Why cloudflare is listed under maximum privacy?
Choosing a Public DNS Resolver
71–80 of 143 posts
Re: Choosing a Public DNS Resolver
#72Earlier quoted context omitted.
When all the authoritative servers support TLS I can enable TLS outbound but very few of them do at the moment. At some point someone is decrypting, turtles all the way down. I could of course just do DoT to another instance of Unbound somewhere else but I do not need to do that as my ISP does not care about my queries. I used to keep standby DoT Unbound servers around but I have never once seen a US ISP tinker with…
There is a bunch of public dnscrypt servers to which your client can randomly fan out encrypted queries.
There are but I will wait until all the authoritative resolvers support TLS. If I wanted to hide my traffic from my ISP then I would just use DoT from my firewall Unbound instance to a few Unbound instances I already have around the web.
Re: Choosing a Public DNS Resolver
#73What would be the additional load if everyone ran a local caching recursive resolver like unbound? It would need to be built into iOS/Android/Linux/Windows/MacOS but what would be the disadvantages? I can see greater load on root servers but caching is specifically designed to reduce that. I can see potential problems for CDNs and equivalent geo-based resolvers. But are they really that bad?
Id expect better geo performance because the geo domain is queried from the actual customer and not from some proxy that is hopefully nearby them
Re: Choosing a Public DNS Resolver
#74Does anyone have advice on how to use public wifi alongside DNS resolver? Many public wifi network works need you to use their DNS, so they can redirect you to a gated "accept ToS" screen (and may even require re-approval every 30-60 minutes). To resolve the issue is so frustrating: 1. realize the internet stopped working 2. ping google.com, wait for timeouts to show up. 3. try to guess if its a ISP issue, but then r…
Just put an IP address into your address bar. They're usually intercepting all port 80 traffic.
Re: Choosing a Public DNS Resolver
#75Earlier quoted context omitted.
And your isp can record all your queries
Do you mean when communicating directly with a root DNS server over unencrypted UDP or TCP? You're right. There's currently no universal way to encrypt direct queries to root DNS servers. To work around this, the best approach is to host your own public DNS server outside your untrusted ISPs network and connect to it securely using DoH, DoQ, or DoT. Alternatively, you can rely on a trusted third-party public DNS prov…
Your friends and family probably don't know what DNS privacy is. If they do know, they'll already be hosting their own. They will care if it works better. When my ISP fucked up DNS once I had my family use mine instead.
Re: Choosing a Public DNS Resolver
#76ok now add benchmarking a-la https://www.grc.com/dns/benchmark.htm to rank them on performance for your specific region etc.
note on privacy: if you are using port 53 you are cooked so make sure you are using dns-over-tls or dns-over-https.
Re: Choosing a Public DNS Resolver
#77Earlier quoted context omitted.
Be cautious with Quad9; their main address (9.9.9.9) has a "malware" blacklist that has misfired several times already: twice for a private torrent tracker, once for gist.github.com, issue was resolved within minutes to hours. They have a non-filtered address (9.9.9.10), but it doesn't do DNSSEC verification. IMO they're too unreliable to be worth the hassle.
Was about to comment this. I actually don't like advert or malware blocking on my public DNS resolvers. It sounds cool but annoying when it misfires. Once Quad9 blocked Halo MCC XBOX Live -> Steam achievements, several fileshare services (probably used for malware somewhere but not my usage) etc... 1.1.1.1 blocked archive.is or got blocked by them or something... Gone back to Google DNS (gasp) for now, yes as a Europ…
It's fine when it's a non default option. Like use x.x.x.x for DNS, x.x.x.y for DNS+adblocking, x.x.x.z for totalitarian corporate blocklist that doesn't let you do anything fun
Re: Choosing a Public DNS Resolver
#78Should add one more filter: EDNS client subnets. Some like cloudflare doesn’t support that in the name of privacy. EDNS lets the dns server of the site you are visiting know from where you are connecting and can give you the closest server. 1.1.1.1 does not do that. This breaks all sorts of ISP cache and peering arrangements. Here’s an example: My ISP’s google global cache is broken every time I use cloudflare. With…
There's some anti-competition going on there too - Cloudflare's own CDN uses anycast, which doesn't need geo-DNS, but some of their competitors use geo-DNS, so Cloudflare actually prefers that geo-DNS is broken.
Re: Choosing a Public DNS Resolver
#79What would be the additional load if everyone ran a local caching recursive resolver like unbound? It would need to be built into iOS/Android/Linux/Windows/MacOS but what would be the disadvantages? I can see greater load on root servers but caching is specifically designed to reduce that. I can see potential problems for CDNs and equivalent geo-based resolvers. But are they really that bad?
To avoid hitting the root, don't send your queries there! Problem solved!
localroot.isi.edu
Bias: I created it, and am a author of one potential set of future specifications (rewrite).
Re: Choosing a Public DNS Resolver
#80Earlier quoted context omitted.
Or you could use dnscrypt so ISP doesn’t see your lookups at all
When all the authoritative servers support TLS I can enable TLS outbound but very few of them do at the moment. At some point someone is decrypting, turtles all the way down. I could of course just do DoT to another instance of Unbound somewhere else but I do not need to do that as my ISP does not care about my queries. I used to keep standby DoT Unbound servers around but I have never once seen a US ISP tinker with…
Yours is not particularly problematic but I've always wondered how come advertising agencies allow highly controversial topics on their billboards in the US.
I know some (all?) EU advertisers deny creatives based on optics i.e. "our name and logo is on the billboard frame, we don't wanna get associated with topic X".