Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

medium.com

Post reply on HN
Print view View original

81–90 of 364 posts

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#81

Post by alwillis »

plg wrote: post #50
djsumdog wrote: post #41

I feel like people forgot about how CloudFlare, Google, et. al. can new effectively censor content they don't agree with: https://fightthefuture.org/article/the-new-era-of-corporate-... ..and even though CloudFlare back pedaled on that particular decision somewhat, it still happened. If you really want something fast and secure, run your own caching DNS that uses root DNS servers.

> If you really want something fast and secure, run your own caching DNS that uses root DNS servers. is there a good tutorial for this somewhere?

What you want is DNSSEC-trigger, which installs Unbound on 127.0.0.1: https://www.nlnetlabs.nl/projects/dnssec-trigger/

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#82

Post by Daviey »

tonfa wrote: post #67
Daviey wrote: post #29

Earlier quoted context omitted.

There is 2 main different ways, one which does what you say - the other i'd say is pretty much OK. If your local DNS server is merely querying an upstream resolver (like 1.1.1.1 / 8.8.8.8) on your behalf, then yes - it is no different. If however, you query the root nameservers for the glue record for a domain and query the domain's own nameservers directly, then it is pretty good... As you are neither querying your…

But you also leak more things to TLAs right?

Yeah, there is that.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#83

Post by jsjohnst »

halayli wrote: post #73

This tests the performance / distance between vps data centers and the dns server's data centers. imho it's better to have a test web page that consumers visit and establishes a tcp connection to those dns services and estimate the rtt of a single packet from the time it took to establish the connection, or test via the https interface for services that support it.

While I whole-heartedly agree with your objection, I question the solution. How do you get high accuracy timing of DNS resolution in JavaScript inside the browser?

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#84

Post by larrybud »

JepZ wrote: post #74
anilgulecha wrote: post #2

I think we'll start seeing the standard configuration of 1.1.1.1,8.8.8.8 everywhere. Google/Cloudflare tackled the UX of free DNS spectacularly with these gold IP addresses. It's the primary reason I use them instead of OpenDNS, which was an earlier player in this space.

I wonder how much Cloudflare paid/pays for the 1.1.1.1

Read the announcement: https://blog.cloudflare.com/announcing-1111/ "APNIC's research group held the IP addresses 1.1.1.1 and 1.0.0.1. While the addresses were valid, so many people had entered them into various random systems that they were continuously overwhelmed by a flood of garbage traffic. APNIC wanted to study this garbage traffic but any time they'd tried to announce the IPs, the flood would overwhelm any conventional network.

We talked to the APNIC team about how we wanted to create a privacy-first, extremely fast DNS system. They thought it was a laudable goal. We offered Cloudflare's network to receive and study the garbage traffic in exchange for being able to offer a DNS resolver on the memorable IPs. And, with that, 1.1.1.1 was born."

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#86

Post by mino »

coaxial wrote: post #60
lucb1e wrote: post #56

Which ISPs are so bad that you want to use external services, which are further in distance than your ISP, for speed? When I test with my ISP, they beat all of these services (both IPv4 and IPv6). They're simply closer to me in terms of hops. My router is another story though. The Fritzbox (>200eur router) adds 6ms of latency, and that's what is advertised over DHCP. (Might still be fine, since cached queries are fas…

My isp got the brilliant idea of rolling their own YouTube cache servers. It's great in theory but in or active they're under powered and so at peak hours I can't even stream 240p on my 500mbits connection. I've had to block their cache servers in my firewall for YouTube to be butter smooth at 1080p consistently. Another example is bell Canada who used to mine your DNS queries to profile you for ads, or ISPs that hig…

It is common for ISP to host instances of the Google Global Cache (GGC, see https://peering.google.com/) which are used for many Google services, most importantly YouTube.

In fact, in many cases Google itself "suggests" to ISP that they host a few GGC servers.

They are directly monitored by Google, and the ISP has basically no say in how they are run. Capacity is managed by Google directly.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#87

Post by jsjohnst »

oelmekki wrote: post #53
plg wrote: post #50

Earlier quoted context omitted.

> If you really want something fast and secure, run your own caching DNS that uses root DNS servers. is there a good tutorial for this somewhere?

If you want to do it on your local linux system, it's pretty easy: you just need to install bind9 and use `nameserver 127.0.0.1` in your /etc/resolv.conf Bind9 has a poor reputation because of how difficult it is to use it to define zones (manage a domain name), but if you want to use it as a resolver, it's basically plug'n'play. Huge bonus included : if you want to flush the cache, you just need to run `sudo rndc fl…

> Bind9 has a poor reputation because of how difficult it is to use it to define zones

YMMV, but bind’s poor reputation in my circles has completely to do with this:

https://www.cvedetails.com/product/144/ISC-Bind.html?vendor_...

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#88

Post by notreallyauser »

JepZ wrote: post #74
anilgulecha wrote: post #2

I think we'll start seeing the standard configuration of 1.1.1.1,8.8.8.8 everywhere. Google/Cloudflare tackled the UX of free DNS spectacularly with these gold IP addresses. It's the primary reason I use them instead of OpenDNS, which was an earlier player in this space.

I wonder how much Cloudflare paid/pays for the 1.1.1.1

No cash outlay. Read the blog, but tl;dr is that it's quid pro quo as the owners can't afford to stand it up due to the volume of junk traffic (but want to, to study the junk) -- cloudflare can and will let the owner study the junk.

What cloudflare don't say in any of their materials that I've seen is the agreement is for an initial 5 years, so YMMV after that.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#89

Post by cliffj »

lucb1e wrote: post #56

Which ISPs are so bad that you want to use external services, which are further in distance than your ISP, for speed? When I test with my ISP, they beat all of these services (both IPv4 and IPv6). They're simply closer to me in terms of hops. My router is another story though. The Fritzbox (>200eur router) adds 6ms of latency, and that's what is advertised over DHCP. (Might still be fine, since cached queries are fas…

There was a story in acient China something like below: One official:People are starving to death, my king. The King: Really, why don't they eat some meat pasty? -------------- You don't have any problems, so would the others right?

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#90

Post by swinglock »

oelmekki wrote: post #64
vertex-four wrote: post #55

Earlier quoted context omitted.

Honestly, isn’t Unbound a better shout if you’re not going to be fiddling with it? Just install, run, and edit /etc/resolv.conf to point at 127.0.0.1.

Well, you're describing exactly how to do it with bind9 :) What make you say Unbound is better?

Unbound is more lightweight. All it does is recursive lookups, it has no option for being authoritative. If that's all you need then that's better.

There are other options too, I don't know what makes Unbound better than PowerDNS Recursor or Knot Resolver.

Post reply on HN