5 ms·

Looks like an interesting alternative to Google DNS (8.8.8.8), and possibly a little more anonymous. Google logs your IP address for 24 - 48 hours[1], while Qua

by gmac 9y ago

Looks like an interesting alternative to Google DNS (8.8.8.8), and possibly a little more anonymous. Google logs your IP address for 24 - 48 hours[1], while Quad9 appears not to[2]. [1] https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy [2] https://www.quad9.net/#/faq#does-quad9-collect-and-store-personal-data https://www.quad9.net/#/faq#does-quad9-collect-and-store-per...

thinkMOAR 9y ago
heh i hope you are kidding :) of course they log.. edit perhaps not YOUR ip address, but enough to identify users. AS number + extra data is almost as good as IP. "When an entity or an individual is using the Quad9 infrastructure, their IP address is not logged in our system. We, however, log the geo-location of the system (city, state, country) and use this information for malicious campaign and actor analysis, as well as a component of the data we provide our threat intelligence partners. " Not logged in 'our' system, reads to me, it is still logged somewhere. And the 'data we provide our threat intelligence partners', seems a little too vague for my likings.
- gca_dre 9y ago
  So a quick explanation of what we do. (Its on the website as well, sorry if my response latency is high) We do for a short period of time have the ip address in memory, it is very quickly used to do a geo location look up, that data (the geo location data) then essentially replaces the src ip in the data structure that is used in our logs and telemetry. We can of course as outlined in that page during times of ddos or troubleshooting enable a higher level set (thing router/infrastructure) set of logging that could provide that data to the infrastructure operator (pch). When that occurs that data is not mixed with the “daily operational data” that is generated by the normal functioning of the system. This is/was the best balance we could come up with to maintain privacy and ability to mitigate/resolve technical issues with infrastructure and the operation of what we do with telemetry around blocks in the system. So quick recap, even when things go sideways and we need to mitigate a ddos or trouble shoot weird routing/anycast/other issues and enable the capture of ip/asn’s that data is generated/processed/used seleratley than the telemtry data we store, generate, and share. (On the sharing side we only share telemetery with the to vendors who gave us data to produce those blocks, so its segmented as well).
  - thinkMOAR 9y ago
    And i think thats perfectly normal. People basically demanding free public services and the operator of that service can't log anything.. thats what i have problems with :)
krylon 9y ago
It is surprisingly easy to set up a recursive resolver for oneself. That way, nobody can log and aggregate the queries you run, and nobody can mess with it either, unless they manage to break DNS itself in a big way.
- bjpbakker 9y ago
  > nobody can log and aggregate the queries you run So who do you forward your queries to? :)
  - lykr0n 9y ago
    The root servers. http://www.inetdaemon.com/img/dns-hierarchy.gif http://www.inetdaemon.com/img/dns-hierarchy.gif
  - krylon 9y ago
    A recursive resolver does not need to forward queries. ;-) Conceptually, it starts with the root nameservers and works its way up - dot by dot, recursively, hence the name - until it finds the domain the host in question in it, then asks the nameservers for that zone and caches the result. It is possible - with BIND9 at least, but I guess other DNS servers offer similar capabilities - to use forward servers for convenience/caching or to redirect queries to specific servers depending on the name in the query. But it is not mandatory.
    - bjpbakker 9y ago
      True, seems I read over the recursive part. In which case it is definitely not easy to set up. But even for a recursive DNS server that is only used by a single client aggregation for popular dains is not impossible. There are better and definitely easier ways to have anonymous DNS lookups
- creeble 9y ago
  Caution: open recursive resolvers need protection from being used for DNS amplification attacks.
bjpbakker 9y ago
Probably they still keep logs (maybe anonymized, but who really knows). If you want a more private DNS look at OpenNIC [0]. [0] - https://www.opennic.org/ https://www.opennic.org/
- skrause 9y ago
  Your closest servers: 172.104.136.243 (ns2.he.de): 96.51% uptime 5.135.183.146 (ns12.fr): 95.63% uptime Now that is some uptime I want for my DNS...

by gmac 9y ago

thinkMOAR 9y ago

heh i hope you are kidding :) of course they log.. edit perhaps not YOUR ip address, but enough to identify users. AS number + extra data is almost as good as IP. "When an entity or an individual is using the Quad9 infrastructure, their IP address is not logged in our system. We, however, log the geo-location of the system (city, state, country) and use this information for malicious campaign and actor analysis, as well as a component of the data we provide our threat intelligence partners. " Not logged in 'our' system, reads to me, it is still logged somewhere. And the 'data we provide our threat intelligence partners', seems a little too vague for my likings.

gca_dre 9y ago
So a quick explanation of what we do. (Its on the website as well, sorry if my response latency is high) We do for a short period of time have the ip address in memory, it is very quickly used to do a geo location look up, that data (the geo location data) then essentially replaces the src ip in the data structure that is used in our logs and telemetry. We can of course as outlined in that page during times of ddos or troubleshooting enable a higher level set (thing router/infrastructure) set of logging that could provide that data to the infrastructure operator (pch). When that occurs that data is not mixed with the “daily operational data” that is generated by the normal functioning of the system. This is/was the best balance we could come up with to maintain privacy and ability to mitigate/resolve technical issues with infrastructure and the operation of what we do with telemetry around blocks in the system. So quick recap, even when things go sideways and we need to mitigate a ddos or trouble shoot weird routing/anycast/other issues and enable the capture of ip/asn’s that data is generated/processed/used seleratley than the telemtry data we store, generate, and share. (On the sharing side we only share telemetery with the to vendors who gave us data to produce those blocks, so its segmented as well).
- thinkMOAR 9y ago
  And i think thats perfectly normal. People basically demanding free public services and the operator of that service can't log anything.. thats what i have problems with :)

krylon 9y ago

It is surprisingly easy to set up a recursive resolver for oneself. That way, nobody can log and aggregate the queries you run, and nobody can mess with it either, unless they manage to break DNS itself in a big way.

bjpbakker 9y ago
> nobody can log and aggregate the queries you run So who do you forward your queries to? :)
- lykr0n 9y ago
  The root servers. http://www.inetdaemon.com/img/dns-hierarchy.gif http://www.inetdaemon.com/img/dns-hierarchy.gif
- krylon 9y ago
  A recursive resolver does not need to forward queries. ;-) Conceptually, it starts with the root nameservers and works its way up - dot by dot, recursively, hence the name - until it finds the domain the host in question in it, then asks the nameservers for that zone and caches the result. It is possible - with BIND9 at least, but I guess other DNS servers offer similar capabilities - to use forward servers for convenience/caching or to redirect queries to specific servers depending on the name in the query. But it is not mandatory.
  - bjpbakker 9y ago
    True, seems I read over the recursive part. In which case it is definitely not easy to set up. But even for a recursive DNS server that is only used by a single client aggregation for popular dains is not impossible. There are better and definitely easier ways to have anonymous DNS lookups
creeble 9y ago
Caution: open recursive resolvers need protection from being used for DNS amplification attacks.

bjpbakker 9y ago

Probably they still keep logs (maybe anonymized, but who really knows). If you want a more private DNS look at OpenNIC [0]. [0] - https://www.opennic.org/ https://www.opennic.org/

skrause 9y ago
Your closest servers: 172.104.136.243 (ns2.he.de): 96.51% uptime 5.135.183.146 (ns12.fr): 95.63% uptime Now that is some uptime I want for my DNS...