Live data from Hacker News

Cloudflare 1.1.1.1 Incident on July 14, 2025

blog.cloudflare.com

201–210 of 391 posts

Re: Cloudflare 1.1.1.1 Incident on July 14, 2025

#201
post #99

Earlier quoted context omitted.

Why not use multiple? You can use 1.1.1.1, your ISPs and google at the same time. Or just run a resolver yourself.

>Or just run a resolver yourself. I did this for a while, but ~300ms hangs on every DNS resolution sure do get old fast.

Ouch. What resolver? What hardware?

With something like a N100- or N150-based single board computer (perhaps around $200) running any number of open source DNS resolvers, I would expect you can average around 30 ms for cold lookups and <1 ms for cache hits.

Re: Cloudflare 1.1.1.1 Incident on July 14, 2025

#202
post #29

Earlier quoted context omitted.

If you consume a service that's free of charge, it's at least not reasonable to complain if there's an outage. Like mentioned by other comments, do it on your own if you are not happy with the stability. Or just pay someone to provide it - like your ISP.. And TBH I trust my local ISP more than Google or CF. Not in availability, but it's covered by my local legislature. That's a huge difference - in a positive way.

> it's at least not reasonable to complain if there's an outage. I don't think this is fair when discussing infrastructure. It's reasonable to complain about potholes, undrinkable tap water, long lines at the DMV, cracked (or nonexistent) sidewalks, etc. The internet is infrastructure and DNS resolution is a critical part of it. That it hasn't been nationalized doesn't change the fact that it's infrastructure (and ac…

>That it hasn't been nationalized doesn't change the fact that it's infrastructure (and access absolutely should be free) and therefore everyone should feel free to complain about it not working correctly.

>"But you pay taxes for drinkable tap water," yes, and we paid taxes to make the internet work too. For some reason, some governments like the USA feel it to be a good idea to add a middle man to spend that tax money on, but, fine, we'll complain about the middle man then as well.

You don't want DNS to be nationalized. Even the US would have half the internet banned by now.

Re: Cloudflare 1.1.1.1 Incident on July 14, 2025

#203

Earlier quoted context omitted.

Just pair 1.1.1.1 with 9.9.9.9 (Quad9) so you have fault tolerance in terms of provider as well.

Windows 11 does not allow using this combination

You can use it, you just need to set the DNS over HTTPS templates correctly, since there's an issue with the defaults it tries to use when mixing providers.

The templates you need are:

1.1.1.1: https://cloudflare-dns.com/dns-query

9.9.9.9: https://dns.quad9.net/dns-query

8.8.8.8: https://dns.google/dns-query

See https://learn.microsoft.com/en-us/windows-server/networking/... for info on how to set the templates.

Re: Cloudflare 1.1.1.1 Incident on July 14, 2025

#204
post #177

Earlier quoted context omitted.

Windows 11 does not allow using this combination

How so? Does it reject a secondary DNS server that’s not in the same subnet or something similar?

It's using DNS over HTTPS, and it doesn't default the URL templates correctly when mixing (some) providers. You can set them manually though, and it works.

Re: Cloudflare 1.1.1.1 Incident on July 14, 2025

#205

Earlier quoted context omitted.

Windows 11 does not allow using this combination

Huh? Did they break the primary/secondary DNS server setup that has been present in all operating systems for decades?

DNS over HTTPS adds a requirement for an additional field - a URL template - and Windows doesn't handle defaulting that correctly in all cases. If you set them manually it works fine.

Re: Cloudflare 1.1.1.1 Incident on July 14, 2025

#206

Earlier quoted context omitted.

Huh? Did they break the primary/secondary DNS server setup that has been present in all operating systems for decades?

DNS over HTTPS adds a requirement for an additional field - a URL template - and Windows doesn't handle defaulting that correctly in all cases. If you set them manually it works fine.

What does that have to do with plain old dns?

Re: Cloudflare 1.1.1.1 Incident on July 14, 2025

#207

Earlier quoted context omitted.

Google is serving you ads, CF isn’t. And it’s not conspiracy theory - it was very suspicious when we did some testing on small, aware group. The traffic didn’t look like being handled anonymously at Google side

Unless the privacy policy changed recently, Google shouldn't be doing anything nefarious with 8.8.8.8 DNS queries.

Yeah it's not like they have a long track record of being caught red-handed stepping all over privacy regulations and snarfing up user activity data across their entire range of free products...

Re: Cloudflare 1.1.1.1 Incident on July 14, 2025

#208

Earlier quoted context omitted.

DNS over HTTPS adds a requirement for an additional field - a URL template - and Windows doesn't handle defaulting that correctly in all cases. If you set them manually it works fine.

What does that have to do with plain old dns?

Nothing, but Windows can automatically use DNS over HTTPS if it recognizes the server, which is the source of the issue the other commenter mentioned.

Re: Cloudflare 1.1.1.1 Incident on July 14, 2025

#209
post #88

Earlier quoted context omitted.

I think normally you pair 1.1.1.1 with 1.0.0.1 and, if I understand this correctly, both were down.

Just pair 1.1.1.1 with 9.9.9.9 (Quad9) so you have fault tolerance in terms of provider as well.

I became a bit disillusioned with quad9 when they started refusing to resolve my website. It's like wetransfer but supporting wget and without the AI scanning or interstitials. A user had uploaded malware and presumably sent the link to a malware scanner. Instead of reporting the malicious upload or blocking the specific URL¹, the whole domain is now blocked on a DNS level. The competing wetransfer.com resolves just fine at 9.9.9.9

I haven't been able to find any recourse. The malware was online for a few hours but it has been weeks and there seems to be no way to clear my name. Someone on github (the website is open source) suggested that it's probably because they didn't know of the website, like everyone heard of wetransfer and github and so they don't get the whole domain blocked for malicious user content. I can't find any other difference, but also no responsible party to ask. The false-positive reporting tool on quad9's website just reloads the page and doesn't do anything

¹ I'm aware DNS can't do this, but with a direct way of contacting a very responsive admin (no captchas or annoying forms, just email), I'd not expect scanners to resort to blocking the domain outright to begin with, at least not after they heard back the first time and the problematic content has been cleared swiftly

Re: Cloudflare 1.1.1.1 Incident on July 14, 2025

#210
post #201
post #99

Earlier quoted context omitted.

>Or just run a resolver yourself. I did this for a while, but ~300ms hangs on every DNS resolution sure do get old fast.

Ouch. What resolver? What hardware? With something like a N100- or N150-based single board computer (perhaps around $200) running any number of open source DNS resolvers, I would expect you can average around 30 ms for cold lookups and <1 ms for cache hits.

Not a hardware issue, but a physics problem. I live in NZ. I guess the root servers are all in the US, so that's 130ms per trip minimum.
Post reply on HN