Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Choosing a Public DNS Resolver

evilbit.de

Post reply on HN
Print view View original

101–110 of 143 posts

Re: Choosing a Public DNS Resolver

#101

Post by TacticalCoder »

Bender wrote: post #5

I use Unbound locally as a DoH server. The Alpine Linux Unbound package is compiled with libnghttp2, required for the built in DoH listener . That's more than enough to enable ECH [1]. I pre-cache all the domains I use hourly via cron. My ISP is not going to dork with my DNS requests and their employees are bigger deviants than I. If I ever started browsing the web from a phone I would just set up my own public DoH s…

I run unbound too here. I love it that it takes wildcards to blacklist domains. I'm using big lists of domains to block and then I've got a whitelist that supercedes the blocked ones.

And I've got a little tool that takes:

    ayt7.ads.acme.com
    afi6.ads.acme.com
    foi5.ads.acme.com
and simplifies it to:

    ads.acme.com
Then I've got a script which generates variations of domains name I use. Say if I use:

    mybank.com (legit)
I block:

   myb4nk.com
   mibank.com
   mybank.{any other tld}
etc.

I generate hundreds of thousands of such variations: all blacklisted by unbound.

I did it after one of my bank sent me an example of a very convincing phishing site.

Been using such a setup since years now. A million blocklisted domains runs fine on an old Pi 3. I take it that on a more powerful computer unbound can deal with blocklist with millions if not tens of millions of domains (and, no, I haven't moved to whitelisting only).

I also block all unicode domains. I simply cannot access a domain name that use unicode characters in its name (and, no, I don't care).

Re: Choosing a Public DNS Resolver

#103

Post by TacticalCoder »

ValentineC wrote: post #39

Random, but I don't understand why anyone would choose a "block ads and trackers" DNS server as a default. Even if it's configuring something for boomer family, that sounds like a recipe for "why is this website not working"?

> Random, but I don't understand why anyone would choose a "block ads and trackers" DNS server as a default.

I use a "block known malware and known porn sites" and then, on top of that, I use gigantic blocklists blocking known ads and trackers.

But then I've got a whitelist of allowed domains, which I updated on-the-go if that one site wife really needed wasn't working due to overzealous filtering.

The reason is simple: browsing with ads and trackers blocked at the DNS level feels not just a bit but much snappier (and there's not need to play cat and mouse with browsers' extensions). And privacy.

I've got a pretty advanced unbound DNS server, blocking ads, trackers, known porn, known malware and shitloads of homoglyph attacks.

Took some time to set up but after that it's smooth sailing. My old Pi 3 running unbound stays always on. The only time I turn it off is when I leave for vacation. It's just that stable.

Gen Xer here, not a boomer.

Re: Choosing a Public DNS Resolver

#104

Post by amiga386 »

marginalia_nu wrote: post #98
aetherspawn wrote: post #82

Use your ISPs official DNS so that you get the shortest path possible from the ISPs handoff location to the CDN (and overseas trunks), not a generic DNS that doesn’t know about your ISPs layout. ISP: 1ms to Cloudflare Cloudflare: 10ms to Cloudflare Thank you for your attention to this matter. Edit: will clarify, this advice applies to countries with good privacy laws and no national surveillance i.e. not the USA

Changing your DNS does basically bupkis for privacy, since they can still read your DNS queries and SNIs.

It doesn't fix privacy but it does work around censorship. Has a court or the government ordered your ISP to usurp its enemies' DNS records? If so, you need to talk to a different resolver, not constrained by your government or courts.

Re: Choosing a Public DNS Resolver

#107

Post by itake »

boramalper wrote: post #45
itake wrote: post #35

Does anyone have advice on how to use public wifi alongside DNS resolver? Many public wifi network works need you to use their DNS, so they can redirect you to a gated "accept ToS" screen (and may even require re-approval every 30-60 minutes). To resolve the issue is so frustrating: 1. realize the internet stopped working 2. ping google.com, wait for timeouts to show up. 3. try to guess if its a ISP issue, but then r…

For macOS and iOS, you can create a profile to configure which DNS server you want to use at all times (including across different Wi-Fi networks and mobile data). See: https://doh.lvv.me/ That’s what I’ve been using for years and never had any issues with public hotspots.

I want the DNS to resolve the captive portal when it needs too.

I think if I force the dns this way, the public dns won’t resolve the captive portal.

When the internet is cut, it needs to use the network’s dns to resolve the captive portal domain (whatever that is)

Re: Choosing a Public DNS Resolver

#108

Post by itake »

jer0me wrote: post #46
itake wrote: post #35

Does anyone have advice on how to use public wifi alongside DNS resolver? Many public wifi network works need you to use their DNS, so they can redirect you to a gated "accept ToS" screen (and may even require re-approval every 30-60 minutes). To resolve the issue is so frustrating: 1. realize the internet stopped working 2. ping google.com, wait for timeouts to show up. 3. try to guess if its a ISP issue, but then r…

On macOS, you might be able to use /etc/resolver to fix this: sudo sh -c 'echo "nameserver 192.168.1.1" > /etc/resolver/captive.apple.com' I did this for an internal website at my university that could only be resolved using the network name server. It just occurred to me that it might also work for the URL macOS uses to detect captive portals. We'll have to see if it works the next time I'm at a café.

I think what may happen with this is:

Captive.apple.com resolves to captive portal domain

Captive portal domain fails to resolve because the portal is private and Google DNS doesn’t know about it.

Might work for captive portals that Google can resolve though?

Re: Choosing a Public DNS Resolver

#109

Post by richardlblair »

aetherspawn wrote: post #82

Use your ISPs official DNS so that you get the shortest path possible from the ISPs handoff location to the CDN (and overseas trunks), not a generic DNS that doesn’t know about your ISPs layout. ISP: 1ms to Cloudflare Cloudflare: 10ms to Cloudflare Thank you for your attention to this matter. Edit: will clarify, this advice applies to countries with good privacy laws and no national surveillance i.e. not the USA

> Thank you for your attention to this matter.

Had me in stiches

Post reply on HN