Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Choosing a Public DNS Resolver

evilbit.de

Post reply on HN
Print view View original

11–20 of 143 posts

Re: Choosing a Public DNS Resolver

#11

Post by Bender »

kingo55 wrote: post #9
Bender wrote: post #5

I use Unbound locally as a DoH server. The Alpine Linux Unbound package is compiled with libnghttp2, required for the built in DoH listener . That's more than enough to enable ECH [1]. I pre-cache all the domains I use hourly via cron. My ISP is not going to dork with my DNS requests and their employees are bigger deviants than I. If I ever started browsing the web from a phone I would just set up my own public DoH s…

> I pre-cache all the domains I use hourly via cron. How does this look? Shell script querying a list of hostnames? What qualifies as a domain you use?

It looks like this [1] I enable query logging to a tmpfs RAM disk and then every month I update a list of domains that I have queries more than {n} times. I mix that in with a list of the Cloudflare top 20K domains after removing the broken ones and some TLD's.

[1] - https://nochan.net/b/Internet-Crap/20260602-Set-Up-Your-Own-...

Re: Choosing a Public DNS Resolver

#12

Post by petee »

Bender wrote: post #5

I use Unbound locally as a DoH server. The Alpine Linux Unbound package is compiled with libnghttp2, required for the built in DoH listener . That's more than enough to enable ECH [1]. I pre-cache all the domains I use hourly via cron. My ISP is not going to dork with my DNS requests and their employees are bigger deviants than I. If I ever started browsing the web from a phone I would just set up my own public DoH s…

Unbound has "prefetch" which will refresh near-expired cached records, and various other cache/ttl knobs. "serve-expired" seemed to work well too

Re: Choosing a Public DNS Resolver

#13

Post by Bender »

petee wrote: post #12
Bender wrote: post #5

I use Unbound locally as a DoH server. The Alpine Linux Unbound package is compiled with libnghttp2, required for the built in DoH listener . That's more than enough to enable ECH [1]. I pre-cache all the domains I use hourly via cron. My ISP is not going to dork with my DNS requests and their employees are bigger deviants than I. If I ever started browsing the web from a phone I would just set up my own public DoH s…

Unbound has "prefetch" which will refresh near-expired cached records, and various other cache/ttl knobs. "serve-expired" seemed to work well too

I use both of those as well in Unbound.

Re: Choosing a Public DNS Resolver

#14

Post by snailmailman »

kingo55 wrote: post #7

It would be nice if a site like this could offer a basic speed comparison test to your local network. Imagine seeing response times at P90 for a series of random lookups and comparing the median response times.

I run an instance of smokeping locally for this purpose. It pings a variety of DNS servers (including my ISPs DNS) and several of the top websites. I periodically update my local DNS server’s upstream accordingly.

All the big DNS servers are in the 5-6ms range for me, but that hasn’t always been the case. My ISPs DNS is about the same but with crazy variance and spikes of up to 50ms, even though they should be able to be the fastest.

Re: Choosing a Public DNS Resolver

#15

Post by abcdefg12 »

Bender wrote: post #10
harshreality wrote: post #8

Earlier quoted context omitted.

Why pre-cache? For speed... what is it, 30-50ms at most? If the authoritative server's TTL is <60minutes, do you force it to 3600? Do you audit all the connections that occur for every website you visit, collect all the domains hosting assets, and pre-cache those as well, or is the main site's domain the only critical one because that affects perceived latency the most?

I pre-cache for speed, verifying records that have expired since I retain the expired records for sites that have intermittent DNS issues and also to throw in domains that I do not use in the off chance someone is logging where I go and when. They will see the Cloudflare top 20K domains hourly. Myself and family members have been able to access sites when others around the internet can not due to infrastructure relat…

Or you could use dnscrypt so ISP doesn’t see your lookups at all

Re: Choosing a Public DNS Resolver

#16

Post by Bender »

abcdefg12 wrote: post #15
Bender wrote: post #10

Earlier quoted context omitted.

I pre-cache for speed, verifying records that have expired since I retain the expired records for sites that have intermittent DNS issues and also to throw in domains that I do not use in the off chance someone is logging where I go and when. They will see the Cloudflare top 20K domains hourly. Myself and family members have been able to access sites when others around the internet can not due to infrastructure relat…

Or you could use dnscrypt so ISP doesn’t see your lookups at all

When all the authoritative servers support TLS I can enable TLS outbound but very few of them do at the moment. At some point someone is decrypting, turtles all the way down. I could of course just do DoT to another instance of Unbound somewhere else but I do not need to do that as my ISP does not care about my queries. I used to keep standby DoT Unbound servers around but I have never once seen a US ISP tinker with my traffic. If they did I would put up billboards saying they what they are doing.

Re: Choosing a Public DNS Resolver

#17

Post by JdeBP »

Every time that this comes up, be it a general list like this or someone announcing a new service, my reaction, and that that I see of surprisingly many other people on Hacker News, is fairly unmoved. I've run my own proxy DNS service for about a quarter of a century at this point, using three different sets of softwares on six different operating systems, and every single point on the filter tab is something that I can (and do) just do for myself.

The list is not so much interesting for the options that it presents, as far as I am concerned, but for the things that it reveals. Every single entry that is explicitly marked 'China' also has 'operates under Chinese regulations'; which is, in 2026, something that is of concern for more than just the Chinese entries on the list, to people on my continent for starters.

'Run by one individual in Denmark.' is an interesting statement of bus factor, but I don't think that all of the other entries should be assumed to be better just because they are mute on the point. There's far less information about who is behind DNS.Watch than there is about Thomas Steen Rasmussen. And it appears that DNS.Watch went off the air at least once in recent years, so it is a legitimate concern.

Then there are all sorts of things not on this list that might matter to people, such as Quad101 looking like it has geographic restrictions on whom it is available to and Gcore being an AI company.

Re: Choosing a Public DNS Resolver

#18

Post by petee »

Bender wrote: post #13
petee wrote: post #12

Earlier quoted context omitted.

Unbound has "prefetch" which will refresh near-expired cached records, and various other cache/ttl knobs. "serve-expired" seemed to work well too

I use both of those as well in Unbound.

I was thinking that if you preload your 50k list and override the min-ttl, the prefetch would let you relax the cron schedule a little

Re: Choosing a Public DNS Resolver

#19

Post by Bender »

petee wrote: post #18
Bender wrote: post #13

Earlier quoted context omitted.

I use both of those as well in Unbound.

I was thinking that if you preload your 50k list and override the min-ttl, the prefetch would let you relax the cron schedule a little

I could but I like to run everything in cron hourly to force trigger the retry mechanisms on the expired records and make a bunch of noise so that my network always looks active.

It's just a "me" thing. Others can and should do whatever they think will work for them. If everyone does this a little different that is probably best.

Post reply on HN