How does Cloudflare compare with OpenDNS?
You’d be better off comparing it to Quad9 based on performance, privacy claims, and response accuracy.
Cloudflare 1.1.1.1 Incident on July 14, 2025
181–190 of 391 posts
Re: Cloudflare 1.1.1.1 Incident on July 14, 2025
#182Earlier quoted context omitted.
> it's at least not reasonable to complain if there's an outage. I don't think this is fair when discussing infrastructure. It's reasonable to complain about potholes, undrinkable tap water, long lines at the DMV, cracked (or nonexistent) sidewalks, etc. The internet is infrastructure and DNS resolution is a critical part of it. That it hasn't been nationalized doesn't change the fact that it's infrastructure (and ac…
But you can just run a recursive resolver. Plenty of packages to install. The root DNS servers were not affected, so you would have been just fine. DNS is infrastructure. But "Cloudflare Public Free DNS Resolver" is not, it's just a convenience and a product to collect data.
One can even run a private root content DNS server, and not be affected by root problems either.
(This isn't a major concern, of course; and I mention it just to extend your argument yet further. The major gain of a private root content DNS server is the fraction of really stupid nonsense DNS traffic that comes about because of various things gets filtered out either on-machine or at least without crossing a border router. The gains are in security and privacy more than uptime.)
Re: Cloudflare 1.1.1.1 Incident on July 14, 2025
#183Earlier quoted context omitted.
> Private DNS on Android refers to 'DNS over HTTPS' Yes, sorry, I did not mention it. So if you want to use DNS over HTTPS on Android, it is not possible to provide a fallback.
> So if you want to use DNS over HTTPS on Android, it is not possible to provide a fallback. Not true. If the (DoH) host has multiple A/AAAA records (multiple IPs), any decent DoH client would retry its requests over multiple or all of those IPs.
Does Cloudflare offer any hostname that also resolves to a different organization’s resolver (which must also have a TLS certificate for the Cloudflare hostname or DoH clients won’t be able to connect)?
Re: Cloudflare 1.1.1.1 Incident on July 14, 2025
#184Question: Years ago, back when I used to do networking, Cisco Wireless controllers used 1.1.1.1 internally. They seemed to literally blackhole any comms to that IP in my testing. I assume they changed this when 1.0.0.0/8 started routing on the Internet?
Yeah part of the reason why APNIC granted Cloudflare access to those very lucrative IPs is to observe the misconfiguration volume.
The theory is CF had the capacity to soak up the junk traffic without negatively impacting their network.
Re: Cloudflare 1.1.1.1 Incident on July 14, 2025
#185What's that about a hijack?
Related, non-causal event: BGP origin hijack of 1.1.1.0/24 exposed by withdrawal of routes from Cloudflare. This was not a cause of the service failure, but an unrelated issue that was suddenly visible as that prefix was withdrawn by Cloudflare.
And because people highlighted it on social media at the time of the outage, many thought that the bogus route was the cause of the problem.
Re: Cloudflare 1.1.1.1 Incident on July 14, 2025
#186Earlier quoted context omitted.
> So if you want to use DNS over HTTPS on Android, it is not possible to provide a fallback. Not true. If the (DoH) host has multiple A/AAAA records (multiple IPs), any decent DoH client would retry its requests over multiple or all of those IPs.
Does Cloudflare offer any hostname that also resolves to a different organization’s resolver (which must also have a TLS certificate for the Cloudflare hostname or DoH clients won’t be able to connect)?
Usually, for plain old DNS, primary and secondary resolvers are from the same provider, serving from distinct IPs.
Re: Cloudflare 1.1.1.1 Incident on July 14, 2025
#187> For many users, not being able to resolve names using the 1.1.1.1 Resolver meant that basically all Internet services were unavailable. Don't you normally have 2 DnS servers listed on any device. So was the second also down, if not why didn't it go to that.
Not all users have configured two DNS servers?
OK. But there's no reason or excuse not to, if they already manually configured a primary.
Re: Cloudflare 1.1.1.1 Incident on July 14, 2025
#188Earlier quoted context omitted.
Isn't the largest company most likely to have the DNS resolver closest to me?
Your ISP should have a DNS revolver closer to you. "Should" doesn't necessarily mean faster, however.
I’ve had ISPs with a DNS server (configured via DHCP) farther away than 1.1.1.1 and 8.8.8.8.
Re: Cloudflare 1.1.1.1 Incident on July 14, 2025
#189Earlier quoted context omitted.
The closest DNS resolver to you is the one run by your ISP.
Actually, it's about 20cm from my left elbow, which is physically several orders of magnitude closer than anything run by my ISP, and logically at least 2 network hops closer. And the closest resolving proxy DNS server for most of my machines is listening on their loopback interface. The closest such machine happens to be about 1m away, so is beaten out of first place by centimetres. (-: It's a shame that Microsoft a…
Is that really a win in terms of latency, considering that the chance of a cache hit increases with the number of users?