Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Choosing a Public DNS Resolver

evilbit.de

Post reply on HN
Print view View original

131–140 of 143 posts

Re: Choosing a Public DNS Resolver

#131

Post by marginalia_nu »

tredre3 wrote: post #126
marginalia_nu wrote: post #98

Earlier quoted context omitted.

Changing your DNS does basically bupkis for privacy, since they can still read your DNS queries and SNIs.

If I set my DNS provider to use DoH or DoT, my ISP will no longer see my DNS requests. I'm confident that my ISP doesn't do DPI at scale to extract SNI, so the lack of ECH doesn't break the entirety of the privacy benefit. The fact that they could perform DPI doesn't change the reality that most ISPs probably aren't doing it, unless mandated by law, because it's expensive and in my main country of residence they can'…

Big part of why we began pushing for TLS everywhere is that ISPs were doing DPI to inject ads in web pages. There's very real precedent for this stuff, and a real market for selling information on your web habits as well. Besides the obvious value for the spooks.

It's taken a conspicuously long time to even begin to see a solution to the glaring privacy issues with SNI. Even just counting the length of time we've been aware of the problem of SNI being used for censorship and eavesdropping[1], it's over a decade, and ECH's is status is still very experimental in most web server software (and ECH is kind of a janky hack even after how long this has been discussed back and forth, the ESNI debacle, and so on).

[1] https://inria.hal.science/hal-01202712/document

Re: Choosing a Public DNS Resolver

#132

Post by hardaker »

rswail wrote: post #85
hardaker wrote: post #79

Earlier quoted context omitted.

To avoid hitting the root, don't send your queries there! Problem solved! localroot.isi.edu Bias: I created it, and am a author of one potential set of future specifications (rewrite).

Thanks, interesting, I like making my systems as stand-alone capable as possible :) What is the primary difference between using an Unbound auth-zone (as described in the RFC) compared to localroot?

They're both good. The localroot service offered at B-Root does authenticated transfers (TSIG protected) and gives you update notifications to ensure you're notified as soon as the root changes. Otherwise you may be an hour behind or so (at worst).

Both methods are fine. It would be best if unbound does ZONEMD checking to ensure the file you receive is properly protected from modification from any network in the middle, and I don't remember without looking what version (and if) Unbound does this. If they don't yet, it's coming soon. With the LocalRoot service at ISI, the TSIG protection gives you this (and is older than the ZONEMD record that is now available in the root zone).

Re: Choosing a Public DNS Resolver

#133

Post by ValentineC »

TacticalCoder wrote: post #103
ValentineC wrote: post #39

Random, but I don't understand why anyone would choose a "block ads and trackers" DNS server as a default. Even if it's configuring something for boomer family, that sounds like a recipe for "why is this website not working"?

> Random, but I don't understand why anyone would choose a "block ads and trackers" DNS server as a default. I use a "block known malware and known porn sites" and then, on top of that, I use gigantic blocklists blocking known ads and trackers. But then I've got a whitelist of allowed domains, which I updated on-the-go if that one site wife really needed wasn't working due to overzealous filtering. The reason is simp…

> But then I've got a whitelist of allowed domains, which I updated on-the-go if that one site wife really needed wasn't working due to overzealous filtering.

That's fine. I'm just puzzled why people would want to use a "block ads and tracking" DNS server without a whitelist feature.

Re: Choosing a Public DNS Resolver

#134

Post by aetherspawn »

Marsymars wrote: post #130
aetherspawn wrote: post #82

Use your ISPs official DNS so that you get the shortest path possible from the ISPs handoff location to the CDN (and overseas trunks), not a generic DNS that doesn’t know about your ISPs layout. ISP: 1ms to Cloudflare Cloudflare: 10ms to Cloudflare Thank you for your attention to this matter. Edit: will clarify, this advice applies to countries with good privacy laws and no national surveillance i.e. not the USA

In practice, performance will probably be better overall with a DNS that blocks ad servers.

A good way to work around this is to have a small server in your house as the first hop for ad blocking, and use the second hop (set the DNS servers of your DNS blocker) as your ISP.

If you use a Unifi router you can use it for this purpose (and caching) by broadcasting its IP as the default DNS server using Network options. It caches/forwards/filters any requests according to how you setup DNS in Firewall settings.

Re: Choosing a Public DNS Resolver

#135

Post by aetherspawn »

1970-01-01 wrote: post #96
layer8 wrote: post #89

Earlier quoted context omitted.

That’s no good if you want uncensored DNS.

Absolutely this. Parent advice is terrible for the reality of the problem. Shortest path does not equal fastest web page load, especially when you're filtering 99% of the crap from even resolving on your network. 0.0.0.0 is always faster than your ISP fetching extra garbage.

More detailed response below, but I believe the best way is to use a router that can filter DNS requests (ie Unifi), and set the upstream of that to your ISP.

You can set the DNS server of your entire LAN using Network options without setting it on the individual devices. It’s up to the end-device whether it uses it or not, but 99%-ish do.

Re: Choosing a Public DNS Resolver

#136

Post by h4kunamata »

Public DNS is blackbox, they always have problems especially if you are using your ISP.

I run my own Unbound recursive DNS, it only talks with the 13 root nameservers and has its own caching, the subsequent requests are lightning fast.

It is for local use only, it is not exposed to the public. When I leave home, I have a WireGuard VPN at home so my phone connects to it and the full traffic is sent via my home network.

Everything works flawlessly for the past 5 years or so.

Re: Choosing a Public DNS Resolver

#137

Post by itake »

microgpt wrote: post #74
itake wrote: post #35

Does anyone have advice on how to use public wifi alongside DNS resolver? Many public wifi network works need you to use their DNS, so they can redirect you to a gated "accept ToS" screen (and may even require re-approval every 30-60 minutes). To resolve the issue is so frustrating: 1. realize the internet stopped working 2. ping google.com, wait for timeouts to show up. 3. try to guess if its a ISP issue, but then r…

Just put an IP address into your address bar. They're usually intercepting all port 80 traffic.

this only works if the captive portal's domain is also in the public dns.

Some captive portals are only accessible in the private network.

Re: Choosing a Public DNS Resolver

#138

Post by exiguus »

abcdefg12 wrote: post #125
exiguus wrote: post #66

Earlier quoted context omitted.

Do you mean when communicating directly with a root DNS server over unencrypted UDP or TCP? You're right. There's currently no universal way to encrypt direct queries to root DNS servers. To work around this, the best approach is to host your own public DNS server outside your untrusted ISPs network and connect to it securely using DoH, DoQ, or DoT. Alternatively, you can rely on a trusted third-party public DNS prov…

That’s fine if you don’t care about privacy as long as you’re conscious about that. Dnscrypt is simple enough to use otherwise

How do you use DNSCrypt on Android or iOS?

On my notebooks, I run two Docker instances of AdGuards dnsproxy, using my own DNSCrypt resolvers as upstream servers. This setup provides anonymity from the resolver and protects against man-in-the-middle attacks, since DNSCrypt authenticates DNS responses. However, root DNS queries from the upstream remain unencrypted. Additionally, not all nameservers support DNSSEC, so a fallback is often needed. Which can still leave the upstream vulnerable to man-in-the-middle attacks. Of course, DNSCrypt is more secure (authentication, no bootstrapping), faster and anonym (against the resolver). But i think it is still not useable for "normal" people. And as a provider, the setup is more complex then DoH, DoT or DoQ, because of cert rotation and the DNS entries.

Re: Choosing a Public DNS Resolver

#139

Post by nticompass »

EbNar wrote: post #44

ControlD is pretty cool.

+1 for ControlD. I've been using for a while, and whilst it does have false positives sometimes and I need to manually add a site to the allow list, it works great for me. Also, their support has been very helpful whenever I needed something.

Re: Choosing a Public DNS Resolver

#140

Post by bguebert »

itake wrote: post #35

Does anyone have advice on how to use public wifi alongside DNS resolver? Many public wifi network works need you to use their DNS, so they can redirect you to a gated "accept ToS" screen (and may even require re-approval every 30-60 minutes). To resolve the issue is so frustrating: 1. realize the internet stopped working 2. ping google.com, wait for timeouts to show up. 3. try to guess if its a ISP issue, but then r…

I've seen some routers that will just silently redirect anything on port 53 to their own idea of the best dns server to use. That would probably "fix" this problem, but I always thought it was a little shady to redirect stuff like that. Makes troubleshooting problems difficult if you don't know it is happening.
Post reply on HN