Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Which DNS servers are you pointing to?

which.nameserve.rs

Post reply on HN
Print view View original

91–97 of 97 posts

Re: Show HN: Which DNS servers are you pointing to?

#91

Post by ycombonator »

JdeBP wrote: post #83
ycombonator wrote: post #75

Earlier quoted context omitted.

I tried doing the same, how do you precache and reduce query lookup times for a new website ? Could you explain your setup if you don’t mind ?

DNS lookup times are strongly affected by things entirely within the control of DNS content publishers and nothing to do with what one uses locally, namely whether "glue" is in-bailiwick. Out-of-bailiwick glue causes a massive explosion of additional back-end queries. This has been a known problem for decades, people having encouraged in-bailiwick "glue" since at least the turn of the century. If you want to decrease…

Thank you. What an awesome explanation. This has been incredibly helpful. Perhaps one of the web optimizations that site owners need to think about is use in-bailiwick delegations

Re: Show HN: Which DNS servers are you pointing to?

#92

Post by Fileformat »

anderspitman wrote: post #90

> I specifically made the API be JSONP only (i.e. you need to provide a callback parameter), so if you abuse it, bad things will happen to your clients! Is OP threatening to inject harmful code into abusers' script tags, or am I totally misreading this.

Yes: I've made free APIs in the past that have been abused. I've made this for my needs and am happy to share, but it isn't a moneymaker. It is really simple to host your own copy, and I've tried make it pretty clear that it should only be for light, non-commercial use.

You can see the code, so obviously I haven't done anything nefarious. Hopefully just the possibility will be enough of a deterrant.

I'm curious how everyone else is dealing with freeloaders. I'm open to alternative suggestions.

Re: Show HN: Which DNS servers are you pointing to?

#93

Post by anderspitman »

Fileformat wrote: post #92
anderspitman wrote: post #90

> I specifically made the API be JSONP only (i.e. you need to provide a callback parameter), so if you abuse it, bad things will happen to your clients! Is OP threatening to inject harmful code into abusers' script tags, or am I totally misreading this.

Yes: I've made free APIs in the past that have been abused. I've made this for my needs and am happy to share, but it isn't a moneymaker. It is really simple to host your own copy, and I've tried make it pretty clear that it should only be for light, non-commercial use. You can see the code, so obviously I haven't done anything nefarious. Hopefully just the possibility will be enough of a deterrant. I'm curious how e…

Oh I don't have an alternative suggestion. Just thought it was an interesting approach. Also I've never used JSONP and hadn't considered the security implications of using a JSONP api you don't control.

Re: Show HN: Which DNS servers are you pointing to?

#94

Post by tptacek »

t0astbread wrote: post #79
fwr wrote: post #26

Neat, this helped me realize I haven't switched away from my provider's default DNS when I moved in, which is something I usually do. How to choose a DNS server? I usually just go with 8.8.8.8/8.8.4.4, I used to always test this with Namebench ( https://en.wikipedia.org/wiki/Namebench ) and these always turned out as the fastest - but it looks like it hasn't been updated since 2010 - are there any better tools for th…

Performance over privacy is a fine tradeoff but if you have the means to, I would recommend avoiding unencrypted unauthenticated DNS over UDP/53. It's probably not a big threat in practice but if someone were to intercept your DNS traffic, they could redirect your internet connections to a different server. TLS (or other forms of authentication) should handle authenticity issues but (probably) not everything on your…

You are not mistaken; DNSSEC doesn't encrypt records, and DoH does. DoH also authenticates the channel between you and your name server. It's likely that DoH will ultimately obviate the need for DNSSEC anywhere.

Re: Show HN: Which DNS servers are you pointing to?

#95

Post by ignoramous »

Arnavion wrote: post #61
imglorp wrote: post #46

Earlier quoted context omitted.

Except for certain applications that want to do their own DNS, eg DOH...

Not the person you responded to, but I too run my own resolver on my router. I also have the router configured to drop [1] all outgoing packets to any DoH IPs; there are a bunch of lists for those, like https://github.com/Sekhan/TheGreatWall [1]: Specifically, to reject them, which means sending a TCP reset / ICMP unreachable response back rather than blackholing them.

I run a DoH resolver domain-fronted by Cloudflare... Blocking it at IP level would mean blocking other Cloudflare proxied websites. With IPv6, a DoH endpoint rotating between various IPs might get even more trickier to block.

A better strategy might be to look at the SNI for hostname at least until ESNI becomes prevalent (the one I run supports ESNI already).

Re: Show HN: Which DNS servers are you pointing to?

#96

Post by apple4ever »

bwoodcock wrote: post #88
ilikepi wrote: post #52

Earlier quoted context omitted.

PCH provides the infrastructure for Quad9...so I don't think it makes sense to say that Quad9 is "relaying" DNS traffic to PCH/WoodyNet. There isn't some organizational boundary that's being crossed.

Hi. I'm Bill Woodcock, the eponymous "woody" of "woodynet." And executive director of PCH, and chairman of Quad9's board. They are three separate corporations, which exist for different reasons, and under different tax regulations (PCH and Quad9 are public-benefit not-for-profits, whereas WoodyNet exists to pay taxes on taxable transactions and keep the non-profits' books clean), but they're very closely related. In…

Thanks Bill for the explanation. I appreciate the detail about why WoodyNet/PCH shows up.
Post reply on HN