Choosing a Public DNS Resolver • Hacker News Board

Re: Choosing a Public DNS Resolver

#141

Post by vzaliva » Mon, Jun 29, 2026, 9:45 PM UTC

brynx97 wrote: post #61

zinekeller wrote: post #55

Earlier quoted context omitted.

Some CDNs (like Cloudflare) use solely BGP anycast steering for routing to the "nearest" server. Other CDNs (like Akamai, Fastly, Netflix, and YouTube) use a hybrid BGP-DNS steering because some ISPs have extremely questionable routing practices . Unfortunately, if the CDN only rely on BGP steering (or conversely if you are a user who is stuck on an ISP monopoly), there are cases where this is not necessarily the nea…

I would be curious if you could provide any examples for the issues you cite. They sound plausible to me, especially around peering disputes or in various Asia countries, but I wonder how in practice this looks in like a traceroute for the amount of added latency etc. I would suspect some of non-optimized scenarios are eyeball network operator decisions on their networks that DNS providers and others do not have much…

Comcast + Netflix. My personal experience few years ago: switched to 8.8.8.8 DNS at home and my Netflix streaming become extrelemly slow.

Re: Choosing a Public DNS Resolver

#142

Post by marginalia_nu » Tue, Jun 30, 2026, 9:19 AM UTC

llm_nerd wrote: post #120

marginalia_nu wrote: post #98

Earlier quoted context omitted.

Changing your DNS does basically bupkis for privacy, since they can still read your DNS queries and SNIs.

There are gaps depending upon the client configuration, but "bupkis" is simply wrong or horribly obsolete. Encrypted DNS isn't an "any day now", basically every platform and browser and provider supports it, and 100% of my household's DNS requests are opaque to anyone watching the wire. And basically every system like Cloudflare supports ECH, so SNI isn't a thing for the vast majority of sites.

Cloudflare is a massive MITM that has full access to your decrypted traffic. In light of the CLOUD Act, that's even worse than the problems with SNI.

Re: Choosing a Public DNS Resolver

#143

Post by Marsymars » Fri, Jul 03, 2026, 3:25 PM UTC

aetherspawn wrote: post #134

Marsymars wrote: post #130

Earlier quoted context omitted.

In practice, performance will probably be better overall with a DNS that blocks ad servers.

A good way to work around this is to have a small server in your house as the first hop for ad blocking, and use the second hop (set the DNS servers of your DNS blocker) as your ISP. If you use a Unifi router you can use it for this purpose (and caching) by broadcasting its IP as the default DNS server using Network options. It caches/forwards/filters any requests according to how you setup DNS in Firewall settings.

Networking isn’t my strong point, but my impression is that if you do this (e.g. with a Pi-hole) there isn’t a way to gracefully failover all your in-home devices to the second hop when your Pi-hole is down. In practice this means that to avoid introducing an extra point of failure you can only really do this with an appropriate router, which pigeonholes your router selection if your preferred router isn’t one that already supported this.