Live data from Hacker News

Choosing a Public DNS Resolver

evilbit.de

91–100 of 143 posts

Re: Choosing a Public DNS Resolver

#91

Use your ISPs official DNS so that you get the shortest path possible from the ISPs handoff location to the CDN (and overseas trunks), not a generic DNS that doesn’t know about your ISPs layout. ISP: 1ms to Cloudflare Cloudflare: 10ms to Cloudflare Thank you for your attention to this matter. Edit: will clarify, this advice applies to countries with good privacy laws and no national surveillance i.e. not the USA

[deleted]

Re: Choosing a Public DNS Resolver

#92
post #7

It would be nice if a site like this could offer a basic speed comparison test to your local network. Imagine seeing response times at P90 for a series of random lookups and comparing the median response times.

Author here, I added this now: https://evilbit.de/dns-resolver-guide2.html#speedtest Only works for DoH though.

Re: Choosing a Public DNS Resolver

#93
Without a purpose for why you should use a public resolver it is an impossible choice to make.

If it is this hard to choose a resolver, imagine how hard it is to choose a web browser, which is a choice that actually matters.

The nearest resolver is

  $ sudo apt-get install unbound
and now your own host is your resolver. The complexity of this is roughly a millionth of a percent of that of your web browser.

Re: Choosing a Public DNS Resolver

#95
post #21

Earlier quoted context omitted.

Be cautious with Quad9; their main address (9.9.9.9) has a "malware" blacklist that has misfired several times already: twice for a private torrent tracker, once for gist.github.com, issue was resolved within minutes to hours. They have a non-filtered address (9.9.9.10), but it doesn't do DNSSEC verification. IMO they're too unreliable to be worth the hassle.

Quad9 employs DNSSEC on all endpoints now. https://quad9.net/news/blog/quad9-enables-dnssec-on-all-serv...

This is great, thanks for the correction! I tried resolving dnssec-failed.org and it does indeed fail with EDE 6 (DNSSEC Bogus). I'm not sure why this hasn't been updated on the info page[0] yet, given that the change is about three months old.

[0]: https://quad9.net/service/service-addresses-and-features/

Re: Choosing a Public DNS Resolver

#96
post #89

Use your ISPs official DNS so that you get the shortest path possible from the ISPs handoff location to the CDN (and overseas trunks), not a generic DNS that doesn’t know about your ISPs layout. ISP: 1ms to Cloudflare Cloudflare: 10ms to Cloudflare Thank you for your attention to this matter. Edit: will clarify, this advice applies to countries with good privacy laws and no national surveillance i.e. not the USA

That’s no good if you want uncensored DNS.

Absolutely this. Parent advice is terrible for the reality of the problem. Shortest path does not equal fastest web page load, especially when you're filtering 99% of the crap from even resolving on your network. 0.0.0.0 is always faster than your ISP fetching extra garbage.

Re: Choosing a Public DNS Resolver

#97

ok now add benchmarking a-la https://www.grc.com/dns/benchmark.htm to rank them on performance for your specific region etc. note on privacy: if you are using port 53 you are cooked so make sure you are using dns-over-tls or dns-over-https.

Done, enjoy: https://evilbit.de/dns-resolver-guide.html#speedtest (DoH only)

Re: Choosing a Public DNS Resolver

#98

Use your ISPs official DNS so that you get the shortest path possible from the ISPs handoff location to the CDN (and overseas trunks), not a generic DNS that doesn’t know about your ISPs layout. ISP: 1ms to Cloudflare Cloudflare: 10ms to Cloudflare Thank you for your attention to this matter. Edit: will clarify, this advice applies to countries with good privacy laws and no national surveillance i.e. not the USA

Changing your DNS does basically bupkis for privacy, since they can still read your DNS queries and SNIs.

Re: Choosing a Public DNS Resolver

#99

Use your ISPs official DNS so that you get the shortest path possible from the ISPs handoff location to the CDN (and overseas trunks), not a generic DNS that doesn’t know about your ISPs layout. ISP: 1ms to Cloudflare Cloudflare: 10ms to Cloudflare Thank you for your attention to this matter. Edit: will clarify, this advice applies to countries with good privacy laws and no national surveillance i.e. not the USA

Changing your DNS does basically bupkis for privacy, since they can still read your DNS queries and SNIs.

[deleted]

Re: Choosing a Public DNS Resolver

#100

Use your ISPs official DNS so that you get the shortest path possible from the ISPs handoff location to the CDN (and overseas trunks), not a generic DNS that doesn’t know about your ISPs layout. ISP: 1ms to Cloudflare Cloudflare: 10ms to Cloudflare Thank you for your attention to this matter. Edit: will clarify, this advice applies to countries with good privacy laws and no national surveillance i.e. not the USA

Changing your DNS does basically bupkis for privacy, since they can still read your DNS queries and SNIs.

DoH and ECH fix that
Post reply on HN