Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

medium.com

Post reply on HN
Print view View original

151–160 of 364 posts

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#151

Post by JohnTHaller »

josteink wrote: post #105
rmrfrmrf wrote: post #66

Earlier quoted context omitted.

NXDOMAIN hijacking is enough for me to switch, and most ISPs are doing it nowadays.

That’s quite a bold claim. Got any data to back it up? Source: I've yet to see this on any ISP I've used anywhere , sans free airport wifis. Travelled pretty much every continent on earth.

Time Warner/Spectrum, the largest provider in NYC (and the only one that services my apt building) does this. They let you turn it off in your account settings, but it doesn't actually turn it off.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#152

Post by betaby »

ralfm wrote: post #114

Why is Montreal reporting abnormally high response times across the board? For example: # Cloudflare Toronto 3.42ms vs. Montreal 17ms; # Google Toronto 9.42ms vs. Montreal 16.71ms.

Perhaps that particular test setup doesn't go to QIX where both of them are present. Cloidflare much faster from QIX peering nonetheless.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#153

Post by betaby »

concatime wrote: post #125
ralfm wrote: post #114

Why is Montreal reporting abnormally high response times across the board? For example: # Cloudflare Toronto 3.42ms vs. Montreal 17ms; # Google Toronto 9.42ms vs. Montreal 16.71ms.

I live in Montréal, and I saw the same tendency. Cloudflare has a datacenter here. Waiting for a tangible explanation…

Are you using BIG ISP or small? Big guys don't peer at QIX and drag your traffic to US. On other side, smaller players peer at QIX https://qix.ca/members

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#154

Post by howard941 »

aarmenaa wrote: post #132
rmrfrmrf wrote: post #66

Earlier quoted context omitted.

NXDOMAIN hijacking is enough for me to switch, and most ISPs are doing it nowadays.

Brighthouse did it before they became Spectrum. They did allow me to turn it off though. I've heard that this is still the case with Spectrum, but I haven't tested.

Spectrum is still doing it (N Pinellas Co FL). Not sure if it can be turned off.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#155

Post by pavs »

jamra wrote: post #127
pavs wrote: post #37

Earlier quoted context omitted.

You can query DNS root server. https://www.iana.org/domains/root/servers And use long TTL time with large cache size. Other than some small edge cases, this is pretty much the most secure and fastest DNS performance you will have, in most instances getting about 1 or I have been using unbound for at least 4 years. Simple and fast.

Ok I'm going to try and set up Cloudflare's DNS setup in Go to point to those root servers and see what I get. Is there a different DNS server you would recommend? I don't think my usage requires anything special.

BIND is the industry standard - but insanely overkill for your use case. Unbound is very easy and lightweight. Dnsmasq is another option, but I don't think you can setup root server with it.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#156

Post by vimda »

kawsper wrote: post #130
djsumdog wrote: post #41

I feel like people forgot about how CloudFlare, Google, et. al. can new effectively censor content they don't agree with: https://fightthefuture.org/article/the-new-era-of-corporate-... ..and even though CloudFlare back pedaled on that particular decision somewhat, it still happened. If you really want something fast and secure, run your own caching DNS that uses root DNS servers.

They also allow for websites to look HTTPs-enabled, but the transfer happens in clear text, e.g.: Client -(HTTPS)> CloudFlare -(HTTP)> Server. For a company that allegedly is privacy first, this is a huge violation of trust. I also know about some people that run websites that can't get Stripe because they can't figure out how to configure SSL for their website, they just plug in CloudFlare in front, and now they can…

The threat model of MiTM attacks leans heavily towards the client side than the Cloudflare -> origin connection. It's not perfect and it would be fantastic if everyone could setup SSL on their origin servers, but in the end there's are more script kiddies in coffeeshops than there are tier1 isps trying to steal your data

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#157

Post by Buge »

Dolores12 wrote: post #52
Buge wrote: post #25

Earlier quoted context omitted.

What? It says >Our test was very simple and we performed 70 DNS lookups That's not ICMP.

Well, the article says so, but they actually measured icmp response. All major domains are in DNS cache anyway. If you look at Yandex result you see it performed very poorly. Why does it resolve popular domains so slow? The reason is it has one server and it is located in Moscow. So i would say icmp is good proxy to actual performance.

It would be a measure of ping + cache latency. That's still different than just ping.

And is your point that the tested sites aren't popular in Russia?

>for different popular domains (google, facebook, twitter, gmail, etc)

google.com facebook.com and twitter.com are all in the top 50 sites in Russia[1]. And gmail.com is number 6000 globally[2], so it's unpopular everywhere, not just Russia. Popular sites in Russia tend to be popular elsewhere, and vice versa.

[1] https://www.similarweb.com/top-websites/russian-federation

[2] https://www.alexa.com/siteinfo/gmail.com

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#158

Post by arca_vorago »

pavs wrote: post #37
jamra wrote: post #24

Earlier quoted context omitted.

But your DNS will have to query other DNS providers so if you’re the only one using it, it won’t be private.

You can query DNS root server. https://www.iana.org/domains/root/servers And use long TTL time with large cache size. Other than some small edge cases, this is pretty much the most secure and fastest DNS performance you will have, in most instances getting about 1 or I have been using unbound for at least 4 years. Simple and fast.

It is also very easy to do this with dnsmasq or powerdns, djbdns, etc.

I'm increasingly beginning to think that every node should be it's own dns so it's cache blacklist can be verified (checksums?) per node instead of per request to the dns provider.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#159

Post by pasbesoin »

lucb1e wrote: post #56

Which ISPs are so bad that you want to use external services, which are further in distance than your ISP, for speed? When I test with my ISP, they beat all of these services (both IPv4 and IPv6). They're simply closer to me in terms of hops. My router is another story though. The Fritzbox (>200eur router) adds 6ms of latency, and that's what is advertised over DHCP. (Might still be fine, since cached queries are fas…

In the U.S., many of them are mining and selling our data. Getting off of their DNS service is one step in mitigating this.

Also, as others mention, they can and do monkey with the results.

In other words, here, your ISP is in part a hostile entity. At least, in my perception -- and I'm not alone.

P.S. Of course, there's the argument against giving Google all your DNS usage, as well... I use a different DNS service from a company with a good reputation that says it's not collecting usage data. Even then, and with the state of our State, who knows...

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#160

Post by danpalmer »

mino wrote: post #86
coaxial wrote: post #60

Earlier quoted context omitted.

My isp got the brilliant idea of rolling their own YouTube cache servers. It's great in theory but in or active they're under powered and so at peak hours I can't even stream 240p on my 500mbits connection. I've had to block their cache servers in my firewall for YouTube to be butter smooth at 1080p consistently. Another example is bell Canada who used to mine your DNS queries to profile you for ads, or ISPs that hig…

It is common for ISP to host instances of the Google Global Cache (GGC, see https://peering.google.com/ ) which are used for many Google services, most importantly YouTube. In fact, in many cases Google itself "suggests" to ISP that they host a few GGC servers. They are directly monitored by Google, and the ISP has basically no say in how they are run. Capacity is managed by Google directly.

Yep, Virgin Media did this in the UK and messed it up badly. Every day at 6pm YouTube would stop working until the following morning.

It appeared to work by inspecting DNS packets and replying with overrides if necessary. I didn’t like it but I could understand that.

What I did not agree with was the fact that this also happened for other DNS services. Google DNS and OpenDNS both experienced the same issue, as did a few other “famous” DNS providers. Random little ones wouldn’t return the caching servers, and also enabling encrypted DNS for Google/OpenDNS would stop it happening too. I’m fairly sure it was some badly thought out deep packet inspection.

Post reply on HN