Live data from Hacker News

Chromium's Impact on Root DNS Traffic

blog.apnic.net

121–130 of 221 posts

Re: Chromium's Impact on Root DNS Traffic

#122

Why does Chrome (Google) need to know whether DNS is being intercepted? What actions does Google take based on the answer? Note that under this crude test of sending queries for unregistered domains, a user who administers their own DNS could be indistingushiable from "DNS interception" by an ISP or other third party. I administer my own DNS. I do not use third party DNS. These random queries would just hit my own DN…

Since these are root queries, wouldn’t your DNS server need to hit the root servers to ensure the TLDs don’t exist? Also your own DNS won’t be detected as DNS interception unless you replace NXDOMAINs with fake responses.

If I am using a localhost cache I serve my own custom copy of root.zone. Currently I am not using a cache; I have split DNS with several authoritative servers and I pre-fetch DNS data in bulk from DOT/DOH servers.

If I serve fake responses does that turn off searching via the address bar?

Why doesn't Chromium just have a setting that allows a user to turn off the incessant queries for nonexistant names.

Re: Chromium's Impact on Root DNS Traffic

#123
post #110

Earlier quoted context omitted.

> the first word No. The answer appears to be yes if you said "the only word", though.

...which the first word would be, as you typed it?

depends how fast you type - there's a delay on the query so it's not re-querying for every keystroke. but probably yes.

Re: Chromium's Impact on Root DNS Traffic

#124

Earlier quoted context omitted.

On FF it’s Ctrl+k for searching (by prepending `? `) and Ctrl+l for addresses (if it can be parsed as an address). I almost never just click into the bar, so that works fine for me.

This works in Chrome too

I just tried this, and it doesn't do as I'd hoped.

ctrl l does not force Chrome to resolve the term through DNS, it may still run a Google search. If you want http://mylocalserver you have to include the http:// or Chrome will Google for mylocalserver.

Re: Chromium's Impact on Root DNS Traffic

#125

Wait, so Chrome leaks the first word of my searches to my ISP? That doesn’t sound like something I want to happen

Your local nameserver should be configured to not forward unqualified names upstream.

Any time you say something 'should' be something, it's an indication that sometimes it's not.

Re: Chromium's Impact on Root DNS Traffic

#126

Earlier quoted context omitted.

You can prefix your searches in the omnibox with “?” and they won’t be treated as possible short local network names

Ctrl+K for Windows users looking for a shortcut key.

It also works on Firefox (and on Linux); if you use split address/search bar it focuses to the search bar instead as it used to be.

Re: Chromium's Impact on Root DNS Traffic

#127

I'm sure anyone here who has set up a PiHole ad-blocking DNS server at home has run into these random domain requests and wondered what was going on. At first I thought one of my devices had a virus on it or something until I did a few searches and discovered it was Chrome being ludicrous. (Next topic: Getting Chrome to actually use the DNS provider that you specify and nothing else...)

I recently just blocked port 53 in my firewall completely, for that exact reason. I use an internal DNS server the forwards to an DOH upstream server. No more rogue devices trying to use their own dns, at least until they all switch to DOH too

> No more rogue devices trying to use their own dns, at least until they all switch to DOH too

nice that you already debunked your thesis

Re: Chromium's Impact on Root DNS Traffic

#128
post #110

Earlier quoted context omitted.

> the first word No. The answer appears to be yes if you said "the only word", though.

...which the first word would be, as you typed it?

I think this only happens after you press enter, not as part of the omnibox real time results. After all the infobar mentioned in the article definitely only appears after you commit the search query.

Re: Chromium's Impact on Root DNS Traffic

#130

Wait, so Chrome leaks the first word of my searches to my ISP? That doesn’t sound like something I want to happen

That's another reason to use an internal DNS server which queries an upstream DOH server.

Last I checked, I think “DNS Security” (DoH) was shipped in Chrome, you can pick an alternative in Settings, I think. Such as, in this case, Google. Not sure if that changes the way this nxdomain check behaves, presumably Chrome trusts TLS but not the ISP’s DoH?
Post reply on HN