Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An open DNS recursive service for free security and high privacy

quad9.net

Post reply on HN
Print view View original

21–30 of 40 posts

Re: An open DNS recursive service for free security and high privacy

#21

Post by drewfax »

Habgdnv wrote: post #8

Just a quick note for the unsuspecting: I run two local DNSes, one recursive and one forwarding. The forwarding one uses few services, like 1.1.1.1, 8.8.8.8, 9.9.9.9, etc. One day I noticed inconsistent responses and started investigating. Turns out that by default 9.9.9.9 have "protection" and for your safety will lie and return NXDOMAIN or something else, for some dangerous domains, taking into account their defini…

That is the point and business of Quad9. It's not their fault for you not knowing what Quad9 is.

I don't want my family to get malware from sketchy websites. Quad9 offers a simple solution for these usecases. I'll take the false positive anyday over unfiltered DNS.

Re: An open DNS recursive service for free security and high privacy

#22

Post by kayson »

staviette wrote: post #20
ebb_earl_co wrote: post #5

Earlier quoted context omitted.

Please correct me if I am mistaken, but unless there’s a local resolver for every single one of your clients, aren’t the DNS requests sent in plaintext to the upstream of your local resolver? That might not be an issue for your situation, but I recall the benefit of something like Quad9’s offering is the encryption between client and their endpoint(s), particularly for untrusted ISP or similar.

Yes, that's a real benefit in many situations. Everything on your lan can do normal DNS queries to your local forwarder, which talks DNS over TLS or DNS over HTTPS to Quad9. Downside is Quad9 can see all your DNS traffic. But without it if you run your own recursive resolver your ISP sees all your queries, and many others see portions of them, unencrypted.

> But without it if you run your own recursive resolver your ISP sees all your queries, and many others see portions of them, unencrypted.

This hopefully shouldn't be an issue for long with stuff like RFC 9539 and OOTS/SVCB.

Re: An open DNS recursive service for free security and high privacy

#24

Post by doublepg23 »

LeoPanthera wrote: post #17

In California, from Xfinity Cable, Google’s DNS consistently has the lowest latency. From AT&T fiber, Cloudflare’s 1.1.1.1 is always the fastest, though Quad9 is a very close second. It’s interesting that it’s different from different ISPs.

Yup, I get 1-3ms to 1.1.1.1 and 18-20ms to Google from a semi-local fiber provider.

Definitely blew my mind coming from the ~20ms DOCSIS adds.

Re: An open DNS recursive service for free security and high privacy

#25

Post by ButlerianJihad »

LeoPanthera wrote: post #17

In California, from Xfinity Cable, Google’s DNS consistently has the lowest latency. From AT&T fiber, Cloudflare’s 1.1.1.1 is always the fastest, though Quad9 is a very close second. It’s interesting that it’s different from different ISPs.

https://en.wikipedia.org/wiki/Anycast#Domain_Name_System

  --- 8.8.8.8 ping statistics ---
  10 packets transmitted, 10 received, 0% packet loss, time 9015ms
  rtt min/avg/max/mdev = 23.666/25.241/27.628/1.022 ms

  --- 9.9.9.9 ping statistics ---
  10 packets transmitted, 10 received, 0% packet loss, time 9015ms
  rtt min/avg/max/mdev = 23.811/25.256/27.003/1.024 ms

  --- 1.1.1.1 ping statistics ---
  10 packets transmitted, 10 received, 0% packet loss, time 9014ms
  rtt min/avg/max/mdev = 13.216/14.553/15.835/0.739 ms
Of course, these ICMP reply times are apples-to-oranges comparisons. With the proper tooling, you should be able to measure DNS reply latencies.

Re: An open DNS recursive service for free security and high privacy

#26

Post by jedberg »

LeoPanthera wrote: post #17

In California, from Xfinity Cable, Google’s DNS consistently has the lowest latency. From AT&T fiber, Cloudflare’s 1.1.1.1 is always the fastest, though Quad9 is a very close second. It’s interesting that it’s different from different ISPs.

Cloudflare probably has a server on AT&Ts network, but not on Xfinity. Google is probably the opposite.

Re: An open DNS recursive service for free security and high privacy

#28

Post by bigstrat2003 »

winstonwinston wrote: post #9
greyface- wrote: post #4

Sending every single query to a centralized third party is hard to square with "high privacy". I prefer to run my own local recursive resolver.

> I prefer to run my own local recursive resolver. Used to be fine. I stopped doing it when average TTL dropped to 300 seconds and it takes far too long for my local recursor to get the answer >100ms, when 3rd party resolver delivers in <10ms.

It's still fine. I run my own recursive resolver and have no noticeable issues.

Re: An open DNS recursive service for free security and high privacy

#30

Post by TacticalCoder »

Habgdnv wrote: post #8

Just a quick note for the unsuspecting: I run two local DNSes, one recursive and one forwarding. The forwarding one uses few services, like 1.1.1.1, 8.8.8.8, 9.9.9.9, etc. One day I noticed inconsistent responses and started investigating. Turns out that by default 9.9.9.9 have "protection" and for your safety will lie and return NXDOMAIN or something else, for some dangerous domains, taking into account their defini…

Instead of CloudFlare's 1.1.1.1 I like CloudFlare's 1.1.1.3: it filters known porn and known malware sites.

By now I expect many sites to be filtered out: too much crap out there.

Then I also run my own DNS (unbound) and after seeing a warning from one of my banks about a phishing site where one letter differed in the domain name from the real bank's site, I went ballistic: I did generate hundreds of thousands (maybe millions by now) of variations of the names of banks/brokers domains I use, with every single variation of one character and many variations of up to two characters and I nullroute those too (in addition to known porn and known malware sites).

And I nullroute every single Unicode domain name. I don't care. I don't care if you disagree with this: too many homoglyph attacks. Too risky. And the Web Just Works [TM] without accessing any Unicode domain.

I null route tens if not hundreds of TLDs.

Filtering out every single domain name using any Unicode char is a bit more involved but it's doable (I do it since years, but today you can ask LLMs if you want to do it or patch a DNS software to do it).

I know some go further and by default disallow everything and then only allow domains they want to use but I find that a bit too tricky.

Now... Should there be something I really want, say I want a shady torrent tracker to download some dubious file, I can always use a VM/container with a more lenient DNS.

I'm using such a setup since years. My unbound DNS runs on a Pi 3 that's on 24/7.

Works flawlessly.

P.S: on another subject I also blocklist entire IP blocks, including entire countries. Same thing: the Web still works totally fine.

Post reply on HN