Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Choosing a Public DNS Resolver

evilbit.de

Post reply on HN
Print view View original

51–60 of 143 posts

Re: Choosing a Public DNS Resolver

#51

Post by abcdefg12 »

Bender wrote: post #16
abcdefg12 wrote: post #15

Earlier quoted context omitted.

Or you could use dnscrypt so ISP doesn’t see your lookups at all

When all the authoritative servers support TLS I can enable TLS outbound but very few of them do at the moment. At some point someone is decrypting, turtles all the way down. I could of course just do DoT to another instance of Unbound somewhere else but I do not need to do that as my ISP does not care about my queries. I used to keep standby DoT Unbound servers around but I have never once seen a US ISP tinker with…

There is a bunch of public dnscrypt servers to which your client can randomly fan out encrypted queries.

Re: Choosing a Public DNS Resolver

#53

Post by abcdefg12 »

exiguus wrote: post #30

Most important and super privacy/security related topic: DNS. Instead of choosing a public one. Host your own infrastructure. You don't need public instances. Just run ADGUARD or unbound/dnsmasq/dnsdist in recursive mode on your router or machine. And you can set limits and block-lists to your needs.

And your isp can record all your queries

Re: Choosing a Public DNS Resolver

#54

Post by kev009 »

themacguffinman wrote: post #41
kev009 wrote: post #27

I always just set up root recursors at my home and other locations. I've never noticed any downside.

The downside is obviously that uncached queries take much longer (adding >100ms) and more queries are uncached since you can't share the cache with a large user-base. Unless you just visit the same websites over and over again, this results in worse overall performance.

I've never felt this. Most large services run or delegate to anycast DNS services.

If you have knowledge of TCP, you know you will occasionally get stalls much greater than that beyond control.

Re: Choosing a Public DNS Resolver

#55

Post by zinekeller »

progval wrote: post #42
vzaliva wrote: post #24

unfortunately many DNS resolvers are integrated with CDNs. I do want privacy of an independent non-tracking DNS but I also want my video streaming work fast. :(

What does it mean for a DNS resolver to be "integrated with CDNs"? And why does that affect streaming speed negatively?

Some CDNs (like Cloudflare) use solely BGP anycast steering for routing to the "nearest" server. Other CDNs (like Akamai, Fastly, Netflix, and YouTube) use a hybrid BGP-DNS steering because some ISPs have extremely questionable routing practices.

Unfortunately, if the CDN only rely on BGP steering (or conversely if you are a user who is stuck on an ISP monopoly), there are cases where this is not necessarily the nearest network-wise (or performant network-wise) if there are peering disputes. If the said ISP is a virtual monopoly or (worse) state-sanctioned to collect network "toll fees" (like in South Korea), non-preferred and international routes are (intentionally) congested.*

If you use a third-party DNS, you basically lose this DNS optimization, and ECS does not fully solve this (because sometimes the DNS override are placed only on the ISP's recursive DNS servers). You're basically in a lose-lose position: either use third-party servers and the IP addresses served to you on popular CDNs are in the congested path, or use the often-unreliable and heavily-logged ISP-provided DNS.

* Usually. There are exceptions, but this comment is just a simplification of the complexities of real-life networking (where RFCs and mutual cooperation die out without fanfare).

Edit for further reading: DNS is the new BGP by Geoff Huston of APNIC (https://ispcol.potaroo.net/2023-09/service-routing.html), How LinkedIn used PoPs and RUM to make dynamic content download 25% faster from the old LinkedIn engineering team (Archived at https://web.archive.org/web/20160310065302/https://engineeri...), Wikimedia's mapping of their CDNs (https://gerrit.wikimedia.org/r/plugins/gitiles/operations/dn...)

Re: Choosing a Public DNS Resolver

#56

Post by kev009 »

abcdefg12 wrote: post #52
kev009 wrote: post #27

I always just set up root recursors at my home and other locations. I've never noticed any downside.

Downside is privacy

Versus letting a singular entity snoop everything? If you actually open a connection to the result what is the difference? The only way to fully deal with all that is an overlay or mixnets.

Re: Choosing a Public DNS Resolver

#58

Post by Scroll_Swe »

ValentineC wrote: post #39

Random, but I don't understand why anyone would choose a "block ads and trackers" DNS server as a default. Even if it's configuring something for boomer family, that sounds like a recipe for "why is this website not working"?

Because to me even as an IT person it sounds like a good idea on the surface. To have no connections to/form ads, malware, c2.

But yes, then you happen upon your first false positive.

And you switch back to a non filtered DNS OR one that you can whitelist or control, still annoying.

Re: Choosing a Public DNS Resolver

#59

Post by javier2 »

JdeBP wrote: post #17

Every time that this comes up, be it a general list like this or someone announcing a new service, my reaction, and that that I see of surprisingly many other people on Hacker News, is fairly unmoved. I've run my own proxy DNS service for about a quarter of a century at this point, using three different sets of softwares on six different operating systems, and every single point on the filter tab is something that I…

I set up my own resolver about 2 years ago, and it has just worked. Never once had an issue.

Re: Choosing a Public DNS Resolver

#60

Post by ethanhawksley »

Scroll_Swe wrote: post #48
mzajc wrote: post #21

Earlier quoted context omitted.

Be cautious with Quad9; their main address (9.9.9.9) has a "malware" blacklist that has misfired several times already: twice for a private torrent tracker, once for gist.github.com, issue was resolved within minutes to hours. They have a non-filtered address (9.9.9.10), but it doesn't do DNSSEC verification. IMO they're too unreliable to be worth the hassle.

Was about to comment this. I actually don't like advert or malware blocking on my public DNS resolvers. It sounds cool but annoying when it misfires. Once Quad9 blocked Halo MCC XBOX Live -> Steam achievements, several fileshare services (probably used for malware somewhere but not my usage) etc... 1.1.1.1 blocked archive.is or got blocked by them or something... Gone back to Google DNS (gasp) for now, yes as a Europ…

I believe cloudflare only blocked archive.is on their "Families" filtered dns. I've been using their normal 1.1.1.1 and haven't encountered any blocks.
Post reply on HN