Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Technitium DNS Server: Self host a DNS server for privacy and security

technitium.com

Post reply on HN
Print view View original

51–60 of 87 posts

Re: Technitium DNS Server: Self host a DNS server for privacy and security

#51

Post by hsbauauvhabzb »

outcoldman wrote: post #43

Hosting own DNS Server at home that blocks some domains freaks me out. I have never run it, so don't know. But comparing to just running AdGuard on my macOS, there are some times, that website would not open or behave without AdGuard being turned off. It is easy to do on my local macOS, but in case of using AdGuard as DNS Server on my home network - that will require more steps. Also, even if you run AdGuard as DNS o…

My pihole is filled with my TV requesting analytics domains, pihole also blocks some ads on my phone. Probably my biggest annoyance is that google product suggestions are blocked when I generally want them.

I would say it’s a trade off, but with a positive value.

Re: Technitium DNS Server: Self host a DNS server for privacy and security

#52

Post by gh02t »

kube-system wrote: post #50
gh02t wrote: post #47

Earlier quoted context omitted.

You can at least partially mitigate this by simply blocking the major DNS-over-https endpoints. There aren't that many. However, in my experience this really pisses off some devices e.g. Google/Nest Home speakers even if you have regular DNS working fine. You also of course won't catch the really nefarious devices phoning home over a custom non-public endpoint. It can be interesting just for logging purposes as well,…

I imagine that eventually we'll see content and DoH served from the same endpoint. Or ads proxied from the same location as the content.

Yep, playing whack-a-mole trying to block it is a losing battle long term, but for now it kinda works. Serving content from the same endpoints is indeed the whole point because it makes it hard to block without collateral damage.

Probably the only way to really block it is some kind of SSL unwrapping and deep packet inspection at the firewall but that's a HUGE hassle to deal with and is itself a potential privacy issue.

Re: Technitium DNS Server: Self host a DNS server for privacy and security

#53

Post by petee »

janwillemb wrote: post #33

I really do want to self host DNS, but I am afraid it will cause problems. Aren't DNS servers easily used in DoS attacks against other servers?

Most residential ISPs will be blocking inbound to DNS anyways; just keep it on a private address.

Re: Technitium DNS Server: Self host a DNS server for privacy and security

#55

Post by petee »

n_plus_1_acc wrote: post #8
Alifatisk wrote: post #2

Isn’t self-hosting a dns server kind off pointless if you are the only user? Like doesn’t that make you unique to tracking?

Are there any uostream DNS Servers that would allow you to just download the while database and then everything immediately after its TTL runs out? I can image it would be a lot of traffic.

The resolver Unbound has a handy feature 'prefetch' [1] which refreshes a cached record before it expires. I'm unfamiliar with Technitium though

Edit: another option allows for serving expired TTLs, which is permitted by rfc. There is a great explanation on their site [2]

[1] https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound...

[2] https://unbound.docs.nlnetlabs.nl/en/latest/topics/core/serv...

Re: Technitium DNS Server: Self host a DNS server for privacy and security

#56

Post by AdamJacobMuller »

Hate to ask this, but, I've become jaded.

Who is behind this software and what's their motivation for it?

PiHole is very simple in that regard, it was created by some dude to fill a niche and has grown into a reasonably robust community which should be reasonably resilient to outside attacks (someone sneaking in a change which adds a "feature" which exfiltrates and sells my data).

AdGuard also is a very known company with an obvious motive, to sell you their software, but they've been around a long time and are widely used and seem relatively harmless.

I'm sure I'm a cynic at this point, but, I feel like I need to know who these guys are and why they are willing to invest in this.

Re: Technitium DNS Server: Self host a DNS server for privacy and security

#57

Post by UI_at_80x24 »

tw04 wrote: post #44
shreyasonline wrote: post #38

Earlier quoted context omitted.

Its actually much more beneficial to use a local DNS server even for a single user. A single user will keep querying for DNS requests since OS/apps cache DNS only for a minute or so. Local DNS will keep cache for the full TTL of the record and thus reduce the number of DNS requests that go out of your network. Plus there is Serve Stale feature which improves resiliency. For privacy, depending on your scenario, you ca…

You should consider disclosing your affiliation to the project in your posts on this thread.

With their specific post, no I don't think so. They are advocating "general good ideas" vs subtly promoting the product.

I run my own DNS, I would have said all the same things they did.

Re: Technitium DNS Server: Self host a DNS server for privacy and security

#58

Post by ameshkov »

riddley wrote: post #45
systemz wrote: post #10

How it compares to let's say AdGuard Home? Seems similar https://github.com/AdguardTeam/AdGuardHome

I started on PiHole and moved to AdGuardHome and eventually landed on Technitium. I have a large home network and it does auto reverses and multiple record types that the others didn't. I really like Technitium.

Could you please explain what auto-reverse and multiple record types mean? The reason for asking is to learn what's missing from AG Home/DNS and maybe adding it in the future.

Re: Technitium DNS Server: Self host a DNS server for privacy and security

#59

Post by neuromanser »

poisonborz wrote: post #12
cookiengineer wrote: post #7

Earlier quoted context omitted.

I get your point, but this is already solved in a much easier manner with an OprnWRT router (and GUI etc) and kind of a strawman's argument using DNS for that. OpenWRT comes out of the box even with social website toggles that require no configuration. Granted, you still have to install OpenWRT, but I still think that running a root DNS isn't necessary for home setups.

Where the DNS server lives is a detail. What is a "root DNS"?

A Root domain, or a name server authoritative for such. I don't think OP meant either.

Re: Technitium DNS Server: Self host a DNS server for privacy and security

#60

Post by Mister_Snuggles »

gh02t wrote: post #47
somat wrote: post #29

Earlier quoted context omitted.

Until the apps figure out dns over http. sigh

You can at least partially mitigate this by simply blocking the major DNS-over-https endpoints. There aren't that many. However, in my experience this really pisses off some devices e.g. Google/Nest Home speakers even if you have regular DNS working fine. You also of course won't catch the really nefarious devices phoning home over a custom non-public endpoint. It can be interesting just for logging purposes as well,…

This really feels like a game of whack-a-mole.

Personally, I think DoH was a mistake. Instead of the network admin configuring the name resolution services (via DHCP, for example) each app has a hard-coded list of IP addresses that it will use to resolve hostnames. Instead of a system resolver that does the job we now have a resolver, complete with hard-coded server configuration, baked into various applications/devices.

Post reply on HN