Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

medium.com

Post reply on HN
Print view View original

211–220 of 364 posts

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#211

Post by sml156 »

josteink wrote: post #105
rmrfrmrf wrote: post #66

Earlier quoted context omitted.

NXDOMAIN hijacking is enough for me to switch, and most ISPs are doing it nowadays.

That’s quite a bold claim. Got any data to back it up? Source: I've yet to see this on any ISP I've used anywhere , sans free airport wifis. Travelled pretty much every continent on earth.

I live near Toronto Canada and Rogers my ISP hijack's DNS requests for non existent domains. The data to back up my bold statement is a simple Google search which reveals that they have been doing this at the very least from my Google search was from 2008.

It is possible to turn off this feature, But it is set by a cookie and once that cookie is deleted you have to do it all over again.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#212

Post by Assossa »

cleanbrowsing wrote: post #176

Pushed a shell script to compare all of them from your location: https://github.com/cleanbrowsing/dnsperftest $ sh ./dnstest.sh |sort -k 22 -n test1 test2 test3 test4 test5 test6 test7 test8 test9 test10 Average cloudflare 1 ms 1 ms 1 ms 4 ms 1 ms 1 ms 1 ms 1 ms 1 ms 1 ms 1.30 norton 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2.00 neustar 2 ms 2 ms 2 ms 2 ms 1 ms 2 ms 2 ms 2 ms 2 ms 22 ms 3.90 cleanbrowsing 11…

Thanks, this is a very useful script. I added my pi-hole (using neustar as upstream) to the script and found it adds about 2ms to the initial queries. After I ran the script a second time, the pi-hole average was half of neustar, so pi-hole must do some amount of caching.

                 test1   test2   test3   test4   test5   test6   test7   test8   test9   test10  Average
  pihole(cached) 14 ms   20 ms   1 ms    4 ms    15 ms   16 ms   1 ms    15 ms   1 ms    2 ms      8.90
  neustar        12 ms   16 ms   15 ms   11 ms   15 ms   11 ms   13 ms   15 ms   12 ms   13 ms     13.30
  norton         11 ms   16 ms   11 ms   13 ms   14 ms   15 ms   15 ms   10 ms   13 ms   16 ms     13.40
  pihole         17 ms   14 ms   14 ms   20 ms   18 ms   15 ms   19 ms   15 ms   1 ms    18 ms     15.10
  cleanbrowsing  14 ms   17 ms   14 ms   16 ms   16 ms   13 ms   16 ms   26 ms   13 ms   14 ms     15.90
  opendns        11 ms   11 ms   12 ms   23 ms   12 ms   11 ms   11 ms   28 ms   27 ms   15 ms     16.10
  google         12 ms   15 ms   11 ms   27 ms   12 ms   26 ms   15 ms   30 ms   12 ms   28 ms     18.80
  cloudflare     43 ms   40 ms   42 ms   42 ms   44 ms   41 ms   41 ms   42 ms   43 ms   43 ms     42.10
  comodo         45 ms   46 ms   43 ms   43 ms   47 ms   44 ms   47 ms   45 ms   43 ms   45 ms     44.80
  quad9          82 ms   91 ms   79 ms   117 ms  160 ms  111 ms  82 ms   82 ms   80 ms   91 ms     97.50
  adguard        153 ms  161 ms  161 ms  155 ms  164 ms  154 ms  154 ms  156 ms  177 ms  158 ms    159.30
  yandex         159 ms  158 ms  163 ms  160 ms  170 ms  268 ms  159 ms  159 ms  160 ms  192 ms    174.80

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#213

Post by jeremy7600 »

monochromatic wrote: post #122

Does anyone actually believe that google isn’t hoovering up personal data with its DNS service?

All this tasty data:

Request domain name, e.g. www.google.com

Request type, e.g. A (which stands for IPv4 record), AAAA (IPv6 record), NS, MX, TXT, etc.

Transport protocol on which the request arrived, i.e. TCP, UDP, or HTTPS

Client's AS (autonomous system or ISP), e.g. AS15169 User's geolocation information: i.e. geocode, region ID, city ID, and metro code

Response code sent, e.g. SUCCESS, SERVFAIL, NXDOMAIN, etc.

Whether the request hit our frontend cache

Whether the request hit a cache elsewhere in the system (but not in the frontend)

Absolute arrival time in seconds

Total time taken to process the request end-to-end, in seconds

Name of the Google machine that processed this request, e.g. machine101

Google target IP to which this request was addressed, e.g. one of our anycast IP addresses (no relation to the user's IP)

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#214

Post by justicezyx »

Anecdotally, I know a guy who runs a local Cloud provider in the greater-Beijing area (part of Hebei proveince). He told me Cloudflare has struck a deal with the government to have integration with them, presumably with higher standard than normal tech providers.

That might explain why CloudFlare has good performance across the globe, which in a large part related to China.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#215

Post by bwoodcock »

lucb1e wrote: post #56

Which ISPs are so bad that you want to use external services, which are further in distance than your ISP, for speed? When I test with my ISP, they beat all of these services (both IPv4 and IPv6). They're simply closer to me in terms of hops. My router is another story though. The Fritzbox (>200eur router) adds 6ms of latency, and that's what is advertised over DHCP. (Might still be fine, since cached queries are fas…

One of the issues is that many ISPs don't actually run their own recursive DNS servers... They outsource to companies which provide a "monetized solution," operating the recursive resolvers and paying the ISP in exchange for the customers' data, which they sell. This will become an illicit activity shortly in Europe, as the GDPR comes into effect, but there are many ISPs that have become very used to receiving those payments. And most of them already don't admit to selling their customers' privacy.

So privacy is why many of the people who use a different recursive nameserver are doing so... In order for that to work, you need to use one of the ones which support link-level encryption, like Quad9 (DNS-over-TLS) or OpenDNS (DNScrypt). Other reasons are performance (which at least in Quad9's case should be no worse than your ISP for real-world queries, since it's back-to-back with many of the authoritative servers already, and all of them will give you a large pool of other users sharing the same cache, which helps performance immensely), and security... Going back-to-back with the authoritative servers also collapses the attack surface between them, minimizing the possibility for MITM attacks between the recursive and authoritative servers.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#216

Post by oasisbob »

scrumper wrote: post #145

Safari barfs on visiting https://1.1.1.1 as linked in the article. Certificate invalid (though it looks fine). Rather unfortunate regarding perception; it's an interesting service!

Works fine in Safari here. Wondering if your request is being intercepted by one of the many network devices out there which hijacks 1.1.1.1 for its own use.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#217

Post by oasisbob »

ryanlol wrote: post #169

Why is google DNS listed as "private"? They permanently log all of your DNS queries. https://developers.google.com/speed/public-dns/privacy

That page specifically says that they don't:

> Google Public DNS stores two sets of logs: temporary and permanent. The temporary logs store the full IP address of the machine you're using. [...] We delete these temporary logs within 24 to 48 hours.

> In the permanent logs, we don't keep personally identifiable information or IP information. We do keep some location information (at the city/metro level) so that we can conduct debugging, analyze abuse phenomena. After keeping this data for two weeks, we randomly sample a small subset for permanent storage.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#218

Post by monochromatic »

jeremy7600 wrote: post #213
monochromatic wrote: post #122

Does anyone actually believe that google isn’t hoovering up personal data with its DNS service?

All this tasty data: Request domain name, e.g. www.google.com Request type, e.g. A (which stands for IPv4 record), AAAA (IPv6 record), NS, MX, TXT, etc. Transport protocol on which the request arrived, i.e. TCP, UDP, or HTTPS Client's AS (autonomous system or ISP), e.g. AS15169 User's geolocation information: i.e. geocode, region ID, city ID, and metro code Response code sent, e.g. SUCCESS, SERVFAIL, NXDOMAIN, etc. W…

And my IP address, linking my browsing to my google account and my identity.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#219

Post by mjevans »

keeperofdakeys wrote: post #78
anilgulecha wrote: post #2

I think we'll start seeing the standard configuration of 1.1.1.1,8.8.8.8 everywhere. Google/Cloudflare tackled the UX of free DNS spectacularly with these gold IP addresses. It's the primary reason I use them instead of OpenDNS, which was an earlier player in this space.

Be careful with that, Google DNS (as an example) will start ignoring your DNS requests if you go over the rate-limit. Not an issue for home users, but an issue for any sizeable business.

Doesn't this just mean that you should be running your own caching resolver so that requests for common things don't constantly hit the upstream server? For those same common sites it should also be better performance anyway.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#220

Post by culot »

cleanbrowsing wrote: post #176

Pushed a shell script to compare all of them from your location: https://github.com/cleanbrowsing/dnsperftest $ sh ./dnstest.sh |sort -k 22 -n test1 test2 test3 test4 test5 test6 test7 test8 test9 test10 Average cloudflare 1 ms 1 ms 1 ms 4 ms 1 ms 1 ms 1 ms 1 ms 1 ms 1 ms 1.30 norton 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2.00 neustar 2 ms 2 ms 2 ms 2 ms 1 ms 2 ms 2 ms 2 ms 2 ms 22 ms 3.90 cleanbrowsing 11…

I added Charter (71.10.216.1) to the list, and in Mid-michigan via Charter, they consistently come out ahead by a clear margin for me:

  charter        15 ms   15 ms   15 ms   16 ms   15 ms   15 ms   15 ms   15 ms   15 ms   30 ms     16.60
  norton         22 ms   23 ms   30 ms   28 ms   23 ms   23 ms   22 ms   21 ms   22 ms   31 ms     24.50
  neustar        24 ms   26 ms   23 ms   25 ms   25 ms   23 ms   28 ms   23 ms   23 ms   39 ms     25.90
  cloudflare     25 ms   27 ms   33 ms   62 ms   26 ms   26 ms   27 ms   27 ms   27 ms   26 ms     30.60
  comodo         37 ms   37 ms   36 ms   38 ms   38 ms   36 ms   38 ms   38 ms   38 ms   37 ms     37.30
  quad9          33 ms   33 ms   45 ms   46 ms   51 ms   40 ms   33 ms   34 ms   35 ms   34 ms     38.40
  opendns        44 ms   40 ms   41 ms   59 ms   30 ms   32 ms   30 ms   38 ms   40 ms   33 ms     38.70
  google         36 ms   40 ms   22 ms   31 ms   18 ms   138 ms  21 ms   32 ms   30 ms   30 ms     39.80
  cleanbrowsing  62 ms   77 ms   65 ms   64 ms   67 ms   74 ms   63 ms   63 ms   63 ms   63 ms     66.10
  adguard        128 ms  131 ms  125 ms  124 ms  124 ms  134 ms  127 ms  134 ms  124 ms  132 ms    128.30
  yandex         160 ms  154 ms  160 ms  154 ms  165 ms  163 ms  153 ms  152 ms  159 ms  157 ms    157.70
Norton, Neustar, and Cloudflare consistently vie for the top spots next to Charter on all of the runs I've done. Occasionally Google mixes it up for the #2 spot as well, but Neustar, Norton, and Cloudflare just edge them out most of the time.
Post reply on HN