4 ms·

The worst side effect of how my ISP implements this is the failure mode for DNS queries. Instead of returning an error code, they actually return a marketing pa

The worst side effect of how my ISP implements this is the failure mode for DNS queries. Instead of returning an error code, they actually return a marketing page. That page contains a fake search engine, with results. If you look at the "results", they are all ads for the ISP I'm already on...

gumby 10y ago
In a just America, people who do this would be jailed. To add insult, the majority of my DNS lookups are not for hosts I'll contact via port 80 or 443, so even in some twisted universe where I wanted their ads, their lying doesn't help me.
ChoGGi 10y ago
You could switch to using GoogleDNS or OpenDNS. If you prefer something more privacy oriented, but possibly not as fast: https://servers.opennicproject.org/ 84.200.69.80 # dns.watch 84.200.70.40 # dns.watch 37.235.1.174 # freedns.zone 37.235.1.177 # freedns.zone 213.73.91.35 # dnscache.berlin.ccc.de 194.150.168.168 # dns.as250.net; Berlin/Frankfurt 85.214.20.141 # FoeBud (digitalcourage.de) 77.109.148.136 # privacyfoundation.ch 77.109.148.137 # privacyfoundation.ch 91.239.100.100 # anycast.censurfridns.dk 89.233.43.71 # ns1.censurfridns.dk 204.152.184.76 # f.6to4-servers.net, ISC, USA Edit: I know this won't do anything for ISPs using transparent proxies (from the article: "Some ISP's"). This is just for people with shitty, but not as shitty ISPs. Such as ones that hijack NXDOMAIN: https://en.wikipedia.org/wiki/DNS_hijacking#Manipulation_by_ISPs https://en.wikipedia.org/wiki/DNS_hijacking#Manipulation_by_... Edit2: I couldn't get the test from dnsleaktest.com to work on my computer, but starting at step 3 from [0] seems to work fine (I do already use DNSCrypt with Unbound). [0] https://www.smartydns.com/support/isp-doing-transparent-dns-proxy/ https://www.smartydns.com/support/isp-doing-transparent-dns-...
- eli 10y ago
  You should read the article
- minxomat 10y ago
  You can't switch your DNS with transparent proxies. That's the whole point of this post. Even if you change your DNS server, your queries to that server are intercepted by your ISP.
  - eriknstr 10y ago
    You can pay for a VPN service that does not transparently proxy DNS and tunnel either DNS requests or DNS requests + other data through it to the DNS servers you are actually intending to use.
- detaro 10y ago
  ... which doesn't do anything if DNS is transparently intercepted, as discussed in the article.
rosstex 10y ago
I used to wonder where those marketing pages came from, I had assumed it was a rogue browser extension. Now that I think about it... it must've been DNS!
xorcist 10y ago
apt-get install unbound && echo nameserver 127.0.0.1 > /etc/resolv.conf I'm sure you have 500 kB free RAM for a proper resolver that works in the real world, and validates DNSSEC for free. I think most resolving should be done locally nowadays. Latency is mostly a last mile problem.
- voltagex_ 10y ago
  Wouldn't unbound's requests out to the net get caught by this proxying?
  - xorcist 10y ago
    I'd guess not since unbound does its own recursion. DNSSEC doesn't play well with nxdomain trickery so customers gets unhappy and that's something even shady ISPs avoid.

gumby 10y ago

In a just America, people who do this would be jailed. To add insult, the majority of my DNS lookups are not for hosts I'll contact via port 80 or 443, so even in some twisted universe where I wanted their ads, their lying doesn't help me.

ChoGGi 10y ago

You could switch to using GoogleDNS or OpenDNS. If you prefer something more privacy oriented, but possibly not as fast: https://servers.opennicproject.org/ 84.200.69.80 # dns.watch 84.200.70.40 # dns.watch 37.235.1.174 # freedns.zone 37.235.1.177 # freedns.zone 213.73.91.35 # dnscache.berlin.ccc.de 194.150.168.168 # dns.as250.net; Berlin/Frankfurt 85.214.20.141 # FoeBud (digitalcourage.de) 77.109.148.136 # privacyfoundation.ch 77.109.148.137 # privacyfoundation.ch 91.239.100.100 # anycast.censurfridns.dk 89.233.43.71 # ns1.censurfridns.dk 204.152.184.76 # f.6to4-servers.net, ISC, USA Edit: I know this won't do anything for ISPs using transparent proxies (from the article: "Some ISP's"). This is just for people with shitty, but not as shitty ISPs. Such as ones that hijack NXDOMAIN: https://en.wikipedia.org/wiki/DNS_hijacking#Manipulation_by_ISPs https://en.wikipedia.org/wiki/DNS_hijacking#Manipulation_by_... Edit2: I couldn't get the test from dnsleaktest.com to work on my computer, but starting at step 3 from [0] seems to work fine (I do already use DNSCrypt with Unbound). [0] https://www.smartydns.com/support/isp-doing-transparent-dns-proxy/ https://www.smartydns.com/support/isp-doing-transparent-dns-...

eli 10y ago
You should read the article
minxomat 10y ago
You can't switch your DNS with transparent proxies. That's the whole point of this post. Even if you change your DNS server, your queries to that server are intercepted by your ISP.
- eriknstr 10y ago
  You can pay for a VPN service that does not transparently proxy DNS and tunnel either DNS requests or DNS requests + other data through it to the DNS servers you are actually intending to use.
detaro 10y ago
... which doesn't do anything if DNS is transparently intercepted, as discussed in the article.

rosstex 10y ago

I used to wonder where those marketing pages came from, I had assumed it was a rogue browser extension. Now that I think about it... it must've been DNS!

xorcist 10y ago

apt-get install unbound && echo nameserver 127.0.0.1 > /etc/resolv.conf I'm sure you have 500 kB free RAM for a proper resolver that works in the real world, and validates DNSSEC for free. I think most resolving should be done locally nowadays. Latency is mostly a last mile problem.

voltagex_ 10y ago
Wouldn't unbound's requests out to the net get caught by this proxying?
- xorcist 10y ago
  I'd guess not since unbound does its own recursion. DNSSEC doesn't play well with nxdomain trickery so customers gets unhappy and that's something even shady ISPs avoid.