Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Which DNS servers are you pointing to?

which.nameserve.rs

Post reply on HN
Print view View original

81–90 of 97 posts

Re: Show HN: Which DNS servers are you pointing to?

#81

Post by Arnavion »

rgroj wrote: post #68
Arnavion wrote: post #61

Earlier quoted context omitted.

Not the person you responded to, but I too run my own resolver on my router. I also have the router configured to drop [1] all outgoing packets to any DoH IPs; there are a bunch of lists for those, like https://github.com/Sekhan/TheGreatWall [1]: Specifically, to reject them, which means sending a TCP reset / ICMP unreachable response back rather than blackholing them.

Are you aware of "Adaptive DNS Resolver Discovery"[1] and do you have plans to block that too? (It's already in iOS 14 and slated for macOS 11.) 1: https://datatracker.ietf.org/doc/draft-pauly-add-resolver-di...

So if I understand this correctly, this provides a way for example.com to suggest a DoH server that the client can use to resolve example.com's subdomains? I can see it being problematic because it'll bypass my resolver's ad-blocking.

I don't use any Apple software or hardware, but if Firefox starts using it I'll start worrying about it.

Re: Show HN: Which DNS servers are you pointing to?

#82

Post by rgroj »

Arnavion wrote: post #81
rgroj wrote: post #68

Earlier quoted context omitted.

Are you aware of "Adaptive DNS Resolver Discovery"[1] and do you have plans to block that too? (It's already in iOS 14 and slated for macOS 11.) 1: https://datatracker.ietf.org/doc/draft-pauly-add-resolver-di...

So if I understand this correctly, this provides a way for example.com to suggest a DoH server that the client can use to resolve example.com's subdomains? I can see it being problematic because it'll bypass my resolver's ad-blocking. I don't use any Apple software or hardware, but if Firefox starts using it I'll start worrying about it.

Yes, that's right. I don't know whether this is on the agenda for Firefox or not.

Re: Show HN: Which DNS servers are you pointing to?

#83

Post by JdeBP »

ycombonator wrote: post #75
znpy wrote: post #36

I run my own DNS servers at home. I have a small virtualization cluster and run a small DNS vm on each physical host. My resolvers perform queries against the root servers directly and cache results. It's refreshing to skip all the DNS fuckery that's going on nowadays.

I tried doing the same, how do you precache and reduce query lookup times for a new website ? Could you explain your setup if you don’t mind ?

DNS lookup times are strongly affected by things entirely within the control of DNS content publishers and nothing to do with what one uses locally, namely whether "glue" is in-bailiwick. Out-of-bailiwick glue causes a massive explosion of additional back-end queries.

This has been a known problem for decades, people having encouraged in-bailiwick "glue" since at least the turn of the century. If you want to decrease lookup times, add your voice to encouraging this. Experts in the field are nowadays generally persuaded that it is a good thing, which took a saddening amount of persuasion. But everyday administrators still too-often do not get encouraged to use in-bailiwick delegations.

* https://cr.yp.to/djbdns/notes.html

Re: Show HN: Which DNS servers are you pointing to?

#84

Post by ryankrage77 »

javajosh wrote: post #53
surround wrote: post #47

Earlier quoted context omitted.

I recommend running your own DNS resolver, so that you don’t have to trust any 3rd party server with your DNS traffic. I run Unbound (a DNS resolver) alongside Pi-hole on a dedicated raspberry pi for my home network.

This is a good solution. Another much lighter-weight solution is to simply add a static name/ip association in your local /etc/hosts file. It's a bit brittle, but honestly for a lot of websites its a lot less brittle than you think (and it's even more efficient than a Pi-hole). The biggest drawback is that you'll have another thing to trouble-shoot if something goes wrong. But that's true for any privacy-preserving D…

pi-hole now allows custom DNS entries, which will then work for all devices on your network and not just the one you edited /etc/hosts on (useful for, e.g, phones & smart devices where DNS configuration can be very limited).

Re: Show HN: Which DNS servers are you pointing to?

#86

Post by Fileformat »

_-___________-_ wrote: post #70

This shows which DNS server performed the recursive query for you, but in more complicated setups it won't be the DNS server your system is pointed to. For example if you're using 1.1.1.1, this will show some other CloudFlare IP.

That's correct, but it is still useful (IMHO). The ASN value should be the same (or at least related). If it isn't, there is something going on that you should probably investigate.

Re: Show HN: Which DNS servers are you pointing to?

#87

Post by Fileformat »

ycombonator wrote: post #76

Also is there a crawler / network tool to find a recursive resolver close to your geographical location

In this thread, @jelv suggested GRC's Benchmark [1]. There is also namebench [2], an older python tool. I personaly haven't used either one (yet). Definitely an opportunity for a new, portable tool!

[1] https://www.grc.com/dns/benchmark.htm

[2] https://github.com/catap/namebench

Re: Show HN: Which DNS servers are you pointing to?

#88

Post by bwoodcock »

ilikepi wrote: post #52
daneel_w wrote: post #44

Earlier quoted context omitted.

This was a surprise to me as well. For anyone else reading this it means that Quad9, not your system , is relaying DNS traffic to WoodyNet.

PCH provides the infrastructure for Quad9...so I don't think it makes sense to say that Quad9 is "relaying" DNS traffic to PCH/WoodyNet. There isn't some organizational boundary that's being crossed.

Hi. I'm Bill Woodcock, the eponymous "woody" of "woodynet." And executive director of PCH, and chairman of Quad9's board. They are three separate corporations, which exist for different reasons, and under different tax regulations (PCH and Quad9 are public-benefit not-for-profits, whereas WoodyNet exists to pay taxes on taxable transactions and keep the non-profits' books clean), but they're very closely related.

In this case, you're seeing WoodyNet IPs and IN-ADDRs because WoodyNet is giving transit to the Quad9 anycast instance you're talking to.

I'm happy to answer any questions you may have about how all this works.

I'd also note that round-robining between two different organizations with radically different privacy practices and security services... um... might not make the most sense? Depending what your goal is, of course. Again, happy to talk about any of this, just let me know if I (or any of the Quad9 or PCH folks) can be of help.

         -Bill

Re: Show HN: Which DNS servers are you pointing to?

#89

Post by anderspitman »

kamyarg wrote: post #71
Cantbekhan wrote: post #18

Nextdns.io and cloudflare externally. Pi-hole pointing to those internally. Preferably encrypted. Preferably with Firefox due to esni support.

Did not know about nextdns, thank you. One question popped into my head is how do you trust nextdns? or are you doing something so that you do not need to trust it?

I just use it to block ads.
Post reply on HN