSSEC prevents a DNS server (or middlebox) from denying results to a disfavored domain; it only (situationally) prevents them from redirecting it somewhere else. (And, of course, it only works if you're running your own recursive server; it does nothing whatsoever in the 8.8.8.8-type use case).
> nothing about DNSSEC prevents a DNS server (or middlebox) from denying results to a disfavored domain But at least it is detectable thanks to NSEC and NSEC3 records.
Question after reading (very interesting) answers: what is the downsize using the root servers instead of the well-known ones? (1.1.1.1, 8.8.8.8, ...) Is it the cache that improves resolution speed in a meaningful way?
Running your own recursive resolver will almost certainly be slower, on the order of 2x latency. I should test it...
Also, DNS-over-HTTP and DNS-over-TLS are not available with all DNS servers, but can be readily enabled to secure the last mile when the upstream public resolver supports it.
Google DNS should at this point be considered harmful. Devs love to hardcode it in resolvd because 'user experience' but there's ample evidence its just analytics. Quad 1 cloudflare is reliable doh but comes from a company with a history of bloviating nonsense about internet freedom only to eagerly capitulate to Twitter lynchmobs and blacklist a customer or ten. https://dnscrypt.info/public-servers/ will give you a n…
Google DNS should at this point be considered harmful. Devs love to hardcode it in resolvd because 'user experience' but there's ample evidence its just analytics. Quad 1 cloudflare is reliable doh but comes from a company with a history of bloviating nonsense about internet freedom only to eagerly capitulate to Twitter lynchmobs and blacklist a customer or ten. https://dnscrypt.info/public-servers/ will give you a n…
Can you point to the evidence that Google DNS is used for analytics?
Google stated that for the purposes of performance and security, the querying IP address will be deleted after 24–48 hours, but Internet service provider (ISP) and location information are stored permanently on their servers.
Earlier quoted context omitted.
The canonical DNS system itself is extremely Western-Centric.
As are many Western inventions
[0] Original DNS RFC1035 https://datatracker.ietf.org/doc/html/rfc1035 (1987) [1] Somewhat cheekily as the inventor of DNS has a Greek surname. https://en.wikipedia.org/wiki/Paul_Mockapetris [2] 2000+ years ago and mature enough to have QoS+max-TTL/hop: http://libgen.rs/scimag/10.1163%2F9789004292123 (pp17-48) + where I write this. [3] Evidenced to 9th century BC https://www.ucl.ac.uk/sargon/essentials/governors/thekingsro... [4] Start by fixing https://en.wikipedia.org/wiki/Timeline_of_postal_history
Personally, I use nextdns on a paid plan (£17/year). Full control, can change to no logs, or logs stored in Switzerland. They have a free plan too
I do this. I have my own resolver on my own server running unbound and it gets service from my paid nextdns account. Sort of like having a pihole but it is available from anywhere and I don’t have to run a rpi…
Earlier quoted context omitted.
Can you point to the evidence that Google DNS is used for analytics?
https://en.m.wikipedia.org/wiki/Google_Public_DNS Google stated that for the purposes of performance and security, the querying IP address will be deleted after 24–48 hours, but Internet service provider (ISP) and location information are stored permanently on their servers.
Google DNS should at this point be considered harmful. Devs love to hardcode it in resolvd because 'user experience' but there's ample evidence its just analytics. Quad 1 cloudflare is reliable doh but comes from a company with a history of bloviating nonsense about internet freedom only to eagerly capitulate to Twitter lynchmobs and blacklist a customer or ten. https://dnscrypt.info/public-servers/ will give you a n…
Can you point to the evidence that Google DNS is used for analytics?
At this point, the onus is to prove thing $x is not used for Google analytics.