Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Choosing a Public DNS Resolver

evilbit.de

Post reply on HN
Print view View original

31–40 of 143 posts

Re: Choosing a Public DNS Resolver

#31

Post by exiguus »

Bender wrote: post #5

I use Unbound locally as a DoH server. The Alpine Linux Unbound package is compiled with libnghttp2, required for the built in DoH listener . That's more than enough to enable ECH [1]. I pre-cache all the domains I use hourly via cron. My ISP is not going to dork with my DNS requests and their employees are bigger deviants than I. If I ever started browsing the web from a phone I would just set up my own public DoH s…

I use my own public powerdns dnsdist and recurser/authoritave instances for DoH, DoT, DoQ, TCP and UDP now for ~3 years. Setup took some time, because i used bind, unbound and dnsmasq before. It's super stable and i can also use it on my mobile or legacy devices and as resolver in unbound, adguard/dnsproxy or just in my local resolve.conf.

Re: Choosing a Public DNS Resolver

#33

Post by nirav72 »

exiguus wrote: post #31
Bender wrote: post #5

I use Unbound locally as a DoH server. The Alpine Linux Unbound package is compiled with libnghttp2, required for the built in DoH listener . That's more than enough to enable ECH [1]. I pre-cache all the domains I use hourly via cron. My ISP is not going to dork with my DNS requests and their employees are bigger deviants than I. If I ever started browsing the web from a phone I would just set up my own public DoH s…

I use my own public powerdns dnsdist and recurser/authoritave instances for DoH, DoT, DoQ, TCP and UDP now for ~3 years. Setup took some time, because i used bind, unbound and dnsmasq before. It's super stable and i can also use it on my mobile or legacy devices and as resolver in unbound, adguard/dnsproxy or just in my local resolve.conf.

If its public , how do you prevent others from accessing it?

Re: Choosing a Public DNS Resolver

#34

Post by sevg »

Happy NextDNS user. Lots of configurability, including which filterlists to enable, configurable logging etc.

Plus it’s reliable and fast from basically anywhere (which is harder to achieve if I ran my own resolvers in the cloud, and anyway I don’t want to have to maintain that).

Re: Choosing a Public DNS Resolver

#35

Post by itake »

Does anyone have advice on how to use public wifi alongside DNS resolver?

Many public wifi network works need you to use their DNS, so they can redirect you to a gated "accept ToS" screen (and may even require re-approval every 30-60 minutes).

To resolve the issue is so frustrating:

1. realize the internet stopped working 2. ping google.com, wait for timeouts to show up. 3. try to guess if its a ISP issue, but then realize the wifi probably timed out. 4. Switch the dns. Flush DNS. 5. try to access a non-TLS domain 6. approve the gate 7. switch the DNS back

There has to be something that manages this

Re: Choosing a Public DNS Resolver

#36

Post by johnhtodd »

mzajc wrote: post #21
_def wrote: post #4

quad9 seems fine. Glad there are a bunch of alternatives though. We should never stop practicing decentralization in the net.

Be cautious with Quad9; their main address (9.9.9.9) has a "malware" blacklist that has misfired several times already: twice for a private torrent tracker, once for gist.github.com, issue was resolved within minutes to hours. They have a non-filtered address (9.9.9.10), but it doesn't do DNSSEC verification. IMO they're too unreliable to be worth the hassle.

Quad9 employs DNSSEC on all endpoints now. https://quad9.net/news/blog/quad9-enables-dnssec-on-all-serv...

Re: Choosing a Public DNS Resolver

#38

Post by flyingzucchini »

sevg wrote: post #34

Happy NextDNS user. Lots of configurability, including which filterlists to enable, configurable logging etc. Plus it’s reliable and fast from basically anywhere (which is harder to achieve if I ran my own resolvers in the cloud, and anyway I don’t want to have to maintain that).

Yeah it’s been pretty good for me too.

Re: Choosing a Public DNS Resolver

#39

Post by ValentineC »

Random, but I don't understand why anyone would choose a "block ads and trackers" DNS server as a default.

Even if it's configuring something for boomer family, that sounds like a recipe for "why is this website not working"?

Re: Choosing a Public DNS Resolver

#40

Post by colinsane »

kev009 wrote: post #27

I always just set up root recursors at my home and other locations. I've never noticed any downside.

the _one_ downside i've seen is on an airplane serviced by Starlink: UDP was extremely lossy to the point that whatever recursive resolver i was using at the time would mark half of all nameservers it saw as "unhealthy" and start returning NXDOMAINs to the clients before even trying to hit the authoritative NS.
Post reply on HN