Choosing a Public DNS Resolver

Post by microgpt » Sun, Jun 28, 2026, 1:15 PM UTC

aand16 wrote: post #80

Bender wrote: post #16

Earlier quoted context omitted.

When all the authoritative servers support TLS I can enable TLS outbound but very few of them do at the moment. At some point someone is decrypting, turtles all the way down. I could of course just do DoT to another instance of Unbound somewhere else but I do not need to do that as my ISP does not care about my queries. I used to keep standby DoT Unbound servers around but I have never once seen a US ISP tinker with…

Yours is not particularly problematic but I've always wondered how come advertising agencies allow highly controversial topics on their billboards in the US. I know some (all?) EU advertisers deny creatives based on optics i.e. "our name and logo is on the billboard frame, we don't wanna get associated with topic X".

Post by aand16 » Sun, Jun 28, 2026, 1:20 PM UTC

abcdefg12 wrote: post #15

Bender wrote: post #10

Earlier quoted context omitted.

I pre-cache for speed, verifying records that have expired since I retain the expired records for sites that have intermittent DNS issues and also to throw in domains that I do not use in the off chance someone is logging where I go and when. They will see the Cloudflare top 20K domains hourly. Myself and family members have been able to access sites when others around the internet can not due to infrastructure relat…

Or you could use dnscrypt so ISP doesn’t see your lookups at all

Post by rswail » Sun, Jun 28, 2026, 1:31 PM UTC

hardaker wrote: post #79

rswail wrote: post #70

What would be the additional load if everyone ran a local caching recursive resolver like unbound? It would need to be built into iOS/Android/Linux/Windows/MacOS but what would be the disadvantages? I can see greater load on root servers but caching is specifically designed to reduce that. I can see potential problems for CDNs and equivalent geo-based resolvers. But are they really that bad?

To avoid hitting the root, don't send your queries there! Problem solved! localroot.isi.edu Bias: I created it, and am a author of one potential set of future specifications (rewrite).

Post by nativeforks » Sun, Jun 28, 2026, 1:47 PM UTC

Post by layer8 » Sun, Jun 28, 2026, 1:56 PM UTC

aetherspawn wrote: post #82

Use your ISPs official DNS so that you get the shortest path possible from the ISPs handoff location to the CDN (and overseas trunks), not a generic DNS that doesn’t know about your ISPs layout. ISP: 1ms to Cloudflare Cloudflare: 10ms to Cloudflare Thank you for your attention to this matter. Edit: will clarify, this advice applies to countries with good privacy laws and no national surveillance i.e. not the USA