Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Choosing a Public DNS Resolver

evilbit.de

Post reply on HN
Print view View original

61–70 of 143 posts

Re: Choosing a Public DNS Resolver

#61

Post by brynx97 »

zinekeller wrote: post #55
progval wrote: post #42

Earlier quoted context omitted.

What does it mean for a DNS resolver to be "integrated with CDNs"? And why does that affect streaming speed negatively?

Some CDNs (like Cloudflare) use solely BGP anycast steering for routing to the "nearest" server. Other CDNs (like Akamai, Fastly, Netflix, and YouTube) use a hybrid BGP-DNS steering because some ISPs have extremely questionable routing practices . Unfortunately, if the CDN only rely on BGP steering (or conversely if you are a user who is stuck on an ISP monopoly), there are cases where this is not necessarily the nea…

I would be curious if you could provide any examples for the issues you cite. They sound plausible to me, especially around peering disputes or in various Asia countries, but I wonder how in practice this looks in like a traceroute for the amount of added latency etc.

I would suspect some of non-optimized scenarios are eyeball network operator decisions on their networks that DNS providers and others do not have much control over. Like, Cloudflare resolves an IP that is closest to them, which is likely also the closest to the end user (and the eyeball ISP), but the eyeball ISP BGP path to that resolved IP takes a roundabout path because of their own BGP policy because $reasons.

Re: Choosing a Public DNS Resolver

#62

Post by zinekeller »

brynx97 wrote: post #61
zinekeller wrote: post #55

Earlier quoted context omitted.

Some CDNs (like Cloudflare) use solely BGP anycast steering for routing to the "nearest" server. Other CDNs (like Akamai, Fastly, Netflix, and YouTube) use a hybrid BGP-DNS steering because some ISPs have extremely questionable routing practices . Unfortunately, if the CDN only rely on BGP steering (or conversely if you are a user who is stuck on an ISP monopoly), there are cases where this is not necessarily the nea…

I would be curious if you could provide any examples for the issues you cite. They sound plausible to me, especially around peering disputes or in various Asia countries, but I wonder how in practice this looks in like a traceroute for the amount of added latency etc. I would suspect some of non-optimized scenarios are eyeball network operator decisions on their networks that DNS providers and others do not have much…

There should be examples under the links I have added to the original comment. Unfortunately, I cannot give examples that I personally encountered (first, NDA, sorry, second, the ISPs would probably be very incensed to me), but browsing BGP collector sites would probably illuminate you, like this one (https://bgp.tools/prefix/41.189.185.0/24#whois, https://bgp.tools/prefix/41.189.185.0/24#dns) for caching Facebook and other Meta stuff, and this one (https://bgp.tools/prefix/2001:918:ffad::/48#whois) is for Akamai.

Re: Choosing a Public DNS Resolver

#63

Post by exiguus »

nirav72 wrote: post #33
exiguus wrote: post #31

Earlier quoted context omitted.

I use my own public powerdns dnsdist and recurser/authoritave instances for DoH, DoT, DoQ, TCP and UDP now for ~3 years. Setup took some time, because i used bind, unbound and dnsmasq before. It's super stable and i can also use it on my mobile or legacy devices and as resolver in unbound, adguard/dnsproxy or just in my local resolve.conf.

If its public , how do you prevent others from accessing it?

To be honest, there’s no way to prevent others from using my DNS server without putting it behind a VPN or in any other non-public network. Also you can do port-knocking or something, but that's not rely authentication. However, I'm not aware of any authentication mechanisms in DNS. That would also cause performance to plummet. If you use a VPN or something, in turn, would mean you'd have to rely on someone else's DNS infrastructure. So I don't have any of this and its public.

The good thing about dnsdist is that it acts as a sort of load balancer for DNS queries and offers features such as dynamic blocking (including via eBpf) at the IP level and rules and rate limits for query types you can combine. Therefore, there are no limits (or very open limits) for all query types from whitelisted IPs, and stricter rules for all others. IPset and GeoIP banning of known malicious IPs and regions (using block-lists) also keeps the footprint of "unwanted" use very, very small.

Re: Choosing a Public DNS Resolver

#65

Post by jaychandra68 »

ethanhawksley wrote: post #60
Scroll_Swe wrote: post #48

Earlier quoted context omitted.

Was about to comment this. I actually don't like advert or malware blocking on my public DNS resolvers. It sounds cool but annoying when it misfires. Once Quad9 blocked Halo MCC XBOX Live -> Steam achievements, several fileshare services (probably used for malware somewhere but not my usage) etc... 1.1.1.1 blocked archive.is or got blocked by them or something... Gone back to Google DNS (gasp) for now, yes as a Europ…

I believe cloudflare only blocked archive.is on their "Families" filtered dns. I've been using their normal 1.1.1.1 and haven't encountered any blocks.

Yesterday 1.1.1.1 failed to resolved "theinformation.com" (hosted on CF itself!) for many hours, answering NXDOMAIN.

Re: Choosing a Public DNS Resolver

#66

Post by exiguus »

abcdefg12 wrote: post #53
exiguus wrote: post #30

Most important and super privacy/security related topic: DNS. Instead of choosing a public one. Host your own infrastructure. You don't need public instances. Just run ADGUARD or unbound/dnsmasq/dnsdist in recursive mode on your router or machine. And you can set limits and block-lists to your needs.

And your isp can record all your queries

Do you mean when communicating directly with a root DNS server over unencrypted UDP or TCP? You're right. There's currently no universal way to encrypt direct queries to root DNS servers. To work around this, the best approach is to host your own public DNS server outside your untrusted ISPs network and connect to it securely using DoH, DoQ, or DoT. Alternatively, you can rely on a trusted third-party public DNS provider that supports encrypted connections. In the end, there's no perfect solution. You have to choose who to trust. Personally, I trust my ISP more than external DNS providers. For anonymity you could route your DNS root queries throe tor or a VPN for the cost of performance.

I also used third-party public resolvers before. Mainly FFM (its not on the list) but non-profit, EU and encrypted. If you boil down the list (from the website) to this categories, you have 4 providers. You can trust, in my opinion. But the problem with all this provider is, that you ran quick into rate limits or some query type restrictions. Especially if you run your own mail server or other DNS expensive task.

Fun fact about hosting your own DNS infrastructure and offering it to friends and family: They might actually trust other providers more than they trust you. Even if they know and trust you personally. Because they know you can theoretically read their queries, it’s more convenient for them to have a stranger do it instead.

Re: Choosing a Public DNS Resolver

#67

Post by chopin »

degenerate wrote: post #6

9.9.9.9 with 1.1.1.1 as secondary

I use 9.9.9.9 but it failed me a couple of times in the past two months. Cloudflare is very robust but I just don't like them. Falling back on them silently is not what I want. I am rather using them directly when quad9 fails.

Re: Choosing a Public DNS Resolver

#68

Post by vachina »

ValentineC wrote: post #39

Random, but I don't understand why anyone would choose a "block ads and trackers" DNS server as a default. Even if it's configuring something for boomer family, that sounds like a recipe for "why is this website not working"?

Because it is very useful on mobile. App typically use an advertising SDK for their monetisation, which means we can BLOCK THEM ALLLLLLL

Re: Choosing a Public DNS Resolver

#69

Post by JdeBP »

duskwuff wrote: post #26
JdeBP wrote: post #17

Every time that this comes up, be it a general list like this or someone announcing a new service, my reaction, and that that I see of surprisingly many other people on Hacker News, is fairly unmoved. I've run my own proxy DNS service for about a quarter of a century at this point, using three different sets of softwares on six different operating systems, and every single point on the filter tab is something that I…

> 'Run by one individual in Denmark.' is an interesting statement of bus factor I find it more interesting as a statement about organizational oversight. If there are multiple people involved in operations, they can keep an eye on each other and speak up if they see anything weird going on (e.g. a DNS resolver implementing selective logging or interfering with results). If there's only one person running the show, th…

It isn't really primarily about organization oversight, though. The weird goings on are in practice usually at the behest of the people paying the salaries of all of the people involved (which includes law enforcement, which goes through corporate channels). There's no real independent oversight for that common case. Everyone is on the payroll. (-:

As a concrete thought experiment, consider if (say) a WWW/DNS hosting company providing such free proxy DNS service decided to covertly record the domain name lookups from the general public that fail in order to compile a list of domain names for the company to prospectively squat on. Having multiple employees handling the public service doesn't stop this if it is the company's actual business decision to sneakily do this.

It really is a statement of bus factor, not about oversight. To make a statement about oversight one has to take into account something else not covered by this list: which of the list entries has attempted to show some level of independent auditing or oversight of its data protection.

* https://blog.cloudflare.com/announcing-the-results-of-the-1-...

CloudFlare has had some independent auditing done, by an accountancy firm. DNS4EU holds itself subject to GDPR rules on Personal Data with respect to query data, and so is auditable by the Czech ÚOOÚ. AdGuard likewise, except that it holds Personal Data in Frankfurt. CZ.NIC likewise, except that it hasn't actually updated its legal doco since 2018 and it's only by implication that the Czech ÚOOÚ can audit the Personal Data handling under the GDPR. DNS.SB simply disclaims the existence of any Personal Data whatsoever, which as with AdGuard is overseen by the German BfDI and relevant Land authorities (HBDI for Frankfurt).

* https://legal-documents-dns4eu.s3.fr-par.scw.cloud/DNS4EU-Pu...

* https://uoou.gov.cz

* https://adguard-dns.io/en/privacy.html

* https://nic.cz/files/documents/20180525_Zasady_zpracovani_os...

* https://dns.sb/privacy/

* https://bfdi.bund.de/EN/Home/home_node.html

* https://datenschutz.hessen.de

Even Thomas Steen Rasmussen, who also claims zero Personal Data, would be subject to oversight by the Datatilsynet.

* https://datatilsynet.dk

Re: Choosing a Public DNS Resolver

#70

Post by rswail »

What would be the additional load if everyone ran a local caching recursive resolver like unbound?

It would need to be built into iOS/Android/Linux/Windows/MacOS but what would be the disadvantages?

I can see greater load on root servers but caching is specifically designed to reduce that.

I can see potential problems for CDNs and equivalent geo-based resolvers.

But are they really that bad?

Post reply on HN