Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Issues with 1.1.1.1 public resolver and WARP

cloudflarestatus.com

Post reply on HN
Print view View original

51–60 of 118 posts

Re: Issues with 1.1.1.1 public resolver and WARP

#51

Post by LinuxBender »

lxgr wrote: post #48
LinuxBender wrote: post #33

Earlier quoted context omitted.

Do you use something besides 8.8.8.8 or 1.1.1.1? 99% of the time I just talk directly to the root servers from my home network and pre-cache the most popular places I visit. Unbound also supports DoH but most distributions of Linux do not enable that compile time flag in their Unbound package build and I have long since stopped compiling things as most distributions finally started using the right security options in…

> I just talk directly to the root servers from my home network and pre-cache the most popular places I visit. Out of curiosity: Why, if you generally trust your ISP? Do you get worse performance using their DNS servers?

I prefer to use my own server as I can optimize cache hit ratios for the things I request. This makes the internet perceptibly faster for me and others on my network. I can also pull statistics from my server whereas I would have to beg someone at the ISP for that data as a one-off request. This also gives me the option to block domain names used for dark patterns or outright malevolent behavior. I also have control over the upper and lower limits of cache and I can flush to cache if a website is still relying upon DNS failover vs BGP Anycast but I have not run into that for about a decade.

Speaking of stats, I can also see what IoT/Cell devices are requesting to keep an eye on their behavior and look for interesting patterns of DNS requests.

I have honestly never used the ISP DNS servers so I don't know what their performance is like. It's just muscle memory for me to set up my own home Linux router to be a DNS server. I highly doubt they could top the performance of Unbound and cron-jobs that request commonly used records on an hourly basis. I do know that my performance is better than talking to the DoH/DoT servers on the internet. The cached record response time is in microseconds vs 23ms for CF and non cached response time is generally between 50ms and 70ms vs 80ms to 160ms for CF not-cached.

Another nifty option in Unbound is to cache the "Infrastructure" records and to "Keep Probing" multiple nodes. This combines into a nice balance of speed and resilience especially if someones name server is having a moment but their status page is green.

    unbound-control dump_infra|wc -l
    1235
These numbers are thrown off a bit by my cron jobs that are requesting things that I am not visiting all the time and when the authoritative record is sub 3600 seconds. They are requested hourly. Some of the government domains in my cron job seem to be throwing off the curve, I will reach out to them.

    total.num.cachehits=20949
    total.num.cachemiss=8010
    total.num.prefetch=753
    total.recursion.time.median=0.0698958

Re: Issues with 1.1.1.1 public resolver and WARP

#52

Post by hk1337 »

giancarlostoro wrote: post #50
hk1337 wrote: post #36

Earlier quoted context omitted.

Pihole is preconfigured to use multiple DNS. I use cloudflare and OpenDNS and exclude Google.

> exclude Google. Their DNS? or all of their services?

The DNS in this case but as a general rule, I avoid Google services.

Re: Issues with 1.1.1.1 public resolver and WARP

#53

Post by ornornor »

sambazi wrote: post #29
shasts wrote: post #18

Earlier quoted context omitted.

There is https://www.dns0.eu and https://nextdns.io . I like the 300K requests per month free tier that nextdns.io has. Comes with plenty of filters.

like i ever wanted to care about the number of dns-requests originating from my systems.

300k is a lot to be fair. And if that’s not enough it’s something like 20$ a year. It’s the only way I found to block ads (except in YouTube) on the iPhone.

Re: Issues with 1.1.1.1 public resolver and WARP

#54

Post by kljsdflkjsaf »

tomrod wrote: post #15
cmeacham98 wrote: post #12

Earlier quoted context omitted.

As neutrally as possible: Cloudflare doesn't support the DNS Extension that sends part of clients' IPs to the upstream resolver ( https://en.m.wikipedia.org/wiki/EDNS_Client_Subnet ). Cloudflare believes this is better for privacy. Archive.is doesn't like this (because it prevents DNS-based CDN routing), and thus has a hardcoded exception to intentionally return bogus results to Cloudflare's resolvers.

> thus has a hardcoded exception to intentionally return bogus results to Cloudflare's resolvers. This is a bad practice.

[flagged]

Re: Issues with 1.1.1.1 public resolver and WARP

#55

Post by ornornor »

diggan wrote: post #6
lucgagan wrote: post #4

Crazy how many things a single thing breaking takes down with it

Not sure how crazy it is when that single thing's whole business objective is to be between what you're trying to reach and yourself.

Wait until you learn about what happens when the electricity stops working

Re: Issues with 1.1.1.1 public resolver and WARP

#56

Post by kmlx »

shasts wrote: post #18
sillysaurusx wrote: post #7

Note that if you use 1.1.1.1, you apparently can't visit archive.is links. I'm not sure why, but around a dozen people on HN have confirmed this. (At least as of a couple months ago.) I think the world could use more alternatives to 8.8.8.8. Hopefully 1.1.1.1 will become more reliable as the years tick by. (Do you use something besides 8.8.8.8 or 1.1.1.1? If so, post it here! Collecting reliable DNS servers might be…

There is https://www.dns0.eu and https://nextdns.io . I like the 300K requests per month free tier that nextdns.io has. Comes with plenty of filters.

the marketing copy on dns0 is lol considering the many ISP data retention schemes across EU states.

> The European public DNS that makes your Internet safer.

> A free, sovereign and GDPR-compliant recursive DNS resolver with a strong focus on security to protect the citizens and organizations of the European Union.

for example france: https://www.patrick-breyer.de/en/data-retention-france-illeg...

> In a decree made public today, French Prime Minister Élisabeth Borne has extended the temporary retention of communications data of all citizens in France for another year. The blanket retention obligation concerns identity data (surname, first name, date and place of birth, postal address(es), e-mail address(es), telephone number(s)) as well as payment information, connection data (IP addresses, port numbers, identification numbers of users and their devices, date, time and duration of each communication, data on supplementary services and their providers)

they basically collect everything.

Re: Issues with 1.1.1.1 public resolver and WARP

#57

Post by jacooper »

sillysaurusx wrote: post #7

Note that if you use 1.1.1.1, you apparently can't visit archive.is links. I'm not sure why, but around a dozen people on HN have confirmed this. (At least as of a couple months ago.) I think the world could use more alternatives to 8.8.8.8. Hopefully 1.1.1.1 will become more reliable as the years tick by. (Do you use something besides 8.8.8.8 or 1.1.1.1? If so, post it here! Collecting reliable DNS servers might be…

You can use quad9 without filters, and i use it because unlike CF it supports EDNS(9.9.9.11)

Re: Issues with 1.1.1.1 public resolver and WARP

#58

Post by sccxy »

giancarlostoro wrote: post #49
tomrod wrote: post #15

Earlier quoted context omitted.

> thus has a hardcoded exception to intentionally return bogus results to Cloudflare's resolvers. This is a bad practice.

why in the world are they doing that I wonder.

Personal hate against big tech companies?

Re: Issues with 1.1.1.1 public resolver and WARP

#59

Post by Unfrozen0688 »

sillysaurusx wrote: post #7

Note that if you use 1.1.1.1, you apparently can't visit archive.is links. I'm not sure why, but around a dozen people on HN have confirmed this. (At least as of a couple months ago.) I think the world could use more alternatives to 8.8.8.8. Hopefully 1.1.1.1 will become more reliable as the years tick by. (Do you use something besides 8.8.8.8 or 1.1.1.1? If so, post it here! Collecting reliable DNS servers might be…

ControlD

From the makers of Windscribe VPN (Canadian)

I use the filter that blocks ads and malware 76.76.2.2 76.76.10.2

https://controld.com/free-dns

https://docs.controld.com/docs

Re: Issues with 1.1.1.1 public resolver and WARP

#60

Post by lxgr »

LinuxBender wrote: post #51
lxgr wrote: post #48

Earlier quoted context omitted.

> I just talk directly to the root servers from my home network and pre-cache the most popular places I visit. Out of curiosity: Why, if you generally trust your ISP? Do you get worse performance using their DNS servers?

I prefer to use my own server as I can optimize cache hit ratios for the things I request. This makes the internet perceptibly faster for me and others on my network. I can also pull statistics from my server whereas I would have to beg someone at the ISP for that data as a one-off request. This also gives me the option to block domain names used for dark patterns or outright malevolent behavior. I also have control…

Interesting, thank you!

Yeah, local caching is a good point if your operating system(s) doesn't already do it in the DNS client.

> This also gives me the option to block domain names used for dark patterns or outright malevolent behavior.

I wonder how long this will actually remain possible, given that with DoH it now seems entirely feasible for websites to provide their own application-level DNS resolver?

Post reply on HN