Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

webcache.googleusercontent.com

Post reply on HN
Print view View original

71–80 of 253 posts

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#71

Post by manacit »

mulmen wrote: post #49
manacit wrote: post #35

Earlier quoted context omitted.

I agree - there are not very many internet-scale (for lack of a better term), completely free and fast DNS servers who have an IP address that's easy to remember. Is that specific? sure, but I'll tell you when I go to set a new system up I'm going to type 8.8.8.8 because it's what comes to my mind.

For "easy to remember" my preference is to use Level 3 because I don't (directly) use them for any other service. 4.2.2.1 4.2.2.2 For as often as I manually configure DNS (I use DHCP) it's not onerous to look up the IPs of whatever DNS is preferable for your purpose. edit: Depending on who you are this may redirect you to a search portal. Probably best to find an alternate DNS provider.

Those resolvers are technically for Level3 customers only - they'll return one of those ad-filled "search" portals where an NXDOMAIN would be proper, see:

  ; > DiG 9.9.7-P3 > thisprobablydoesntexist.com @4.2.2.2
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER
Contrast that with 8.8.8.8:

  ; > DiG 9.9.7-P3 > thisprobablydoesntexist.com @8.8.8.8
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER
The NXDOMAIN response is proper - the level3 DNS servers are just a faster version of my ISPs goal to garner ad revenue at this point.

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#72

Post by manacit »

gruez wrote: post #51
manacit wrote: post #35

Earlier quoted context omitted.

I agree - there are not very many internet-scale (for lack of a better term), completely free and fast DNS servers who have an IP address that's easy to remember. Is that specific? sure, but I'll tell you when I go to set a new system up I'm going to type 8.8.8.8 because it's what comes to my mind.

Most ISPs provide their own DNS server via dhcp, why not use that?

My ISP (Spectrum / Time Warner) will not return a proper NXDOMAIN, and will instead send you to an ad-filled "search" page. They're also slower than Google DNS somehow, and generally not much more than an opportunity for my ISP to get more information and ad revenue from me.

At least I'm not paying Google to do the same, and I can trust that they'll send the proper results.

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#73

Post by ocdtrekkie »

cm2187 wrote: post #33
amq wrote: post #12

The concerning thing about this is that internet is increasingly dependent on Cloudflare, making it a single point of failure and exploitation. Somehow, people are not talking much about it, but a significant amount of sites have opted in for Cloudflare proxying, allowing it to see the traffic in plain text, while the visitors are made to believe that the connection is secure. Similarly, users will now use their fast…

To me that’s a diversification away from 8.8.8.8. I am absolutely not criticising google’s DNS, it’s a useful service. But I am happy to get more choice.

I wonder if, given that we now have a number of reasonably decent DNS services, if we can make software better to obscure/divide up our DNS use.

Take your 1.1.1.1, 8.8.8.8, 9.9.9.9, maybe your ISP DNS, etc., check against them randomly to try and avoid giving any one of them all of your DNS request traffic, maybe look up the same address on two of them to confirm that you're getting the same destination from both?

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#74

Post by shadowfacts »

jasongill wrote: post #40
shadowfacts wrote: post #22

The website at 1.1.1.1 isn't running, but the DNS service seems to be operating.

Why would there be a website at that IP? Google and OpenDNS don't serve a website from their resolver IP's; don't think I've ever seen any that do

Because that's the URL the cache is for: https://1.1.1.1/

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#75

Post by Asdfbla »

>supports encrypted DNS as well as DNS over HTTPS

Are encrypted DNS requests used by default? Does 1.1.1.1 somehow advertise to your client (whether it's a browser, the OS or a router) that encryption is possible? Do I have to configure my endpoint, which may expect to be able to send normal plaintext DNS requests, for it?

I guess DNS over HTTPS will surely not be supported by normal routers, but I don't know what other protocol Cloudflare refers to as "encrypted DNS", so maybe that will work.

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#76

Post by stordoff »

jasongill wrote: post #40
shadowfacts wrote: post #22

The website at 1.1.1.1 isn't running, but the DNS service seems to be operating.

Why would there be a website at that IP? Google and OpenDNS don't serve a website from their resolver IP's; don't think I've ever seen any that do

The submitted link is the Google Cache page for a website running at that IP:

"This is Google's cache of https://1.1.1.1/."

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#77

Post by scrollaway »

So am I correct assuming they support DNSCrypt if they claim they support encryption?

If that's the case that's really nice actually. Google DNS kinda silently launched DNS-over-HTTPS in 2016 but still no DNSCrypt; opendns are the only major ones supporting it.

Of course I stopped using dnscrypt at some point because it was a pain to maintain, and wasnt supported on most of my devices :/

Re: 1.1.1.1 Cloudflare DNS Resolver Soon to Be Announced?

#80

Post by userbinator »

manacit wrote: post #71
mulmen wrote: post #49

Earlier quoted context omitted.

For "easy to remember" my preference is to use Level 3 because I don't (directly) use them for any other service. 4.2.2.1 4.2.2.2 For as often as I manually configure DNS (I use DHCP) it's not onerous to look up the IPs of whatever DNS is preferable for your purpose. edit: Depending on who you are this may redirect you to a search portal. Probably best to find an alternate DNS provider.

Those resolvers are technically for Level3 customers only - they'll return one of those ad-filled "search" portals where an NXDOMAIN would be proper, see: ; > DiG 9.9.7-P3 > thisprobablydoesntexist.com @4.2.2.2 ;; global options: +cmd ;; Got answer: ;; ->>HEADER Contrast that with 8.8.8.8: ; > DiG 9.9.7-P3 > thisprobablydoesntexist.com @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER The NXDOMAIN response…

Those resolvers are technically for Level3 customers only

There is this comment from a few years ago, https://news.ycombinator.com/item?id=7120248 , linking to a blog post which is now only accessible from the Internet Archive, where a VP at Level3 stated they were public.

I use 4.2.2.x and I do get NXDOMAIN from them, and I'm not a L3 customer. I wonder if they respond differently depending on who you are...

Post reply on HN