Show HN: Which DNS servers are you pointing to? • Hacker News Board

Re: Show HN: Which DNS servers are you pointing to?

#61

Post by Arnavion » Sun, Oct 25, 2020, 9:49 PM UTC

imglorp wrote: post #46

znpy wrote: post #36

I run my own DNS servers at home. I have a small virtualization cluster and run a small DNS vm on each physical host. My resolvers perform queries against the root servers directly and cache results. It's refreshing to skip all the DNS fuckery that's going on nowadays.

Except for certain applications that want to do their own DNS, eg DOH...

Not the person you responded to, but I too run my own resolver on my router. I also have the router configured to drop [1] all outgoing packets to any DoH IPs; there are a bunch of lists for those, like https://github.com/Sekhan/TheGreatWall

[1]: Specifically, to reject them, which means sending a TCP reset / ICMP unreachable response back rather than blackholing them.

Re: Show HN: Which DNS servers are you pointing to?

#62

Post by Arnavion » Sun, Oct 25, 2020, 9:53 PM UTC

minerjoe wrote: post #50

jlgaddis wrote: post #45

Earlier quoted context omitted.

What, exactly, does "sending your IP all around the internet" even mean?

Meaning, if you don't want people to know you are searching for snm.donkeyporn.com than going out to the nameserver that donkeyporn is using is not exactly keeping the information private.

You are correct that if you run your own resolver, then all the DNS traffic from your resolver to other nameservers is in cleartext. DoH and DoT only get used by forwarders.

Re: Show HN: Which DNS servers are you pointing to?

#63

Post by Fileformat » Sun, Oct 25, 2020, 10:05 PM UTC

babuskov wrote: post #54

Unrelated, but I found a typo on this page: https://resolve.rs/http/myheaders.html It says: > These are the HTTP headers that are being sent my your browser. Great set of tools, BTW.

Thanks! Typo fixed too.

Re: Show HN: Which DNS servers are you pointing to?

#64

Post by formerly_proven » Sun, Oct 25, 2020, 10:16 PM UTC

fwr wrote: post #26

Neat, this helped me realize I haven't switched away from my provider's default DNS when I moved in, which is something I usually do. How to choose a DNS server? I usually just go with 8.8.8.8/8.8.4.4, I used to always test this with Namebench ( https://en.wikipedia.org/wiki/Namebench ) and these always turned out as the fastest - but it looks like it hasn't been updated since 2010 - are there any better tools for th…

Just run your own recursive resolver, it's very easy and reliable (e.g. knot-resolver).

Re: Show HN: Which DNS servers are you pointing to?

#65

Post by viraptor » Sun, Oct 25, 2020, 10:44 PM UTC

minerjoe wrote: post #60

viraptor wrote: post #57

Earlier quoted context omitted.

In practice with 1.1.1.1 you're trading the parties who know about your access from: Donkeyporn's DNS provider, com's DNS provider (0.1% chance it's not already cached), your ISP, transit providers, donkeyporn's ISP, donkeyporn service To: cloudflare, your ISP, transit providers, donkeyporn's ISP, donkeyporn service It's not a huge change and it's really about whether you trust CloudFlare more than the service donkey…

I though correctly switching to cloudflare should just be me -> cloudflare via an encrypted channel?

If you're talking about clouflare warp, then yes... kind of. If you mean only the DNS, them no, there are still many connections matching you to the destination.

Re: Show HN: Which DNS servers are you pointing to?

#66

Post by robertcope » Sun, Oct 25, 2020, 11:21 PM UTC

I really like NextDNS. But right now, I'm pointed to Cloudflare Gateway servers.

Re: Show HN: Which DNS servers are you pointing to?

#67

Post by Thorrez » Mon, Oct 26, 2020, 12:54 AM UTC

lucb1e wrote: post #15

If Mozilla silently enabled DOH-via-CloudFlare for you, it would show up here right? Because if yes, this would make it quite easy to find whether you have the right settings without having to find it somewhere in a configuration screen or trying to find out which users' throats Mozilla ended up deciding to force this down.

Thanks for this comment, I was quite confused why this site said Cloudflare when my OS is configured to use 8.8.8.8.

Re: Show HN: Which DNS servers are you pointing to?

#68

Post by rgroj » Mon, Oct 26, 2020, 1:00 AM UTC

Arnavion wrote: post #61

imglorp wrote: post #46

Earlier quoted context omitted.

Except for certain applications that want to do their own DNS, eg DOH...

Not the person you responded to, but I too run my own resolver on my router. I also have the router configured to drop [1] all outgoing packets to any DoH IPs; there are a bunch of lists for those, like https://github.com/Sekhan/TheGreatWall [1]: Specifically, to reject them, which means sending a TCP reset / ICMP unreachable response back rather than blackholing them.

Are you aware of "Adaptive DNS Resolver Discovery"[1] and do you have plans to block that too? (It's already in iOS 14 and slated for macOS 11.)

1: https://datatracker.ietf.org/doc/draft-pauly-add-resolver-di...

Re: Show HN: Which DNS servers are you pointing to?

#69

Post by dsr_ » Mon, Oct 26, 2020, 2:08 AM UTC

imglorp wrote: post #46

znpy wrote: post #36

I run my own DNS servers at home. I have a small virtualization cluster and run a small DNS vm on each physical host. My resolvers perform queries against the root servers directly and cache results. It's refreshing to skip all the DNS fuckery that's going on nowadays.

Except for certain applications that want to do their own DNS, eg DOH...

Which is why my nameservers answer NXDOMAIN to use-application-dns.net, which DoH-using applications are supposed to honor.

And I supply DNS-over-TLS and DNS-over-HTTPS locally. It's really not too difficult.

Re: Show HN: Which DNS servers are you pointing to?

#70

Post by _-___________-_ » Mon, Oct 26, 2020, 3:30 AM UTC

This shows which DNS server performed the recursive query for you, but in more complicated setups it won't be the DNS server your system is pointed to. For example if you're using 1.1.1.1, this will show some other CloudFlare IP.