Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

medium.com

Post reply on HN
Print view View original

181–190 of 364 posts

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#181

Post by ori_b »

cleanbrowsing wrote: post #176

Pushed a shell script to compare all of them from your location: https://github.com/cleanbrowsing/dnsperftest $ sh ./dnstest.sh |sort -k 22 -n test1 test2 test3 test4 test5 test6 test7 test8 test9 test10 Average cloudflare 1 ms 1 ms 1 ms 4 ms 1 ms 1 ms 1 ms 1 ms 1 ms 1 ms 1.30 norton 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2.00 neustar 2 ms 2 ms 2 ms 2 ms 1 ms 2 ms 2 ms 2 ms 2 ms 22 ms 3.90 cleanbrowsing 11…

I'm seeing much closer results:

    cloudflare     32 ms   33 ms   34 ms   39 ms   36 ms   35 ms   29 ms   57 ms   48 ms   33 ms     37.60
    google         43 ms   38 ms   37 ms   60 ms   34 ms   30 ms   30 ms   50 ms   32 ms   67 ms     42.10
    quad9          30 ms   139 ms  25 ms   35 ms   49 ms   36 ms   34 ms   32 ms   27 ms   47 ms     45.40
    opendns        32 ms   33 ms   28 ms   69 ms   32 ms   91 ms   37 ms   75 ms   67 ms   39 ms     50.30
    norton         35 ms   33 ms   33 ms   31 ms   39 ms   34 ms   22 ms   25 ms   24 ms   33 ms     30.90
    cleanbrowsing  36 ms   48 ms   40 ms   49 ms   56 ms   35 ms   36 ms   49 ms   49 ms   46 ms     44.40
    yandex         217 ms  233 ms  203 ms  199 ms  215 ms  380 ms  210 ms  204 ms  258 ms  205 ms    232.40
    adguard        98 ms   95 ms   101 ms  97 ms   104 ms  129 ms  103 ms  110 ms  95 ms   111 ms    104.30
    neustar        32 ms   30 ms   32 ms   35 ms   31 ms   34 ms   29 ms   28 ms   138 ms  34 ms     42.30
    comodo         55 ms   52 ms   51 ms   52 ms   47 ms   48 ms   58 ms   59 ms   48 ms   48 ms     51.80

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#182

Post by dansanderson »

josteink wrote: post #105
rmrfrmrf wrote: post #66

Earlier quoted context omitted.

NXDOMAIN hijacking is enough for me to switch, and most ISPs are doing it nowadays.

That’s quite a bold claim. Got any data to back it up? Source: I've yet to see this on any ISP I've used anywhere , sans free airport wifis. Travelled pretty much every continent on earth.

CenturyLink, major telecom in 37 US states. DNS requests for all nonexistent domains go to a server that delivers a dumb "search" page to web requests. They're currently the sole fiber-to-the-home provider in my neighborhood, and Comcast is the only broadband alternative.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#183

Post by vavrusa »

Isomer wrote: post #63

Things to look for in comparing recursive DNS servers performance: The 95%ile DNS response time for cached/uncached names. The 95%ile DNS response when one/some of the authoritative nameservers is "lame" or not responding. (better yet, 99%ile, but that requires even more queries...) The average packet loss to the nameserver. (As many resolvers use the default of a 5s timeout, better resolvers use a 1s timeout, the be…

This is a great comment. The ping time is so much less meaningful for recursive service than for authoritative. The latency difference between cached answer and uncached answer is in several orders of magnitude. The cache hit ratio also plummets without some sort of cache sharing, which many recursive services don't implement. So you may end up with great ping time, but something like:

``` ;; Query time: 12 msec ;; Query time: 149 msec ;; Query time: 14 msec ;; Query time: 238 msec ;; Query time: 112 msec ;; Query time: 27 msec ```

For less popular names.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#184

Post by eikenberry »

What about services which use anycast/geolocation to decide where to serve you data from? They will get bad location data as they will get the location of the resolver. This can have a direct impact on services.

An example of my own is from about 10 years ago when Netflix started streaming. We got a Roku and signed up but the service terrible due to the stream stopping to buffer every few minutes. After researching and trying several things I eventually came across the fact that the stream was coming from servers in over a thousand miles away with pretty bad latency between. Long story short, I eventually figured out it was due to my using the level3 resolvers for DNS. As soon as I changed to our ISP's DNS servers it worked great and the data was streaming from very close.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#185

Post by cleanbrowsing »

ori_b wrote: post #181
cleanbrowsing wrote: post #176

Pushed a shell script to compare all of them from your location: https://github.com/cleanbrowsing/dnsperftest $ sh ./dnstest.sh |sort -k 22 -n test1 test2 test3 test4 test5 test6 test7 test8 test9 test10 Average cloudflare 1 ms 1 ms 1 ms 4 ms 1 ms 1 ms 1 ms 1 ms 1 ms 1 ms 1.30 norton 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2.00 neustar 2 ms 2 ms 2 ms 2 ms 1 ms 2 ms 2 ms 2 ms 2 ms 22 ms 3.90 cleanbrowsing 11…

I'm seeing much closer results: cloudflare 32 ms 33 ms 34 ms 39 ms 36 ms 35 ms 29 ms 57 ms 48 ms 33 ms 37.60 google 43 ms 38 ms 37 ms 60 ms 34 ms 30 ms 30 ms 50 ms 32 ms 67 ms 42.10 quad9 30 ms 139 ms 25 ms 35 ms 49 ms 36 ms 34 ms 32 ms 27 ms 47 ms 45.40 opendns 32 ms 33 ms 28 ms 69 ms 32 ms 91 ms 37 ms 75 ms 67 ms 39 ms 50.30 norton 35 ms 33 ms 33 ms 31 ms 39 ms 34 ms 22 ms 25 ms 24 ms 33 ms 30.90 cleanbrowsing 36 m…

Run it with "sort -k 22 -n" to to get it listed in order of performance:

*norton is faster for you:

    norton         35 ms   33 ms   33 ms   31 ms   39 ms   34 ms   22 ms   25 ms   24 ms   33 ms     30.90
    cloudflare     32 ms   33 ms   34 ms   39 ms   36 ms   35 ms   29 ms   57 ms   48 ms   33 ms     37.60
    google         43 ms   38 ms   37 ms   60 ms   34 ms   30 ms   30 ms   50 ms   32 ms   67 ms     42.10
    neustar        32 ms   30 ms   32 ms   35 ms   31 ms   34 ms   29 ms   28 ms   138 ms  34 ms     42.30
    cleanbrowsing  36 ms   48 ms   40 ms   49 ms   56 ms   35 ms   36 ms   49 ms   49 ms   46 ms     44.40
    quad9          30 ms   139 ms  25 ms   35 ms   49 ms   36 ms   34 ms   32 ms   27 ms   47 ms     45.40
    opendns        32 ms   33 ms   28 ms   69 ms   32 ms   91 ms   37 ms   75 ms   67 ms   39 ms     50.30
    comodo         55 ms   52 ms   51 ms   52 ms   47 ms   48 ms   58 ms   59 ms   48 ms   48 ms     51.80
    adguard        98 ms   95 ms   101 ms  97 ms   104 ms  129 ms  103 ms  110 ms  95 ms   111 ms    104.30
    yandex         217 ms  233 ms  203 ms  199 ms  215 ms  380 ms  210 ms  204 ms  258 ms  205 ms    232.40

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#186

Post by michel-slm »

lucb1e wrote: post #56

Which ISPs are so bad that you want to use external services, which are further in distance than your ISP, for speed? When I test with my ISP, they beat all of these services (both IPv4 and IPv6). They're simply closer to me in terms of hops. My router is another story though. The Fritzbox (>200eur router) adds 6ms of latency, and that's what is advertised over DHCP. (Might still be fine, since cached queries are fas…

Indonesian ISPs are required to filter certain domains, but go further than the Denmark case - they also block access to third-party DNS servers. Using DNScrypt or a VPN (or hosting your own DNS on a port they're not blocking like 80) is the only workaround.

Prior to third-party DNS servers being blocked a lot of tech-savvy people were using either Google's DNS or OpenDNS anyway since they tend to be more reliable than the local ISP's (even before they started filtering).

I'm no longer in Indonesia, but I could imagine the results people are posting here would be useful to folks back home so they can adjust their DNScrypt config.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#187

Post by unethical_ban »

eikenberry wrote: post #184

What about services which use anycast/geolocation to decide where to serve you data from? They will get bad location data as they will get the location of the resolver. This can have a direct impact on services. An example of my own is from about 10 years ago when Netflix started streaming. We got a Roku and signed up but the service terrible due to the stream stopping to buffer every few minutes. After researching a…

I wonder if location data would/could/should be an optional flag in DNS requests, instead of relying on physical location of the resolver.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#188

Post by tialaramex »

sjwright wrote: post #148
scrumper wrote: post #145

Safari barfs on visiting https://1.1.1.1 as linked in the article. Certificate invalid (though it looks fine). Rather unfortunate regarding perception; it's an interesting service!

Works for me; Safari 11.0.3 on High Sierra. (I'm surprised it works at all though... I wouldn't have thought you could have an HTTPS certificate for an IP address? You learn something new every day.)

Yes, the browser checks the certificate presented includes a name which exactly matches the name in the URL it is trying to fetch.

The relevant RFC specifies two types of name suitable for servers, dnsName (a Fully Qualified DNS name written as text, except that there is no final dot, and optionally an asterisk may be used to make "wildcards") and ipAddress (an IPv4 or IPv6 address stored as a numeric value). Because this RFC is only about 20 years old, some software (but not e.g. Chrome, Firefox) also checks the X.500 series Common Name on a certificate to see if that seems to be textually equivalent to the name in the URL, which is how Netscape originally did this in like 1995 or whenever they invented SSL.

Unlike for DNS names we haven't substantially cleaned up the validation mechanisms Certificate Authorities may use for IP addresses, so they're a bit... lax, but the basic structure is you need to show you really have control over the address which was easy in this case.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#189

Post by hahainternet »

kakarot wrote: post #172
charleslmunger wrote: post #126

Earlier quoted context omitted.

https://developers.google.com/speed/public-dns/privacy

we don't keep personally identifiable information We all know what that means. "Anonymous" user IDs that can trivially be traced when combined with another database.

Except that if you click the link, that's not what this means.

Re: DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

#190

Post by burntwater »

stordoff wrote: post #168
larrybud wrote: post #84

Earlier quoted context omitted.

Read the announcement: https://blog.cloudflare.com/announcing-1111/ "APNIC's research group held the IP addresses 1.1.1.1 and 1.0.0.1. While the addresses were valid, so many people had entered them into various random systems that they were continuously overwhelmed by a flood of garbage traffic. APNIC wanted to study this garbage traffic but any time they'd tried to announce the IPs, the flood would overwhelm any co…

Have they discussed what this means in terms of the privacy promises? What "garbage traffic" does APNIC have access to in order to study?

I think that's part of the point of all this - to find out what all that garbage traffic is.
Post reply on HN