quad9 is recommended by Privacy Guides. There's also other recommendations.
An open DNS recursive service for free security and high privacy
11–20 of 40 posts
Re: An open DNS recursive service for free security and high privacy
#12Quad9 DNS sometimes returns a CDN node with obviously slower response and higher delay, so I have rarely used it since then.
Re: An open DNS recursive service for free security and high privacy
#13What are the odds that it's a honeypot?
Re: An open DNS recursive service for free security and high privacy
#14Quad9 DNS sometimes returns a CDN node with obviously slower response and higher delay, so I have rarely used it since then.
They have an ECS enabled option that fixes that, at 9.9.9.11
Re: An open DNS recursive service for free security and high privacy
#15What are the odds that it's a honeypot?
[deleted]
Re: An open DNS recursive service for free security and high privacy
#16Just a quick note for the unsuspecting: I run two local DNSes, one recursive and one forwarding. The forwarding one uses few services, like 1.1.1.1, 8.8.8.8, 9.9.9.9, etc. One day I noticed inconsistent responses and started investigating. Turns out that by default 9.9.9.9 have "protection" and for your safety will lie and return NXDOMAIN or something else, for some dangerous domains, taking into account their defini…
You can use 9.9.9.10, which is unfiltered, or 9.9.9.12, which is unfiltered and passes ECS.
Re: An open DNS recursive service for free security and high privacy
#17In California, from Xfinity Cable, Google’s DNS consistently has the lowest latency.
From AT&T fiber, Cloudflare’s 1.1.1.1 is always the fastest, though Quad9 is a very close second.
It’s interesting that it’s different from different ISPs.
Re: An open DNS recursive service for free security and high privacy
#18Just a quick note for the unsuspecting: I run two local DNSes, one recursive and one forwarding. The forwarding one uses few services, like 1.1.1.1, 8.8.8.8, 9.9.9.9, etc. One day I noticed inconsistent responses and started investigating. Turns out that by default 9.9.9.9 have "protection" and for your safety will lie and return NXDOMAIN or something else, for some dangerous domains, taking into account their defini…
[dead]
Re: An open DNS recursive service for free security and high privacy
#19Sending every single query to a centralized third party is hard to square with "high privacy". I prefer to run my own local recursive resolver.
> I prefer to run my own local recursive resolver. Used to be fine. I stopped doing it when average TTL dropped to 300 seconds and it takes far too long for my local recursor to get the answer >100ms, when 3rd party resolver delivers in <10ms.
You don't have to obey TTL. You can use Unbound options like:
cache-min-ttl: 3600 // seconds
cache-min-negative-ttl: 3600 // seconds
serve-expired: yes
serve-expired-client-timeout: 20 // milliseconds to wait for resolution before serving the old value to the clientRe: An open DNS recursive service for free security and high privacy
#20Sending every single query to a centralized third party is hard to square with "high privacy". I prefer to run my own local recursive resolver.
Please correct me if I am mistaken, but unless there’s a local resolver for every single one of your clients, aren’t the DNS requests sent in plaintext to the upstream of your local resolver? That might not be an issue for your situation, but I recall the benefit of something like Quad9’s offering is the encryption between client and their endpoint(s), particularly for untrusted ISP or similar.
Yes, that's a real benefit in many situations. Everything on your lan can do normal DNS queries to your local forwarder, which talks DNS over TLS or DNS over HTTPS to Quad9.
Downside is Quad9 can see all your DNS traffic. But without it if you run your own recursive resolver your ISP sees all your queries, and many others see portions of them, unencrypted.