[deleted]
Issues with 1.1.1.1 public resolver and WARP
31–40 of 118 posts
Re: Issues with 1.1.1.1 public resolver and WARP
#32Earlier quoted context omitted.
Running your own resolver that points directly to root servers is also an option. https://nlnetlabs.nl/projects/unbound/about/ It isn't too complicated to set up and provides faster responses than external DNS servers, especially after the cache gets built up a bit.
Indeed, this is my preferred solution too. Unfortunately this doesn’t protect one from snooping by network intermediaries, although that’s much less of an issue in the EU due to privacy regulations. At least in principle, but it’s hard to be sure.
Run your own resolver on a vpc (perhaps in a different country, pay with bitcoin, adjust on your level of concern) and WireGuard to it (perhaps WireGuard over a service like mullvad)
Re: Issues with 1.1.1.1 public resolver and WARP
#33Note that if you use 1.1.1.1, you apparently can't visit archive.is links. I'm not sure why, but around a dozen people on HN have confirmed this. (At least as of a couple months ago.) I think the world could use more alternatives to 8.8.8.8. Hopefully 1.1.1.1 will become more reliable as the years tick by. (Do you use something besides 8.8.8.8 or 1.1.1.1? If so, post it here! Collecting reliable DNS servers might be…
Do you use something besides 8.8.8.8 or 1.1.1.1?
99% of the time I just talk directly to the root servers from my home network and pre-cache the most popular places I visit. Unbound also supports DoH but most distributions of Linux do not enable that compile time flag in their Unbound package build and I have long since stopped compiling things as most distributions finally started using the right security options in their builds. I also have DoT running at home which the cell phone figured out on it's own.
I keep DoT Unbound DNS running on several VPS providers that also talk directly to the root servers just in case. Useful for cell phones. My ISP is a tiny community ISP and would never filter any results and DNS privacy is just one tiny piece of browsing habits. Until encrypted SNI is fully adopted by all SSL libraries and applications they can still see where I browse unless I am using my own Tinc VPNs or SSH tunneling.
Re: Issues with 1.1.1.1 public resolver and WARP
#34Note that if you use 1.1.1.1, you apparently can't visit archive.is links. I'm not sure why, but around a dozen people on HN have confirmed this. (At least as of a couple months ago.) I think the world could use more alternatives to 8.8.8.8. Hopefully 1.1.1.1 will become more reliable as the years tick by. (Do you use something besides 8.8.8.8 or 1.1.1.1? If so, post it here! Collecting reliable DNS servers might be…
There is https://www.dns0.eu and https://nextdns.io . I like the 300K requests per month free tier that nextdns.io has. Comes with plenty of filters.
I’m a big fan of NextDNS, ad filters, logs (or not), block list, allow list, multiple profiles, parental-ish controls. They have binaries to add support for DoH to my router. I literally couldn’t be happier with a DNS provider.
Re: Issues with 1.1.1.1 public resolver and WARP
#35Earlier quoted context omitted.
Indeed, this is my preferred solution too. Unfortunately this doesn’t protect one from snooping by network intermediaries, although that’s much less of an issue in the EU due to privacy regulations. At least in principle, but it’s hard to be sure.
Run your own resolver on a vpc (perhaps in a different country, pay with bitcoin, adjust on your level of concern) and WireGuard to it (perhaps WireGuard over a service like mullvad)
DNS latency sucks.
Re: Issues with 1.1.1.1 public resolver and WARP
#36Note that if you use 1.1.1.1, you apparently can't visit archive.is links. I'm not sure why, but around a dozen people on HN have confirmed this. (At least as of a couple months ago.) I think the world could use more alternatives to 8.8.8.8. Hopefully 1.1.1.1 will become more reliable as the years tick by. (Do you use something besides 8.8.8.8 or 1.1.1.1? If so, post it here! Collecting reliable DNS servers might be…
Do you use something besides 8.8.8.8 or 1.1.1.1? 99% of the time I just talk directly to the root servers from my home network and pre-cache the most popular places I visit. Unbound also supports DoH but most distributions of Linux do not enable that compile time flag in their Unbound package build and I have long since stopped compiling things as most distributions finally started using the right security options in…
Pihole is preconfigured to use multiple DNS. I use cloudflare and OpenDNS and exclude Google.
Re: Issues with 1.1.1.1 public resolver and WARP
#37Earlier quoted context omitted.
There is https://www.dns0.eu and https://nextdns.io . I like the 300K requests per month free tier that nextdns.io has. Comes with plenty of filters.
like i ever wanted to care about the number of dns-requests originating from my systems.
even beyond that the DNS works fine but the filtering would be turned off.
Re: Issues with 1.1.1.1 public resolver and WARP
#38Note that if you use 1.1.1.1, you apparently can't visit archive.is links. I'm not sure why, but around a dozen people on HN have confirmed this. (At least as of a couple months ago.) I think the world could use more alternatives to 8.8.8.8. Hopefully 1.1.1.1 will become more reliable as the years tick by. (Do you use something besides 8.8.8.8 or 1.1.1.1? If so, post it here! Collecting reliable DNS servers might be…
As neutrally as possible: Cloudflare doesn't support the DNS Extension that sends part of clients' IPs to the upstream resolver ( https://en.m.wikipedia.org/wiki/EDNS_Client_Subnet ). Cloudflare believes this is better for privacy. Archive.is doesn't like this (because it prevents DNS-based CDN routing), and thus has a hardcoded exception to intentionally return bogus results to Cloudflare's resolvers.
I think it's also worth noting that Cloudflare's implementation is EDNS compliant. The EDNS extension for sending the client subnet is explicitly optional in the standard.
Re: Issues with 1.1.1.1 public resolver and WARP
#39Note that if you use 1.1.1.1, you apparently can't visit archive.is links. I'm not sure why, but around a dozen people on HN have confirmed this. (At least as of a couple months ago.) I think the world could use more alternatives to 8.8.8.8. Hopefully 1.1.1.1 will become more reliable as the years tick by. (Do you use something besides 8.8.8.8 or 1.1.1.1? If so, post it here! Collecting reliable DNS servers might be…
The operators of archive.* have a peculiar problem with eDNS, or rather Cloudflare’s lack of support thereof. Some details here: https://community.cloudflare.com/t/archive-today-works-again...
Cloudflare supports EDNS, they just don't support the optional EDNS Client Subnet extension.
Re: Issues with 1.1.1.1 public resolver and WARP
#40Note that if you use 1.1.1.1, you apparently can't visit archive.is links. I'm not sure why, but around a dozen people on HN have confirmed this. (At least as of a couple months ago.) I think the world could use more alternatives to 8.8.8.8. Hopefully 1.1.1.1 will become more reliable as the years tick by. (Do you use something besides 8.8.8.8 or 1.1.1.1? If so, post it here! Collecting reliable DNS servers might be…
> Do you use something besides 8.8.8.8 or 1.1.1.1?
NextDNS