29 ms·

1.1.1.1: Fast, privacy-first consumer DNS service

• deleted 9y ago
  [deleted]
• ajross 9y ago
  This is the Cloudflare resolver, right? What's the "privacy-first" part about? It's just another third party DNS host. They haven't changed the protocol to be uninspectable and AFAIK haven't made any guarantees about logging or whatnot that would enhance privacy vs. using whatever you are now. This just means you're trusting Cloudflare instead of Comcast or Google or whoever.
  • deleted 9y ago
    [deleted]
  • shimms 9y ago
    Yes they have: "Privacy First: Guaranteed. We will never sell your data or use it to target ads. Period. We will never log your IP address (the way other companies identify you). And we’re not just saying that. We’ve retained KPMG to audit our systems annually to ensure that we're doing what we say. Frankly, we don’t want to know what you do on the Internet—it’s none of our business—and we’ve taken the technical steps to ensure we can’t."
    • dictum 9y ago
      > Frankly, we don’t want to know what you do on the Internet—it’s none of our business In the DNS resolver space, what is their business?
      • hrunt 9y ago
        They want fast resolution of names that point to websites hosted by Cloudflare. Cloudflare makes their money selling their network to businesses that use it, and anything that makes that service better for the end-user increases customer stickiness.
      • distantsounds 9y ago
        Making the internet fast and reliable, and arguably DNS resolution plays into that.
      • tbyehl 9y ago
        Could be a precursor to launching an OpenDNS competitor.
        • wtmt 9y ago
          Is OpenDNS even as relevant as it was earlier, before Google DNS appeared (and then OpenDNS was bought by Cisco)?
          • tialaramex 9y ago
            Maybe not _as_ relevant, but still a considerable number of clients are configured to trust OpenDNS, and their far more ambiguous stance on what exactly this is for is appealing to some people. For example, OpenDNS says yes, absolutely it is their business what you're looking up, and maybe you are a Concerned Parent™ who wants to ensure their children don't access RedTube, so that feels like a good idea.
            • tbyehl 9y ago
              I was thinking more along the lines of their SME offering. DNS filtering is an important layer in network security and CloudFlare’s position of being in the middle of a large portion of Internet traffic, alongside now trying to attract a chunk of general DNS queries, potentially gives them a great deal of insight into who the bad actors are.
      • jhanschoo 9y ago
        Traffic from heavily censored regimes to its big customers, which often end up being censored due to user contributions, I suppose.
    • ajross 9y ago
      Serious question: where is that quote from? The link above is just to the resolver address.
      • brantonb 9y ago
        Quote is at: https://1.1.1.1 https://1.1.1.1
        • dingo_bat 9y ago
          Not opening for me.
          • lugg 9y ago
            Try https://1.0.0.1/ https://1.0.0.1/
  • deleted 9y ago
    [deleted]
  • vimda 9y ago
    Did you read the page? They're supporting DNS over TLS and DNS over HTTPS - both changes to the protocol to make in uninspectable. They've also said they're not logging IP info and they're getting independent auditors in to confirm what they're saying. Sounds trustworthy to me
    • dingaling 9y ago
      Both encrypted extensions are of course inspectable at the end-point, which is the privacy model being discussed. What is intriguing to me is why Cloudflare are offering this. Perhaps it is to provide data on traffic that is 'invisible' to them, as in it doesn't currently touch their networks. Possibly as a sales-lead generator. Or is the plan to become dominant and then use DNS blackholing to shutdown malware that is a threat to their systems?
      • vimda 9y ago
        Im probably being naive, but maybe altruism? At least if you buy into their making the internet better rhetoric
        • wtmt 9y ago
          Cloudflare is already a significant enough player in handling Internet traffic. Maybe the company does want to do good for the sake of doing good, but I’m wary of companies taking over in this manner and making the Internet more like a monolith than a distributed system.
      • zackbloom 9y ago
        The goal is to make the sites that use Cloudflare ridiculously fast by putting the authoritative and recursive DNS on the same machine (for clients who use 1.1.1.1).
    • kzrdude 9y ago
      It seems like bait-and-switch though? They tell about DNS over https and dns without logging, and then direct to an installation instruction where you can learn to start to use, "DNS without logging", but nothing that's encrypted? What am I missing?
  • yjftsjthsd-h 9y ago
    On the contrary, they've taken 2 big steps that are better than ISPs (not sure about Google): * no logging * DNS over HTTPS
    • therealmarv 9y ago
      Google is one of the first ones using DNS over HTTPS. BTW if you want to use DNS over HTTPS on Linux/Mac I strongly recommend dnscrypt proxy V2 (golang rewrite) https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy and put e.g. cloudflare in their config toml file to make use of it.
      • cptskippy 9y ago
        The whole point of encrypting DNS traffic is to hide it from the likes of Google.
        • akquise 9y ago
          For me personally it is much more important to hide my DNS traffic from my ISP instead of Google, etc., even though I don't live in the US. I pay them to access the internet, every further information they gather about my internet activity does not mean any benefit for me.
          • opencl 9y ago
            Hiding DNS traffic from your ISP is pointless when you have to give them the IP that gets resolved anyway for them to route your traffic.
            • markonen 9y ago
              Not really. Typically the query includes much more information (the site you want to visit) than the response (an IP potentially shared by thousands or millions of sites).
  • otoburb 9y ago
    Cloudflare is making a public pronouncement that they're not going to sell your DNS data nor track your IP address, with the implication that they will also not use the usage data to upsell you services. That's about the only additional "privacy" edge they offer. In the same breath, they insinuate that Google both sells and uses DNS usage from their 8.8.8.8 and 8.8.4.4 resolvers.
    • heisenbit 9y ago
      They are NOT saying Google is lying and collecting the data. They are saying the business model of Google inherently provides such incentive. Cloudflare is somewhat right: Means, Motive and Opportunity - but for a conviction you have to prove someone acted on the Opportunity. The Motive of Google is tampered with severe risk for loosing trust. Cloudflare can make an argument they are fundamentally better positioned and that is all they do. As with all US based operations the NSA may cook up some convincing counterarguments and we may never know.
      • Twisol 9y ago
        It's clear what you meant, but for whatever it's worth, I think the word you wanted was "tempered", not "tampered".
        • wtmt 9y ago
          For what it’s worth, you missed to point out “loosing” vs. “losing” in that comment (where it talks about “loosing trust”). :)
          • Twisol 9y ago
            That looked more like a garden-variety typo than a bona fide eggcorn, so I gave it a pass ;) https://en.wikipedia.org/wiki/Eggcorn https://en.wikipedia.org/wiki/Eggcorn
      • bogomipz 9y ago
        >"They are NOT saying Google is lying and collecting the data." The OP did not say that cloudflare is "saying" that. The OP very clearly said they are "insinuating" it. And yes under the heading "DNS's Privacy Problem" the post mentions: "With all the concern over the data that companies like Facebook and Google are collecting on you,..." I think that juxtaposition of this statement under a bolded heading of "DNS's Privacy Problem" is very much insinuating that.
  • tialaramex 9y ago
    "We will never log your IP address (the way other companies identify you). And we’re not just saying that. We’ve retained KPMG to audit our systems annually to ensure that we're doing what we say." Now, audits are generally not worth very much (even, perhaps even especially, from a Big Four group like KPMG), but for this type of thing (verifying that a company isn't doing something they promised they would not do) they're about the best we have.
    • runningmike 9y ago
      Where is the technical audit report published? Open access url please.
      • bostik 9y ago
        Having dealt with KPMG recently (which I do at least once a year...), I would not expect to see the report. KPMG's risk department - the lawyers' lawyers - appears to be violently allergic to their customers disclosing any report to outside parties. Based on my experience you can get a copy, but first you and the primary customer need to submit some paperwork. And among the conditions you need to agree with is that you don't redistribute the report or its contents. Disclosure: I deal with security audits and technical aspects of compliance.
        • jlgaddis 9y ago
          > KPMG's risk department - the lawyers' lawyers - appears to be violently allergic to their customers disclosing any report to outside parties. Isn't that the entire point of such an audit? To be able to present it to outside third-parties? For examples, Mozilla (CA/B) requires audits for root CAs. The CA must provide a link to the audit on the auditor's public web site -- forwarding a copy or hosting it on their own isn't sufficient.
          • tialaramex 9y ago
            You'd think, but it's surprisingly difficult to get the real full audit report. Mozilla's root policy _does_ require that they be shown the report, and has a bunch of extra requirements in there to ensure they're more detail, rather than some summary or overview document the auditors were persuaded to produce for this purpose. But the CA/B rules would allow just an audit letter which basically almost always says "Yes, we did an audit, and everything is fine" unless the auditors weren't comfortable writing "everything is fine". And almost always they feel that a footnote on a sub-paragraph buried in a detailed report is enough to leave "everything is fine" as the headline in the letter... If you've ever been audited for some other reason, you'll know they find lots of things, and then you fix them, and that's "fine". But well, is it fine? Or, should we acknowledge that they found lots of things and what those things were, even if you subsequently fixed them? The CA/B says you have several months to hand over your letter after the audit period. Guess what those months are spent doing...
  • cornholio 9y ago
    I think the whole point for such free services is to log that data and extract statistical meaning out of it - in this case, they pledge to use an anonymized format. On the other hand CloudFlare's mission (ensure secure, solid end to end connectivity) is much better aligned with the user's needs than Google's mission (sell more ads).
• deleted 9y ago
  [deleted]
• mkj 9y ago
  If everyone* just ran a full recursing resolver would that cause undue load on the root-servers? Seems like a sane way to decentralise. * Actually only ~1% of internet users, the kind of people that install openwrt
  • vimda 9y ago
    Root servers get basically no traffic anyway. It's basically all cached by recursors.
    • JdeBP 9y ago
      That's not in fact true. There are quite a lot of cache misses in the normal course of affairs, to start with.
  • oneplane 9y ago
    Well, OpenWRT, DD-WRT, pfSense and OPNSense eh.
• tomputer 9y ago
  Today I learned that it is possible to request a certificate for an IP address.
  • tialaramex 9y ago
    Yup, the Subject Alternative Name (often misunderstood as an alias, but "Alternative" here is meant in the sense of this is the Internet's _Alternative_ way to name things versus the X.500 series directory hierarchy that the X.509 certificates are originally intended for) can be one of several distinct types, the two relevant for servers are dnsName and ipAddress. dnsName can be any er, name, in the DNS hierarchy, or, as a special case, a "wildcard" with asterisks, whereas ipAddress can be any type of IP address, currently either IPv4 or IPv6. The Baseline Requirements agreed between Web Browser vendors and root Certificate Authorities dictate how the CA can figure out if an applicant is allowed a certificate for a particular name, for dnsNames this is the Ten Blessed Methods, for ipAddress the rules are a bit... eh, rusty, but the idea is you can't get one for that dynamic IP you have from your cable provider for 24 hours, but somebody who really controls the IP address can get one. They're uncommon, but not rare, maybe a dozen a day are issued? Your web browser requires that the name in the URL exactly matches the name in the certificate. So if you visit https://some-dns-server.example/ https://some-dns-server.example/ the certificate needs to be for some-dns-server.example (or *.example) and a certificate for 1.1.1.1 doesn't work, even if some-dns-server.example has IP address 1.1.1.1 - so this cert is only useful because they want people actually typing https://1.1.1.1/ https://1.1.1.1/ into browsers... [edited, I have "Servers" on the brain, it's _Subject_ Alternative Name, you can use them to name email recipients, and lots of things that aren't servers]
    • tomputer 9y ago
      Thanks for the clarification. I did know it was possible when setting up CA's for VPN servers, they can use certificates with DNS and/or IP as identifiers. Somehow I never thought about certificates for public IP addresses.
      • jlgaddis 9y ago
• therealmarv 9y ago
  Where can I flush a address there (just asking for DevOps purposes)?
  • vimda 9y ago
    By setting a low TTL? Does any recursor allow you to manually flush?
    • therealmarv 9y ago
      I can flush Google's DNS entries https://developers.google.com/speed/public-dns/cache https://developers.google.com/speed/public-dns/cache and OpenDNS https://cachecheck.opendns.com/ https://cachecheck.opendns.com/ which is very handy when you play with your DNS entries of your servers.
• infinisil 9y ago
  9.9.9.9 [1] has been praised by a bunch of people in the thread from a couple days ago [2]. How do those two compare? [1] https://www.quad9.net/ https://www.quad9.net/ [2] https://news.ycombinator.com/item?id=16716606 https://news.ycombinator.com/item?id=16716606
  • yjftsjthsd-h 9y ago
    Logging: https://www.quad9.net/privacy/ https://www.quad9.net/privacy/
    • matwood 9y ago
      Anonymized logging to improve the service and security. Is this different from Cloudflare?
      • bitxbitxbitcoin 9y ago
        Cloudflare is saying they won't log and will have audits by KPMG yearly to prove as such. Not logging and logging anonymized data are different approaches.
        • matwood 9y ago
          FTA: While we need some logging to prevent abuse and debug issues, we couldn't imagine any situation where we'd need that information longer than 24 hours. So the difference is how long the logs are kept, and possibly what the log data is used for.
  • okket 9y ago
    "Here are some DNS measurements comparing @Google Public DNS, @Quad9DNS and @Cloudflare, v6 and v4. Sourced from AS3320 near Frankfurt. Quad9 is fastest in avg. The proposed v6 address from Cloudflare is not yet working, but the longer ones." https://twitter.com/webernetz/status/980055981282484225 https://twitter.com/webernetz/status/980055981282484225
  • 9y ago
• TheWoodsy 9y ago
  Thought this was an April Fool joke at first. Queries are jumping anywhere from 10ms to 138ms compared to a flat 6ms on Google and OpenDNS in Australia. Maybe unexpected traffic?
  • noobermin 9y ago
    I thought so too, especially the emphasis on April 1. But I'm not sure what the joke is.
• nubela 9y ago
  $ ping 1.1.1.1 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: icmp_seq=0 ttl=47 time=214.866 ms 64 bytes from 1.1.1.1: icmp_seq=1 ttl=47 time=173.416 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=45 time=256.007 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=45 time=196.638 ms 64 bytes from 1.1.1.1: icmp_seq=4 ttl=45 time=294.694 ms 64 bytes from 1.1.1.1: icmp_seq=5 ttl=45 time=314.883 ms 64 bytes from 1.1.1.1: icmp_seq=6 ttl=47 time=335.099 ms (From Singapore) Google's 8.8.8.8 has about <4ms
  • wakokueh 9y ago
    PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: icmp_seq=0 ttl=60 time=2.099 ms 64 bytes from 1.1.1.1: icmp_seq=1 ttl=60 time=2.073 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=60 time=1.963 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=60 time=2.089 ms PING 8.8.8.8 (8.8.8.8): 56 data bytes 64 bytes from 8.8.8.8: icmp_seq=0 ttl=60 time=1.908 ms 64 bytes from 8.8.8.8: icmp_seq=1 ttl=60 time=1.888 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=60 time=1.993 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=60 time=1.891 ms From SG too. Could it be... just you?
    • isatty 9y ago
      Just him. Starhub Fiber: ping 1.1.1.1 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: icmp_seq=0 ttl=59 time=3.111 ms 64 bytes from 1.1.1.1: icmp_seq=1 ttl=59 time=3.172 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=59 time=3.301 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=59 time=3.018 ms 64 bytes from 1.1.1.1: icmp_seq=4 ttl=59 time=3.218 ms ^C --- 1.1.1.1 ping statistics --- 5 packets transmitted, 5 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 3.018/3.164/3.301/0.096 ms fwiw Google DNS is around the same, 2.942ms average.
      • sho 9y ago
        Interesting, mine is bad too. From singtel: Host Loss% Snt Last Avg Best Wrst StDev 1. 192.168.1.254 0.0% 75 1.3 1.6 1.1 14.8 1.6 2. bbXXX-XXX-XXX-XX.singnet.com.sg 0.0% 75 3.4 2.8 1.9 18.7 2.5 3. 202.166.123.134 0.0% 75 3.2 3.5 2.7 15.9 2.0 4. 202.166.123.133 0.0% 75 3.0 3.0 2.4 6.6 0.7 5. ae8-0.tp-cr03.singnet.com.sg 0.0% 75 3.1 3.3 2.8 6.9 0.7 6. ae4-0.tp-er03.singnet.com.sg 0.0% 75 2.9 3.1 2.6 6.7 0.5 7. 203.208.191.197 0.0% 75 7.8 4.6 2.9 18.3 3.6 8. 203.208.149.138 0.0% 75 3.0 7.5 2.7 67.2 13.4 9. 203.208.153.126 0.0% 75 182.8 186.9 174.4 327.7 20.5 203.208.172.226 203.208.172.178 203.208.158.50 203.208.152.214 203.208.173.106 203.208.149.58 203.208.149.30 10. ix-xe-0-1-2-0.tcore2.pdi-palo-alto.as6453.net 0.0% 74 201.4 190.5 183.9 210.1 5.9 11. if-ae-5-2.tcore2.sqn-san-jose.as6453.net 0.0% 74 181.4 184.7 179.4 197.9 4.6 12. if-ae-1-2.tcore1.sqn-san-jose.as6453.net 0.0% 74 177.8 177.3 172.0 190.0 4.8 13. 63.243.205.106 0.0% 74 179.2 184.2 179.1 196.2 4.5 14. 1dot1dot1dot1.cloudflare-dns.com 0.0% 74 191.9 184.7 172.4 202.3 6.6 Looks like singtel has some bad routing rules for Cloudflare and it's going through to the USA rather than hitting a local PoP. Might send CloudFlare a quick email as they'll probably want singtel to correct this.
• sofaofthedamned 9y ago
  How on earth did they get a cert for an IP address?!
  • gsich 9y ago
    Place the IP into the "Subject Alternative Name".
    • sofaofthedamned 9y ago
      Good to know, thank you!
      • gsich 9y ago
        Haven't tried this with Lets Encrypt, but would be nice if this worked there aswell.
        • prdonahue 9y ago
          They don't support this.
• milankragujevic 9y ago
  uhm how can you get an ssl cert for an IP?
  • nkozyra 9y ago
    It's just uncommon but supported https://stackoverflow.com/questions/1095780/are-ssl-certificates-bound-to-the-servers-ip-address https://stackoverflow.com/questions/1095780/are-ssl-certific...
  • rocqua 9y ago
    Apparently, you need to provide it as a Subject Alternative Name (SAN). This is the entry for the cert used: DNS Name=*.cloudflare-dns.com IP Address=1.1.1.1 IP Address=1.0.0.1 DNS Name=cloudflare-dns.com IP Address=2606:4700:4700:0000:0000:0000:0000:1111 IP Address=2606:4700:4700:0000:0000:0000:0000:1001
    • tialaramex 9y ago
      SAN is the only correct way to write any kind of name for servers on the Internet in a certificate. The "Common Name" was left as a compatibility feature like 20 years ago when SANs were invented and then it rusted into place, but is no longer examined by current Firefox or Chrome browsers for "real" certificates from the public Internet. Chrome shipped releases for a while with a bug where they'd complain the server's cert had the wrong "Common Name" when actually they never checked CN at all, and so it might even have the right Common Name, but they really meant "Your SANs don't match fool" and hadn't updated the error text. Because crappy software (looking at you here OpenSSL) makes writing SANs into a Certificate Subject Request way harder than it needs to be, a lot of CAs (including Let's Encrypt) will take a CSR that says "My Common Name is foo.example" and sigh, and issue a cert which adds SAN dnsName foo.example, because they know that's what you want. Really somebody should fix the software, one of these days. In older Windows versions, SChannel (Microsoft's implementation of SSL/TLS) doesn't understand ipAddress, and thinks the correct way to match an ipAddress against a certificate is to turn the address into ASCII text of dotted decimals and compare that to the dnsName entries. This, unsurprisingly, is not standards compliant. It's good to see a CA not trying to fudge this, but the consequence is probably that if you have older Windows (XP? Maybe even something newer) these certs don't check out as valid for the site. Eh. Upgrade already.
• eeZah7Ux 9y ago
  Any reason why DNS over TLS is preferred over DNSCurve?
  • rocqua 9y ago
    It looks like any other TLS connection? Just a guess.
  • therealmarv 9y ago
    I'm guessing less "sophisticated reinvention" and usage of existing TLS connection technology. You can use both (even at the same time) with DNScrypt-proxy V2 https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy ;)
• deleted 9y ago
  [deleted]
• DSthrowaway1 9y ago
  It works! ; <<>> DiG 9.8.3-P1 <<>> dailystormer.name @1.1.1.1 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: - ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 10 ;; QUESTION SECTION: ;dailystormer.name. IN A ;; ANSWER SECTION: dailystormer.name. 86400 IN A 198.251.90.113 ;; AUTHORITY SECTION: dailystormer.name. 86400 IN NS f1g1ns1.dnspod.net. dailystormer.name. 86400 IN NS f1g1ns2.dnspod.net. ;; ADDITIONAL SECTION: f1g1ns1.dnspod.net. 70157 IN A 58.247.212.36 f1g1ns1.dnspod.net. 70157 IN A 61.151.180.44 f1g1ns1.dnspod.net. 70157 IN A 180.163.19.15 f1g1ns1.dnspod.net. 70157 IN A 182.140.167.166 f1g1ns1.dnspod.net. 70157 IN A 14.215.150.17 f1g1ns2.dnspod.net. 70157 IN A 61.129.8.159 f1g1ns2.dnspod.net. 70157 IN A 101.226.220.16 f1g1ns2.dnspod.net. 70157 IN A 121.51.128.164 f1g1ns2.dnspod.net. 70157 IN A 182.140.167.188 f1g1ns2.dnspod.net. 70157 IN A 52.220.136.67 ;; Query time: 550 msec ;; SERVER: 1.1.1.1#53(1.1.1.1) ;; WHEN: Sun Apr 1 -:-:- 2018 ;; MSG SIZE rcvd: 265
• latexr 9y ago
  If you’re on macOS and would rather do this from the command line: sudo networksetup -setdnsservers Wi-Fi 1.1.1.1 1.0.0.1
• jimaek 9y ago
  You can get performance stats over here https://www.dnsperf.com/#!dns-resolvers https://www.dnsperf.com/#!dns-resolvers
• phoe-krk 9y ago
  I find it slightly amusing that they do not need to register a domain name for that one.
  • 0x006A 9y ago
    to get the ssl certificate they had to get a domain: cloudflare-dns.com, ips only works as alternative names but not as the main domain name.
    • tialaramex 9y ago
      Nope, certificates can be, and sometimes are, issued for plain IP addresses, yes including in the Web PKI ("proper" certificates that work in common web browsers). Because the BRs say that the subject Common Name, if present (which it usually will be for really crappy software that still doesn't implement standards from _last god-damn century_) must be chosen from the list of SANs, these certificates will have an IP address as their CN, plus an ipAddress SAN. Here is an example, which my records say had an IP address as its only name, but at time of writing crt.sh is timing out for me so forgive me if this some completely unrelated cert and I've pasted the wrong one: https://crt.sh/?id=346170629 https://crt.sh/?id=346170629
• therealmarv 9y ago
  Interesting that https://dnsleaktest.com/ https://dnsleaktest.com/ does not work with Cloudflare's DNS... that's a first one for me.
  • peterburkimsher 9y ago
    https://www.immigration.govt.nz https://www.immigration.govt.nz also doesn't work - I just realised when reopening my browser. Thankfully I noticed quickly, so I knew what the problem would be.
    • vavrusa 9y ago
      As it should fail in any validating resolver. The CNAME signature recently expired: http://dnsviz.net/d/www.immigration.govt.nz/dnssec/ http://dnsviz.net/d/www.immigration.govt.nz/dnssec/
• pmlnr 9y ago
  Cloudflare, are you planning to support the OpenNIC initiative with this later on, rather than just being a regular, alternative DNS resolver?
• ogud 9y ago
  Official now Privacy and Speed are the goals https://blog.cloudflare.com/dns-resolver-1-1-1-1/ https://blog.cloudflare.com/dns-resolver-1-1-1-1/ https://blog.cloudflare.com/announcing-1111/ https://blog.cloudflare.com/announcing-1111/
• ComputerGuru 9y ago
  This is bad, bad, bad advice. You don't set the DNS on your local machine. That breaks things. The DNS needs to be set at the gateway. If you change your PC/mac's DNS to an external service, you won't be able to resolve any addresses on the local network. Come on, CloudFlare. You guys know better than that. Please stop breaking the (local) internet.
  • lorenzhs 9y ago
    Ordinary users don't have anything that resolves to local IPs, so this is a non-issue for just about anybody. Plus, many if not most ISP-provided modem-router-AP-boxes don't let you configure the DNS server they use, making your recommendation impossible to follow for most users. Someone who runs services on their local network likely knows enough to do as you say, but for 99% of people, these instructions are exactly what they need.
    • Spooky23 9y ago
      Most people own printers and other devices that use local DNS. Don’t presume that joe public is a simpleton. Millions of people are not.
      • lorenzhs 9y ago
        Zeroconf (Avahi/Bonjour) takes care of making that wireless printer work regardless of which DNS server you’re using. I’m not insinuating that “joe public” is dumb. He just doesn’t need to care about DNS on his local network, there’s software that handles it for him.
        • wpietri 9y ago
          Yes! People are smart enough to handle most things. But they don't have time or attention to handle all the things. When we're making technology for users, we should do our best to make sure they only have to learn about the things that are important to them.
    • 9y ago
• icebergonfire 9y ago
  I am getting ERR_CERT_AUTHORITY_INVALID because my ISP-provided router is intercepting the connection and trying to show me a "helpful" configuration wizard. No Cloudflare DNS for me. To be explicit: This is not Cloudflare's fault and we should blame the manufacturer of the router, or the ISP for deploying their custom "friendly" settings. But it is what it is.
  • rmsaksida 9y ago
    Same problem here. It would be nice if Cloudflare created an alias to 1.1.1.1, because I can't access it at all. Edit: 1.0.0.1 also takes me to the router configuration screen. And there's no configuration setting for it. :(
    • jamesog 9y ago
      https://cloudflare-dns.com/ https://cloudflare-dns.com/ works, however it redirects to https://1.1.1.1/ https://1.1.1.1/
    • tialaramex 9y ago
      Yup, these ranges are poisonous, which is why APNIC kept them, so this is effectively to be expected. It would actually be extraordinary if, since the range was determined to be poisonous and so mustn't be delegated this had magically fixed itself. So I was sort-of expecting to see some comments in the last thread about 1.1.1.1 like yours. The "good" news is that this isn't being used for anything you really need - imagine if 1.1.1.1 had been delegated and now it was the resolution for www.facebook.com or indeed news.ycombinator.com ... The bad news is that idiots do not learn from their mistakes, that's Dunning Kruger, the people who built your device don't understand why this was the Wrong Thing™ and won't now seek to do better in future. If we're lucky they'll go out of business, but that's the best we can hope for.
  • captainju 9y ago
    Same here, orange (FR)
• veidr 9y ago
  Just curious: can somebody shed light on how they got the 1.1.1.1 IP address?
  • tomputer 9y ago
    It is explained on the bottom of the page: Who’s behind this? 1.1.1.1 is a partnership between Cloudflare and APNIC. Cloudflare runs one of the world’s largest, fastest networks. APNIC is a non-profit organization managing IP address allocation for the Asia Pacific and Oceania regions. Cloudflare had the network. APNIC had the IP address (1.1.1.1). Both of us were motivated by a mission to help build a better Internet. You can read more about each organization’s motivations on our respective posts: Cloudflare Blog / APNIC Blog.
  • bvm 9y ago
    http://packetlife.net/blog/2010/feb/5/ripe-plays-with-1-0-0-0-network-apnic-allocation/ http://packetlife.net/blog/2010/feb/5/ripe-plays-with-1-0-0-...
  • vidyesh 9y ago
    APNIC's research group held the IP addresses 1.1.1.1 and 1.0.0.1. While the addresses were valid, so many people had entered them into various random systems that they were continuously overwhelmed by a flood of garbage traffic. APNIC wanted to study this garbage traffic but any time they'd tried to announce the IPs, the flood would overwhelm any conventional network. We talked to the APNIC team about how we wanted to create a privacy-first, extremely fast DNS system. They thought it was a laudable goal. We offered Cloudflare's network to receive and study the garbage traffic in exchange for being able to offer a DNS resolver on the memorable IPs. And, with that, 1.1.1.1 was born https://blog.cloudflare.com/announcing-1111/ https://blog.cloudflare.com/announcing-1111/
    • dang 9y ago
      Thanks. Since https://1.1.1.1/ https://1.1.1.1/ was posted the other day (https://news.ycombinator.com/item?id=16716606 https://news.ycombinator.com/item?id=16716606), we've changed the URL above to that blog post.
• mediaserf 9y ago
  Does anyone know if it caches beyond the specified TTL like some services do? One of the things I love about Google's is that it honors TTL.
• antoncohen 9y ago
  When I've seen DNS-over-HTTPS in the past I've always thought it odd that it's setup with a DNS name for the HTTPS address, requiring a plain DNS lookup before it starts using HTTPS. I assumed this was done because they didn't have a valid TLS cert for the IP address. But 1.1.1.1 actually has a valid TLS cert, yet their setup instructions say to use the DNS name cloudflare-dns.com instead of the IP. https://developers.cloudflare.com/1.1.1.1/dns-over-https/ https://developers.cloudflare.com/1.1.1.1/dns-over-https/ Is there a technical reason the DNS-over-HTTPS resolvers need their upstream resolvers to be looked up by name and not IP?
  • Someone1234 9y ago
    I suppose I see your point, but since DNS-over-HTTPS only supports HTTPS (not HTTP) and therefore requires a valid certificate for the requested resolver, there's no risk of the protocol being downgraded to HTTP or easily spoofed. So what do you see as the threat profile?
    • antoncohen 9y ago
      That is a good point, though I wasn't thinking about it from a security perspective. I was more imagining an ISP or nation that is trying to control content by blocking/faking DNS queries. They could block the first DNS query if DNS-over-HTTPS doesn't use an IP for the resolver. Of course an ISP or nation could block/reroute the IP 1.1.1.1 too, so maybe it doesn't matter. Neither way would allow MITM, I was just thinking about ways oppressive ISPs/nations could stop DNS-over-HTTPS from working.
      • zackbloom 9y ago
        You can also query 1.1.1.1 using the DNS-over-HTTPS URL schema if you like, you don't have to use cloudflare-dns.com.
• unicornporn 9y ago
  9.9.9.9 https://quad9.net https://quad9.net has been serving me well.
• deleted 9y ago
  [deleted]
• rdsubhas 9y ago
  > We will never sell your data or use it to target ads. Period. Won't sell != Won't collect > We will never log your IP address (the way other companies identify you) Never log IP != Never log anything Bonus: The way other companies identify you ~= There are other ways Edit: Looks like many people assume I'm nitpicking. So here are more specific questions: * Is logging a hashcode of the IP considered as "not logging the IP"? * Can combination of timestamp, packet info other than end IP (latency, hops, etc), geoIP and other factors be used for deep intelligence?
  • kentonv 9y ago
    Some more details can be found here: https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
  • fwgwgwgch 9y ago
    AFAIK the only data is domain name, record and the incoming ip. I don't care if they store the first two. Do you have any actual points against or are you just trying to nitpick? And do you have anything better?
    • nathanaldensr 9y ago
      Unfortunately, nitpicking is quite necessary. Haven't we seen enough instances of corporations lying through omission? Where is the trend that indicates we should give a more favorable, trustworthy reading to terms and promises like these? I don't see it. Cloudflare is a for-profit corporation--you know, "duty to shareholders" and all that. We must assume, almost by definition, that they actually have their own self-interests at heart.
    • rdsubhas 9y ago
      Fair point and (maybe) you are right, I am nitpicking but not ashamed to do so. Could have been stronger to say "We won't store your data" rather than "We won't sell your data". And frankly, "we will never log your IP address (the way other companies identify you)", like really? Talking very naively, what if they just store a hashcode or some other derivative of the IP instead, is that counted as logging the IP? And what about the timestamp, geoIP, reverse hostname and other factors, can deep intelligence be used to associate with other behavior?
• contingencies 9y ago
  From Shenzhen, China 1.1.1.1/1.0.0.1 rtt min/avg/max/mdev = 198.036/199.739/202.978/2.319 ms 8.8.8.8/8.8.4.4 rtt min/avg/max/mdev = 12.798/13.681/14.408/0.673 ms 114.114.114.114/114.114.115.115 rtt min/avg/max/mdev = 15.508/25.381/38.815/9.842 ms
  • larrysalibra 9y ago
    Not surprising: Google despite being blocked in China a lot of presumably expensive paid transit from the big 3 mainland china telcos in and out of the mainland to Hong Kong. Cloudflare serves sites visited from China that aren't using their China-requires-an-ICP-license service from their west coast USA location where the big 3 Chinese telcos will peer for free.
    • nik736 9y ago
      Peer for free? Anything to back that up because I doubt that highly? Maybe DTAG and UPC will peer for free in mighty LA as well. /s
      • jlgaddis 9y ago
        PeeringDB seems to indicate as much.
        • nik736 9y ago
          https://www.peeringdb.com/net/308 https://www.peeringdb.com/net/308 I don't see any free peering?
  • rankun203 9y ago
    True...
• 0x0 9y ago
  I'm curious to read the reports from the garbage traffic they get at their 1.x.x.x addresses. Must be a ton of computers sending traffic that way. On the other hand, there's probably quite a few networks where 1.x.x.x is unreachable or routed to a local captive network access server, too.
• DyslexicAtheist 9y ago
  TIL you can also use 1.1 and it will expand to 1.0.0.1 $> ping 1.1 PING 1.1 (1.0.0.1) 56(84) bytes of data. 64 bytes from 1.0.0.1: icmp_seq=1 ttl=55 time=28.3 ms 64 bytes from 1.0.0.1: icmp_seq=2 ttl=55 time=33.0 ms 64 bytes from 1.0.0.1: icmp_seq=3 ttl=55 time=43.6 ms 64 bytes from 1.0.0.1: icmp_seq=4 ttl=55 time=41.7 ms 64 bytes from 1.0.0.1: icmp_seq=5 ttl=55 time=56.5 ms 64 bytes from 1.0.0.1: icmp_seq=6 ttl=55 time=38.4 ms 64 bytes from 1.0.0.1: icmp_seq=7 ttl=55 time=34.8 ms 64 bytes from 1.0.0.1: icmp_seq=8 ttl=55 time=45.7 ms 64 bytes from 1.0.0.1: icmp_seq=9 ttl=55 time=45.2 ms 64 bytes from 1.0.0.1: icmp_seq=10 ttl=55 time=43.1 ms
  • tux3 9y ago
    You can also use the decimal value of the IP, without the dots: https://16843009 https://16843009
    • chisleu 9y ago
      You can also sing that number to the tune of the famous 8675309 song with very little robato.
      • chisleu 9y ago
        If you want to memorize the integer, it's not a bad mechanic to use... Why do you hate me?
      • finnh 9y ago
        I just upvoted you, bc (a) funny and (b) TIL a new word (rubato).
    • discreditable 9y ago
      Hex works too: https://0x1010101 https://0x1010101
      • notamy 9y ago
        Sadly, binary / octal don't work: https://0b1000000010000000100000001 https://0b1000000010000000100000001 / https://0o100200401 https://0o100200401
• dorfsmay 9y ago
  What about ipv6? There were rumours that they were getting 2001:2001:: and 2001:2001:2001::, but I can neither ping those addresses not use them to resolve.
  • ancarda 9y ago
    https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/ https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1... 2606:4700:4700::1111 2606:4700:4700::1001 Not as memorable, unfortunately.
    • wila 9y ago
      2606:4700:4700::1111 You could make it slightly more memorable by decoding from hex to ascii, but that does not help too much either in this case: & ACK:G NUL: G NUL::1111
      • visitante 9y ago
        .
• DyslexicAtheist 9y ago
  so is a DHCP server address of 1.1.1.1 still perfectly valid for wireless local area networks? see: http://www.revolutionwifi.net/revolutionwifi/2011/03/explaining-dhcp-server-1111.html http://www.revolutionwifi.net/revolutionwifi/2011/03/explain...
  • detaro 9y ago
    As that article mentions, it wasn't "perfectly valid" even back then, it just didn't hurt. If I understand the specific implementation mentioned there correctly, it'll still work if the interception is done right (only catching DHCP and redirecting it to where it should go, leaving everything else untouched)
  • ge0rg 9y ago
    It never was perfectly valid. That blog post is incorrect, and network engineers are perfectly fine arguing against that practice. The IP address 1.1.1.1 was reserved by APNIC and now belongs to the APNIC and Cloudflare research project. Assigning an IP address you don't own on a local network usually means that you cut off access to the actual owner of that address. You might not (immediately) notice it because you don't need to access anything that's located there. But it will set you up for unpleasant surprises in the future when your users (or yourself) want to access a resource that happens to be located there. RFC 1918 <https://tools.ietf.org/html/rfc1918> https://tools.ietf.org/html/rfc1918> provides explicit IP ranges you should use for private resources (10.x.x.x, ~172.16.x.x, 192.168.x.x), which are not routed over the Internet and where your organization is responsible to avoid IP address conflicts.
• tscs37 9y ago
  I'm probably gonna switch my PiHole over from Google DNS. I trust Cloudflare more than Google to uphold my privacy. Not that I trust either very much. Benchmarking Results for the interested: (sorted worst first, P value is bottom-X-percent) 1.1.1.1: P00.5=48.2ms (55.8ms VPN) P50.0=32.8ms (37.0ms VPN) P95.0=29.1ms (33.0ms VPN) P99.5=29.1ms (32.7ms VPN) 8.8.8.8: P00.5=225.4ms (71.5ms VPN) P50.0=48.0ms (53.6ms VPN) P95.0=44.1ms (51.3ms VPN) P99.5=43.8ms (50.7ms VPN) I've noticed I measured with my VPN on, so I put the VPN measurements in brackets behind the nominal values. The 8.8.8.8 benchmark is a bit odd but I repeated it several times with 100 iterations each and this is basically what I get.
  • Faaak 9y ago
    Why isn't your pihole a stand-alone DNS resolver instead on relying on 3rd-party services ?
    • tscs37 9y ago
      I'm not aware of any pihole native setting to enable a resolver instead of using forwarding. Third-party services like this will also have a huge range of queries cached so the response time will definitely be better than have a rasppi with little free memory try/attempt to cache that.
  • sgc 9y ago
    Where are you located? I am in the rural north Bay Area California and my numbers are shocking: Ping statistics for 1.1.1.1: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 1ms, Maximum = 2ms, Average = 1ms Ping statistics for 8.8.8.8: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 25ms, Maximum = 27ms, Average = 26ms Ping statistics for 8.8.4.4: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 26ms, Maximum = 28ms, Average = 27ms
    • tscs37 9y ago
• bluejekyll 9y ago
  DNS-over-HTTPS doesn’t make as much sense to me as DNS-over-TLS. They are effectively the same thing, but HTTPS has the added overhead of the HTTP headers per request. If you look at the currently in progress RFC, https://tools.ietf.org/html/draft-ietf-doh-dns-over-https-04 https://tools.ietf.org/html/draft-ietf-doh-dns-over-https-04, this is quite literally the only difference. The DNS request is encoded as a standard serialized DNS packet. The article mentions QUIC as being something that might make HTTPS faster than standard TLS. I guess over time DNS servers can start encoding HTTPS requests into JSON, like google’s impl, though there is no spec that I’ve seen yet that actually defines that format. Can someone explain what the excitement around DNS-over-HTTPS is all about, and why DNS-over-TLS isn’t enough? EDIT: I should mention that I started implementing this in trust-dns, but after reading the spec became less enthusiastic about it and more interested in finalizing my DNS-over-TLS support in the trust-dns-resolver. The client and server already support TLS, I couldn't bring myself to raise the priority enough to actually complete the HTTPS impl (granted it's not a lot of work, but still, the tests etc, take time).
  • tzahola 9y ago
    >The article mentions QUIC as being something that might make HTTPS faster than standard TLS. Even with TLS 1.3 0-RTT?
    • bluejekyll 9y ago
      exactly...
    • patrickmcmanus 9y ago
      yes, quic will make dns over https more resillient to packet loss than a tls based approach.
  • patrickmcmanus 9y ago
    rfc 8336. h2 coalescing. h2 push. caching. it starts to add up to a very interesting story.
    • 9y ago
• koolba 9y ago
  > We committed to never writing the querying IP addresses to disk and wiping all logs within 24 hours. > Cloudflare's business has never been built around tracking users or selling advertising. We don't see personal data as an asset; we see it as a toxic asset. While we need some logging to prevent abuse and debug issues, we couldn't imagine any situation where we'd need that information longer than 24 hours. How about aggregate stats? Will CloudFlare be keeping track of any long term usage statistics per domain? I'm not talking about tracking the person making the request. I'm referring to tracking the hostnames that are being resolved. Given the near 1:1 mapping between user's accessing a website and DNS resolution for that website[1], wide scale usage of something like this gives decent analytics on net usage of any website even if it's not served by CloudFlare. [1]: Assuming the DNS response cache times are low enough that a new user session to a website would require a fresh DNS request to resolve the website's IP.
• quantumofmalice 9y ago
  Will they allow sites with unpopular but legal content, like The Daily Stormer, to resolve? Or will this DNS service, like their DDoS service, be at the whim of their CEO?
• nk1tz 9y ago
  Montreal => 8.8.8.8 : round-trip min/avg/max/stddev = 35.781/38.241/46.959/2.635 ms 1.1.1.1 : round-trip min/avg/max/stddev = 12.090/14.492/23.095/1.909 ms
• ebikelaw 9y ago
  There’s more to dns performance than query time. Cloudflare doesn’t seem to be sending the EDNS client subnet to authoritative resolvers, which means those resolvers can’t give sensible nearest-to-client responses. This is a crucial feature of what makes the modern web fast.
  • tssva 9y ago
    It would be hard to claim to be a dns service which helps protect your privacy while also forwarding your subnet info on to other DNS servers. Cloudflare has a large number of PoPs and are increasing them rapidly. If the service is distributed to them all than the authoritative server is likely to give a response that is similar to that it would have provided if the subnet had been explicitly provided since the Cloudflare PoP sending the request will be located network wise close to the client that originally made the request. This isn't always going to be true but the slightly higher odds that you will not connect to the optimal location for the service you are connecting to is probably worth the increase in privacy.
    • ebikelaw 9y ago
      What exactly is the privacy threat model in this situation? If you are about to connect to the resolved service it makes no difference that you hid your subnet from that service’s DNS server.
      • jvolkman 9y ago
        What if a client blackholes all traffic to some network due to some privacy-related reason? If cloudflare tells that provider (via name resolution) who's resolving names, some of that client's PII is possibly shared before the blackhole decision can even be made.
        • ebikelaw 9y ago
          That seems a bit contrived but just rolling with it, this hypothetical org with ultra-sensitive opsec should have also blacklisted the domain in question at their inside resolver.
• JD557 9y ago
  I wish that they talked a bit more about their stance regarding censorship. They have a small paragraph talking about the problem, but they don't talk about the "solution". While Cloudflare has been pretty neutral about censoring sites in the past (notably, pirate sites), the Daily Stormer incident put them in a though spot[1]. They talk a bit about Project Galileo (the link is broken BTW, it should be https://www.cloudflare.com/galileo https://www.cloudflare.com/galileo), but their examples do not mention topics that would be controversial in western societies, and the site is quite vague. Would they also protect sites like sci-hub, for example? While I would rather use a DNS not owned by Google, I have never seen any site blocked by them, including sites with a nation-wide block. I hope that Cloudflare is able to do the same thing. 1: https://torrentfreak.com/cloudflare-doesnt-want-daily-stormer-evidence-at-piracy-trial-180327/ https://torrentfreak.com/cloudflare-doesnt-want-daily-storme...
  • zackbloom 9y ago
    The Galileo link works for me. It's worth pointing out Google at the very least censors as easily as Cloudflare [1]. My understanding of Cloudflare's policies though are with the exception of exceptionally objectionable content, Cloudflare only takes sites down in response to a court order. I don't know if it has been established that DNS is something which operators have a proactive obligation to censor, but I imagine it's the kind of thing Cloudflare would go to court over. 1- https://www.vox.com/policy-and-politics/2017/8/14/16143820/godaddy-and-google-wont-host-daily-stormer-domain https://www.vox.com/policy-and-politics/2017/8/14/16143820/g...
  • deleted 9y ago
    [deleted]
  • ocdtrekkie 9y ago
    Bear in mind, they dropped Daily Stormer because they were claiming Cloudflare agreed with their ideology. Which someone in the previous discussion pointed out was a Terms of Service violation. DNS resolving offers no such terms and no such reason to make such a claim. I don't see that playing here. And bear in mind, when the CEO did it, he wrote about how dangerous it was that companies had that power. I don't feel other companies running other DNS services hold that level of concern or awareness. When you consider that their "competitor" in the space of free DNS resolvers with easy-to-remember IPs is Google, who recently tried blocking the word "gun" in Google Shopping... it's hard not to see the introduction of a Cloudflare DNS resolver as at least a net positive for resisting censorship. And more options is almost always better.
• pvsukale3 9y ago
  I am not a pro computer Networks. Quick Question: Can an ISP block DNS Queries or packets to a specific IP address.
  • DesertBattery 9y ago
    ISP can do anything with you DNS traffic. That's why Cloudflare DNS support DNS-over-TLS.
  • SSLy 9y ago
    Yup, of course they can.
  • joshbaptiste 9y ago
    yes of course.. common in totalitarian countries
• switch007 9y ago
  Timeouts when connected to Private Internet Access. Not surprised at all! (I don't use PIA's DNS because they return IPs for popular sites that are different to my ISP/Google that cause issues, for some reason.)
• peterhadlaw 9y ago
  I wish I was joking but is Cloudflare going to just decide one day to stop resolving domains based on any morning whims of management?
• gok 9y ago
  Does it work well with (non-CloudFlare) CDNs or is this another DNS service that won’t work with Netflix on a Friday night because it routes everyone to a single edge mode?
• lepouet 9y ago
  My FAI, Orange in France, seems to block/redirect acces to https://1.1.1.1 https://1.1.1.1 , i see great irony here. Chrome security warning when i try to access it, ping <1ms when ping ip adress.
  • halbritt 9y ago
    It's very likely that they have 1.1.1.1 in their "bogons" list and have for a very long time. Bogons are a list of prefixes that most ISPs blackhole as there is usually never any legitimate traffic bound for those destinations. RFC1918 addresses, for example. I can't reach 1.1.1.1 either, but 1.0.0.1 works fine. Maybe try that.
    • plb4333 9y ago
      Could it be that 1.1.1.1 is blocked because it uses a secure protocol as opposed to 1.0.0.1 which is unsecure. This would be for the sake of monitoring traffic.
  • __david__ 9y ago
    My AT&T fiber is blocking 1.1.1.1, too. But 1.0.0.1 is working.
    • jmuguy 9y ago
      Same, ATT Fiber in Charlotte NC
      • jlgaddis 9y ago
        Which AT&T modem do you have? I'm seeing this w/ 5268AC, trying to find others that are affected as well.
        • jlgaddis 9y ago
          If it's not the 5268AC, please let marty at cloudflare dot com know as well. According to a reply on NANOG, he is interested in knowing about other broken CPE.
• akerro 9y ago
  Privacy-first from cloudflare? Wasn't cloudflare founded by ex-NSA employee and heavily funded by NSA when it started?
  • kentonv 9y ago
    No. Where did you get that from?
• stadeschuldt 9y ago
  A couple of years ago there was a tool built by some Google employee called namebench which benchmarked a couple of DNS servers and helped you to find the best one based on your browser history. Unfortunately, the project seems abandoned: https://github.com/google/namebench https://github.com/google/namebench I remember being in France it was huge speedup over the providers default DNS.
• abhiminator 9y ago
  This is super exciting -- Public DNS space frankly needs more entrants. I've been a long time user of OpenDNS's public DNS service (and have come to adore it greatly). Other recent new entrant to this space worth mentioning includes Global Cyber Alliance's [0] Quad9 DNS service, launched in Q4 2017. This to me looks like a good move by Cloudflare, business model wise, given the increasing awareness among general public to the dangers of privacy breaches -- aside from the supposed boost in network speed piggybacking off of Cloudflare's extensive server farm network [1]. Whether the service delivers on it's bold claims, however, is to be seen. I'm going to go give this a shot now. [0] https://www.globalcyberalliance.org/initiatives/quad9.html https://www.globalcyberalliance.org/initiatives/quad9.html [1] https://www.cloudflare.com/network/ https://www.cloudflare.com/network/
• booomagnolia 9y ago
  DNS needs to be moved to a blockchain system yesterday. After currency, it's close to being the second killer app for blockchain. Anything else, as in anything centralized, will be vulnerable to random state actor censorship, be they China, the Google, USG, Turkey or any other deplorables and is therefore broken. Namecoin was an early attempt at that (almost as old as bitcoin), but it came in too early. Time to restart that train.
• JackNichelson 9y ago
  Privacy and cloudflare on the same sentence? Bwahahhahahahahaa Shills
• deleted 9y ago
  [deleted]
• slowsun 9y ago
  > What many Internet users don't realize is that even if you're visiting a website that is encrypted — has the little green lock in your browser — that doesn't keep your DNS resolver from knowing the identity of all the sites you visit. That means, by default, your ISP, every wifi network you've connected to, and your mobile network provider have a list of every site you've visited while using them. > Network operators have been licking their chops for some time over the idea of taking their users' browsing data and finding a way to monetize it. The "1.1.1.1 stops ISPs/Starbucks from selling your browsing history" pitch is untrue and, given Cloudflare's expertise, seems disingenuous. HTTPS transmits domains unencrypted in request headers, to support SNI. So even if DNS lookups are completely hidden, my ISP can still log all domains I visit by inspecting my HTTP(S) requests. And the domain log from my web requests is more valuable than my DNS log. Advertisers and data aggregators can see the true timing and frequency of my browsing history, whereas a DNS log is affected by router/OS/browser lookup caching.
  • QasimK 9y ago
    It’s a step in the right direction. Also is TLS1.3. not supposed to encrypt SNI?
    • slowsun 9y ago
      I agree that a non-Google public resolver, which comes with guarantees about how they'll use your data, is a good thing. I'm taking exception with Cloudflare's announcement, which makes a pitch to end users that CF can protect your domain history from ISP snooping, then links to a two-minute setup guide for people with "no technical skill". They really can't protect your domain history, and I feel bad for people using this service who have been led to believe otherwise. AFAIK there is nothing in the TLS 1.3 draft [1] about SNI encryption. There are other draft proposals for SNI encryption that build on top of TLS 1.3 [2]. It's a hard problem and there are no deployed solutions I'm aware of. [1] https://tools.ietf.org/html/draft-ietf-tls-tls13-28 https://tools.ietf.org/html/draft-ietf-tls-tls13-28 [2] https://tools.ietf.org/html/draft-ietf-tls-sni-encryption-00 https://tools.ietf.org/html/draft-ietf-tls-sni-encryption-00
    • djsumdog 9y ago
• mastax 9y ago
  If you want to figure out what the fastest DNS server is for you, I suggest this freeware utility https://www.grc.com/dns/benchmark.htm https://www.grc.com/dns/benchmark.htm
  • s3nnyy 9y ago
    Is there a thing like this for macOS?
    • telesilla 9y ago
      Namebench hasn't been updated since 2010, but I just checked and it's running fine on my Sierra box. https://code.google.com/archive/p/namebench/downloads https://code.google.com/archive/p/namebench/downloads
      • indigodaddy 9y ago
        The browser doesn't open after the operation/queries finish for me on High Sierra
        • telesilla 9y ago
          It should still save the results, check your console and open the .html file > Saving detailed results to /var/folders/j8/vd7q07z7r_5wt0s2mq00vgn/T/namebench_2018-04-01_1856.csv > default 18:56:37.001803 +0200 namebench Opening /var/folders/j8/vd7q07z7r_5wt0s2mq00vgn/T/namebench_2018-04-01_1856.html
    • teeray 9y ago
      This will run fine under Wine on macOS. Steve has said many times on the SN podcast that he tests under Wine to ensure compatibility.
      • teeray 9y ago
        To the downvoters: perhaps a source will placate you: https://www.grc.com/sn/sn-641.htm https://www.grc.com/sn/sn-641.htm (search for WINE). I apologize for providing facts that might help someone that wants to run this.
• hennsen 9y ago
  Seems to be either blocked in Germany for T-Mobile LTE networks or built on a not so stable architecture...
• anotheryou 9y ago
  It's april 1st, but I don't get the joke here...
• vinniejames 9y ago
  How does this service, with DNS-over-HTTPS or DNS-over-TLS, compare to something like DNS Crypt? https://www.opendns.com/about/innovations/dnscrypt/ https://www.opendns.com/about/innovations/dnscrypt/
  • jedisct1 9y ago
    https://dnscrypt.info/faq/ https://dnscrypt.info/faq/
    • vinniejames 9y ago
      I more curious from a practical perspective, the FAQ appers to cliam DNScrypt gives you most/all of what the others do, with easy setup. The caveat that a "good amount of servers support the protocol" isn't very clear, how many is a "good amount"? Does that hold true now? Unsupported servers appear to fall back to traditional DNS resolution, oer the diagram; is this not the case with the HTTP/TLS implementations?
• lenova 9y ago
  Is there a way to use Cloudflare's new DNS servers with Simple DNSCrypt? (https://simplednscrypt.org/ https://simplednscrypt.org/)
  • jedisct1 9y ago
    Yes, just select "Cloudflare" in the list. It's been available in the public list for quite some time already.
    • lenova 9y ago
      I see it on the list, but is it referring to the 1.1.1.1 server?
      • jedisct1 9y ago
        Yes, this is it.
• deleted 9y ago
  [deleted]
• rhabarba 9y ago
  I cannot trust a service provided by a company which implies that Tor users are mostly bad people. No, thanks.
  • zackbloom 9y ago
    Talking about the distribution of traffic over Tor is very different than the people who use it. Cloudflare built Privacy Pass with the specific intent of allowing people who use Tor to have a better experience: https://blog.cloudflare.com/cloudflare-supports-privacy-pass/ https://blog.cloudflare.com/cloudflare-supports-privacy-pass...
    • rhabarba 9y ago
      Artificially limiting the choice of browsers is not really something that should be honored. But I thank you for this insight - I did not know this link.
• scooter_de 9y ago
  Too bad this was announced on 1st of April.
  • jason_slack 9y ago
    They state why they picked April 1, aka 4/1: From the article: The only question that remained was when to launch the new service? This is the first consumer product Cloudflare has ever launched, so we wanted to reach a wider audience. At the same time, we're geeks at heart. 1.1.1.1 has 4 1s. So it seemed clear that 4/1 (April 1st) was the date we needed to launch it.
• Scramblejams 9y ago
  Anybody got a howto to get dnsmasq to makes its requests over https or tls?
  • jedisct1 9y ago
    You need dnscrypt-proxy for this.
• dpweb 9y ago
  Change DNS in Win10: Control Panel - Network and Internet - Network Connections - <adapter> (right click) - Properties - Internet Protocol Version 4 (double click)
• anjbe 9y ago
  Lately I’ve been thinking about some concerns about domain name privacy: • My ISP can spoof DNS responses. • My ISP can sniff DNS requests. • My ISP can sniff SNI. • My ISP can look up reverse DNS on the IPs I visit. DNS over TLS is nice—I just set up Unbound on my router to use 1.1.1.1@853 and 1.0.0.1@853 as forwarding zones. That eliminates the first bullet, at the cost of allowing CloudFlare to track my DNS requests. I wonder how easy it is to route DNS‐over‐TLS over Tor?
  • deeebug 9y ago
    What’s your threat model? The latency you’re going to introduce with TOR will make everyday browsing slow
    • anjbe 9y ago
      It’s not like I’d be running everything over Tor. DNS requests for newly‐visited domains would slow down, but unbound’s prefetch feature would keep popular frequently‐used domains cached. Adding one of those advertising domain blacklists might help performance too. The point would be to keep Cloudflare from being able to track my DNS requests.
      • cmstoken 9y ago
        Why not use a VPN like PIA?
        • jerheinze 9y ago
          > Why not use a VPN like PIA? A VPN gives you little protection against browser fingerprinting, which may alone leak enough information about you to identify you. Also privacy-by-policy is in no way near privacy-by-design. If you want privacy, use the Tor Browser.
          • plb4333 9y ago
            What a bunch of false security you're providing. NSA had broken the TOR traffic quite a while back. Worthless.
• 7ewis 9y ago
  Not April Fools? This is cool.
• mindcrash 9y ago
  Sorry, but the only DNS resolver which can really claim to be "privacy first" and can be completely trusted is the one built with opensource code running on your own system. So a VPS with enough storage plus Unbound and you're pretty much done in regards to "privacy first" and "trust".
  • mindcrash 9y ago
    To whoever who downvoted this comment, thanks for proving my point.
• cleanbrowsing 9y ago
  And look at these ping times: CloudFlare Google DNS Quad9 OpenDNS NewYork 2 msec 1 msec 2 msec 19 msec Toronto 2 msec 28 msec 17 msec 27 msec Atlanta 1 msec 2 msec 1 msec 19 msec Dallas 1 msec 9 msec 1 msec 7 msec San Francisco 3 msec 21 msec 15 msec 20 msec London 1 msec 12 msec 1 msec 14 msec Amsterdam 2 msec 6 msec 1 msec 6 msec Frankfurt 1 msec 9 msec 2 msec 9 msec Tokyo 2 msec 2 msec 81 msec 77 msec Singapore 2 msec 2 msec 1 msec 189 msec Sydney 1 msec 130 msec 1 msec 165 msec Very impressive CloudFlare.
  • fipple 9y ago
    How is this possible from a single location? The speed of light in a vacuum is ~200 miles per millisecond.
    • aftbit 9y ago
      Despite using a single IP, this is not served from a single location. Check out Anycast, wikipedia: https://en.wikipedia.org/wiki/Anycast https://en.wikipedia.org/wiki/Anycast
      • tialaramex 9y ago
        Yup, anycast, this is also why: The "backup" IPv4 address is 1.0.0.1 rather than, say, 1.1.1.2, and why they needed APNIC's help to make this work In theory you can tell other network providers "Hi, we want you to route this single special address 1.1.1.1 to us" and that would work. But in practice most of them have a rule which says "The smallest routes we care about are a /24" and 1.1.1.1 on its own is a /32. So what gets done about that is you need to route the entire /24 to make this work, and although you can put other services in that /24 if you _really_ want, they will all get routed together, including failover routing and other practices. So, it's usually best to "waste" an entire /24 on a single anycast service. Anycast is not exactly a cheap homebrew thing, so a /24 isn't _that_ much to use up.
• ocdtrekkie 9y ago
  So, one thing I'd love to see clarified: APNIC was interested in studying the junk traffic to 1.1.1.1. Cloudflare's DNS will not log or track. So what is logged and tracked for APNIC's research purposes? Everything but DNS? Everything but DNS and HTTPS requests directly to 1.1.1.1 (presumably people looking for details on Cloudflare DNS?). What's being studied? Fun fact: CCNA classes regularly use 1.1.1.1 as a router-id. Really good reason now not to configure it via a loopback address.
  • ENOTTY 9y ago
    Really hoping this question gets answered. It seemed contradictory to me.
    • ocdtrekkie 9y ago
      My strong impression is that they wouldn't give APNIC any data that can be used to identify users of their DNS service, but I'd definitely love a more detailed answer than what the site currently provides.
      • xuande 9y ago
        Found this: https://labs.apnic.net/?p=1127 https://labs.apnic.net/?p=1127
        • ENOTTY 9y ago
          An excellent find! > We will be destroying all “raw” DNS data as soon as we have performed statistical analysis on the data flow. We will not be compiling any form of profiles of activity that could be used to identify individuals, and we will ensure that any retained processed data is sufficiently generic that it will not be susceptible to efforts to reconstruct individual profiles. Furthermore, the access to the primary data feed will be strictly limited to the researchers in APNIC Labs, and we will naturally abide by APNIC’s non-disclosure policies. So it's a 5 year research program, with options to extend it as a research program. To me, that means they intend to keep DNS data for up to 5 years (or longer) before performing statistical analysis and processing on it. Here is APNIC Labs's privacy policy http://labs.apnic.net/privacy.shtml http://labs.apnic.net/privacy.shtml and APNIC's privacy policy https://www.apnic.net/about-apnic/corporate-documents/documents/corporate/privacy/#2.4 https://www.apnic.net/about-apnic/corporate-documents/docume... So much for "privacy-first".
• chiefalchemist 9y ago
  Three novice questions, please: 1) A VPN gives you privacy but this prevents your ISP from even knowing you're using a VPN, correct? 2) This is a change you make to your wifi router, correct? 3) What is you're not on wifi, or you're using public wifi, is it possible to still benefit from this? Thanks in advance. I'll wait for my answers off the air :)
  • lallysingh 9y ago
    1) These requests are all in the clear, so your isp can read them and see which hosts you're asking for. VPNs provide better privacy (assuming you choose a private one). 2) yup 3) often. You can set it on your computer, but some public WiFi systems will block it.
    • tonyztan 9y ago
      To add to #1, your ISP can also see that you're using OpenVPN or another VPN protocol.
• z3t4 9y ago
  Hopefully it will try secondary DNS if main is down, which Google DNS does not.
• quotemstr 9y ago
  But will it report your DNS lookups to the authorities if Cloudflare's CEO wakes up one morning and decides he doesn't like you? Sorry, but I don't trust Cloudflare with anything anymore.
  • eganist 9y ago
    This is addressed with commitments and third party audits assuring 24h retention for IP logs. There are other conversations in this thread surrounding the viability of those audits, but that's somewhat of a tangential debate. This doesn't answer whether or not cloudflare will be able to protect against someone intercepting their traffic and recording dns lookups independently, but that's a problem for any dns provider.
  • lopmotr 9y ago
    Especially since they advertise being actively involved in certain political movements and promise to defend those ones. That's a scarily biased attitude for a DNS. How does someone's sexuality have anything to do with IP address lookups?
• christogreeff 9y ago
  Cape Town, South Africa My ISP Pinging 168.210.2.2 with 32 bytes of data: Reply from 168.210.2.2: bytes=32 time=1ms TTL=58 Reply from 168.210.2.2: bytes=32 time=1ms TTL=58 Reply from 168.210.2.2: bytes=32 time=1ms TTL=58 Reply from 168.210.2.2: bytes=32 time=1ms TTL=58 Google Pinging 8.8.8.8 with 32 bytes of data: Reply from 8.8.8.8: bytes=32 time=18ms TTL=54 Reply from 8.8.8.8: bytes=32 time=18ms TTL=54 Reply from 8.8.8.8: bytes=32 time=18ms TTL=54 Reply from 8.8.8.8: bytes=32 time=18ms TTL=54 CloudFlare Pinging 1.1.1.1 with 32 bytes of data: Reply from 1.1.1.1: bytes=32 time=22ms TTL=246 Reply from 1.1.1.1: bytes=32 time=22ms TTL=246 Reply from 1.1.1.1: bytes=32 time=22ms TTL=246 Reply from 1.1.1.1: bytes=32 time=21ms TTL=246
• cmurf 9y ago
  A big PITA for me right now with friends and family is changing DNS. They all have these Xfinity cable modem boxes that have integrated WiFi and Ethernet. It's not possible to change the DNS through the web interface. So I have to convince everyone to buy a separate AP or a 3rd party (but ISP approved) cable modem, and then what ensues is I'm now responsible for that device because Xfinity washes their hands entirely if there are any problems. It's also a PITA to change this on each device.
  • RKearney 9y ago
    I'm not sure which modem you have, but the Cisco modem I used to use with the built-in WiFi just as you describe absolutely has the ability to go in and edit the DNS servers assigned by DHCP under Connection > Local IP Network. I also have the remote access enabled for my family members so I can diagnose and make changes like this directly on their modem.
    • cmurf 9y ago
      ARRIS Group, Inc. TG1682G less than a year old. This is what everyone has in Denver, as far as I'm aware. Most of the devices settings aren't managable by its own web interface, I have to go to xfinity.com/myxfi and login to the account, and then it pushes changes to the cable modem/AP. This includes the login password for the device's web interface. Thoroughly screwy in my opinion. Anyway, there is a Connection > Local IP Network. But no DNS settings anywhere.
• RKearney 9y ago
  How was Cloudflare able to get a wildcard certificate with IP Address SANs added to it? How do I obtain one from DigiCert because I don't see the option on their site.
  • prdonahue 9y ago
    Fun fact: they had never issued an IPv6 SAN before (which Safari fails to validate due to a bug). Try browsing to https://[2606:4700:4700::1111] https://[2606:4700:4700::1111] with desktop Safari. (It's a known issue and we're working with Apple to get it fixed.)
    • RKearney 9y ago
      I understand that, and I've had to use the IPv6 address since Comcast is null routing 1.1.1.1 in my area, but that doesn't explain how a wildcard certificate was issued with IP addresses in the SAN. Am I able to buy one for my own website? If so, how? If not, why not? I couldn't even get past the DigiCert cert selection page since a wildcard cert can't have SANs, and a SAN cert can't contain a wildcard. The only thing I haven't tried yet is supplying my own CSR.
• tjgillies 9y ago
  Is there anything to worry about with these types of services? Why are they competing for free? Where is the hook?
• hartator 9y ago
  I would love using better DNS resolvers like this than crappy ISP provided ones. My only complain is when you connect to public wifi that requires to display some wifi capture page, acceptance of ToS, to sign in with your room number, airliner wifi, etc. Usually they break when you don't use their automated provided DNS servers. Requiring you to remove your preferred DNS entries, waiting for the wifi popup to open, do the required thing, and put back your preferred DNS servers. I end up just keeping the defaults, and that's a shame. Wish they were a good solution. Any tips?
  • adityapatadia 9y ago
    Put this DNS in your home router and not directly in your PC. Now your PC will fetch DNS at your home from this fast DNS and on pubic wifi, it will use theirs.
    • jads 9y ago
      Some ISPs and their routers don't allow for the DNS settings to be changed, unfortunately. Still can be worked around, but sometimes the easiest solution is to just edit the DNS settings directly.
• driverdan 9y ago
  Here's how to use it with DNS-over-HTTPS on OS X / MacOS: brew install dnscrypt-proxy Change line 25 in /usr/local/etc/dnscrypt-proxy.toml to server_names = ['cloudflare'] sudo brew services restart dnscrypt-proxy Then change your DNS server to 127.0.0.1 (run Network pref panel, unlock, Advanced, DNS)
  • jedisct1 9y ago
    And you can use this to control it from the menu bar: https://github.com/jedisct1/bitbar-dnscrypt-proxy-switcher/ https://github.com/jedisct1/bitbar-dnscrypt-proxy-switcher/
  • kim0 9y ago
    Thanks! That setup breaks everytime I'm behind a captive portal (hotel) .. any work around that except changing it manually and back?!
• adityapatadia 9y ago
  https://dns.watch/ https://dns.watch/ this is also good one. Proved to be better than Google for me.
• bedros 9y ago
  how would you setup https with DNS?
• deleted 9y ago
  [deleted]
• herodotus 9y ago
  This looks good, but I assume that any DNS request I make is still routed through my ISP. Therefore, I assume there is no way to stop my ISP from keeping a log of every URL I visit. Is that correct?
  • deleted 9y ago
    [deleted]
  • written 9y ago
    No, DNS only deals with domains, not the whole URLs.
  • _arvin 9y ago
    ISP will be aware of all traffic to your IP, but consider that most people have their DNS set to use their ISPs, meaning the ISP easily sees this information in logs. Some people use Google DNS or another provider to bypass the ISP's DNS, which is a step better. Now Cloudflare is providing a very fast and privacy-driven DNS, so to me this is a step up from others (Quad9, OpenDNS being formidable alternatives) Say you're on a public WIFI and don't want DNS queries from your machine, there's also DNS-over-HTTPS (which Cloudflare and a couple others support) which doesn't use the DNS protocol and would make a POST request to say, https://1.1.1.1/.well-known/dns-query https://1.1.1.1/.well-known/dns-query instead. Also with HTTPS, ISPs won't see the full URL, just that a secure connection was made to that domain.
• Justsignedup 9y ago
  Can China block them? I know blocking Google means no Google services but blocking cloudflare could mean blocking half the internet.
• jlgaddis 9y ago
  EDIT: Looks like this might be an issue w/ my AT&T-provided CPE, sorry! (more details at the bottom) From my vantage point, 1.1.1.1 is inaccessible, while 1.0.0.1 seems to work just fine. Comments on the blog post blame this on "various reasons" but, at least in my case, this seems to be a Cloudflare issue: $ ping -c 5 -q 1.0.0.1 PING 1.0.0.1 (1.0.0.1) 56(84) bytes of data. --- 1.0.0.1 ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4005ms rtt min/avg/max/mdev = 34.955/35.737/37.492/0.936 ms $ ping -c 5 -q 1.1.1.1 PING 1.1.1.1 (1.1.1.1) 56(84) bytes of data. --- 1.1.1.1 ping statistics --- 5 packets transmitted, 0 received, 100% packet loss, time 4102ms $ traceroute 1.0.0.1 traceroute to 1.0.0.1 (1.0.0.1), 30 hops max, 60 byte packets [...] 3 * * * 4 12.83.79.61 (12.83.79.61) 28.126 ms 28.663 ms 29.110 ms 5 cgcil403igs.ip.att.net (12.122.132.121) 35.854 ms 37.532 ms 37.510 ms 6 ae16.cr7-chi1.ip4.gtt.net (173.241.128.29) 33.997 ms 29.083 ms 29.647 ms 7 xe-0-0-0.cr1-det1.ip4.gtt.net (89.149.128.74) 37.758 ms 35.165 ms 36.620 ms 8 cloudflare-gw.cr0-det1.ip4.gtt.net (69.174.23.26) 36.946 ms 37.343 ms 38.574 ms 9 1dot1dot1dot1.cloudflare-dns.com (1.0.0.1) 38.385 ms 36.621 ms 37.157 ms $ traceroute 1.1.1.1 traceroute to 1.1.1.1 (1.1.1.1), 30 hops max, 60 byte packets [...] 3 * * * 4 12.83.79.61 (12.83.79.61) 30.388 ms 12.83.79.41 (12.83.79.41) 30.601 ms 31.280 ms 5 cgcil403igs.ip.att.net (12.122.132.121) 37.602 ms 37.873 ms 37.808 ms 6 ae16.cr7-chi1.ip4.gtt.net (173.241.128.29) 33.441 ms 29.788 ms 29.678 ms 7 xe-0-0-0.cr1-det1.ip4.gtt.net (89.149.128.74) 35.266 ms 35.124 ms 33.921 ms 8 cloudflare-gw.cr0-det1.ip4.gtt.net (69.174.23.26) 35.294 ms 35.949 ms 35.455 ms 9 * * * 10 * * * 11 * * * 12 *^C ---- EDIT: I have AT&T-provided CPE that I have to use due to 802.1X. If I log into the device (over HTTP) and use the built-in (web-based) diagnostics tools, I am able to successfully ping 1.1.1.1 from the device itself: ping successful: icmp seq:0, time=2.364 ms ping successful: icmp seq:1, time=1.085 ms ping successful: icmp seq:2, time=1.160 ms ping successful: icmp seq:3, time=1.245 ms ping successful: icmp seq:4, time=0.739 ms These RTTs are way too low, however. The RTT for a ping to the CPE's next-hop/default gateway comes in at, minimum, ~20 ms. When pinging 1.1.1.1 from my (pfSense-based) router sitting directly behind the modem, however, no replies come back from the modem to the router (confirmed via pcap on the upstream-facing interface). Thus, it looks like this is an issue with the AT&T CPE (5268AC).
  • pgrote 9y ago
• bogomipz 9y ago
  >"And we wanted to put our money where our mouth was, so we committed to retaining KPMG, the well-respected auditing firm, to audit our code and practices annually and publish a public report confirming we're doing what we said we would." It's worth pointing out that KPMG was Wells Fargo's independent auditor while the bank recently committed fraud on a massive scale by creating more than a million fake deposit accounts and 560,000 credit card applications for customers without their knowledge or approval.[1] Calling KPMG a "well-respected auditing firm" when they failed to detect over a million fake bank accounts is a joke. See: https://www.reuters.com/article/wells-fargo-kpmg/lawmakers-question-quality-of-kpmgs-wells-fargo-audits-idUSL1N1HX0XL https://www.reuters.com/article/wells-fargo-kpmg/lawmakers-q... [1] https://www.warren.senate.gov/files/documents/2016-10-27_Ltr_to_KPMG_re_Wells_Fargo_Audits_FINAL.pdf https://www.warren.senate.gov/files/documents/2016-10-27_Ltr...
  • thenewwazoo 9y ago
    Speaking as a former KPMG employee who did infosec, the financial audit and controls people are far removed from anyone with technical skill in this domain. It may be cold comfort, but these kinds of special purpose attestations may as well be done by a different company (insert BearingPoint joke here).
    • bogomipz 9y ago
      Right, that's why it's amusing to think we're supposed to believe that KPMG are going to audit a code base and logging infrastructure.
      • ismail 9y ago
        Agreed. Anecdotal but... We have had to supply information to KPMG “IT Auditors” at a client due to some software we wrote. In most cases the auditors are young grads who have never worked in an actual IT/software dev team. So they have very naive view and never ask the right questions. If one wanted to hide something it would be super easy.
• brightball 9y ago
  I still find myself wondering about things like the iphones DNS service though. You can’t change it while connected to a cell network and it always seemed strange to me that was considered okay.
  • LeoPanthera 9y ago
    You can change the iPhone DNS servers by installing a profile. Apps like "DNS Override" (not a recommendation) will do it for you.
• jlgaddis 9y ago
  Is Cloudflare overriding TTLs on RRs? If I send a request to 1.0.0.1 for a specific RR that I'm 99.9% certain isn't cached (although I didn't check the query logs on the authoritative DNS servers to verify a request actually came in), the response contains the (expected) TTL of 14400. If I then send the same request to 1.1.1.1, I get a response that is identical except with a TTL of 3591 seconds. According to the timestamps in my client, the second request was made nine seconds after the first one (3591+9=3600), hence my question: is Cloudflare "overriding" the TTL I explicitly set on this specific RR (14400s) with a different TTL (i.e., 3600s)?
  • vavrusa 9y ago
    Yes, there's a cap on both negative and positive cache lifetime. The reason is reducing the blast radius as accidents happen, and it hurts especially on long infrastructure records (mistake during repointing NSs, bad glue, expired DS etc.) We're going to be looking into making the cap more dynamic over time.
    • LinuxBender 9y ago
      I do this at home as well, using Unbound DNS to set a min and max TTL. It's taboo on public DNS recursors, but totally makes sense. Some folks try to use DNS as real time load balancers and will set crazy low TTL's like 1 second or even 0 (which violates RFC's)
• 2bitencryption 9y ago
  Does Windows/all my devices support DNS-over-HTTPS (or TLS) right now? I.e. if I set everything to use 1.1.1.1, will all my devices know to use the secure protocols, or will it be regular old unsecure DNS?
  • jlgaddis 9y ago
    Your best bet would be to configure your own DNS server (on your router, for example, assuming support) to use DNS-over-(HTTPS|TLS) and then have all of your other devices use your router as their DNS server.
• cpeterso 9y ago
  Here are instructions for testing DoH (DNS-over-HTTPS) in Firefox Nightly: https://gist.github.com/mcmanus/766a9564a51325b6543644983539e7ff https://gist.github.com/mcmanus/766a9564a51325b6543644983539...
  • cpeterso 9y ago
    Unfortunately, enabling DoH in Firefox Nightly causes a 100% reproducible macOS kernel panic for me! :( https://bugzilla.mozilla.org/show_bug.cgi?id=1450583 https://bugzilla.mozilla.org/show_bug.cgi?id=1450583
  • alwillis 9y ago
    DoH on Firefox nightly working great: Version: 61.0a1 (2018-04-01) OS: macOS High Sierra 10.13.4 (17E199)
    • cpeterso 9y ago
      According to the Firefox bug report, this was an Apple bug (related to TCP Fast Open) fixed in macOS 10.13.4. When I updated to 10.13.4, the panic went away.
• jlgaddis 9y ago
  For the Cloudflare folks hanging around: Please, please, please add some basic "features" (like Google does) that will help when troubleshooting resolution! For example, the following will show the unicast IP address of the server you're hitting when using 8.8.8.8: $ dig @8.8.8.8 txt o-o.myaddr.l.google.com. +short Additionally, with one other DNS query, we can get a list of what netblocks are being used (for Google Public DNS) in what datacenters/locations: $ dig @8.8.8.8 txt locations.publicdns.goog. +short (This same info, along with a small shell script to format it nicely, is available on their web site [0] as well.) [0]: https://developers.google.com/speed/public-dns/faq https://developers.google.com/speed/public-dns/faq
  • eastdakota 9y ago
    Thank you for the suggestions. I'll make sure they get relayed to the team.
  • deleted 9y ago
    [deleted]
  • DesertBattery 9y ago
    I think i have questions to Google: [user@v-fed-1 ~]$ dig txt o-o.myaddr.l.google.com @8.8.8.8 +short "74.125.46.8" "edns0-client-subnet 92.223.114.166/32" [user@v-fed-1 ~]$ dig txt o-o.myaddr.l.google.com @8.8.8.8 +short "74.125.46.11" "edns0-client-subnet 176.36.247.0/24" [user@v-fed-1 ~]$ dig txt o-o.myaddr.l.google.com @8.8.8.8 +short "74.125.74.3" "edns0-client-subnet 94.181.44.185/32" [user@v-fed-1 ~]$ dig txt o-o.myaddr.l.google.com @8.8.8.8 +short "74.125.46.8" "edns0-client-subnet 92.223.114.166/32" [user@v-fed-1 ~]$ dig txt o-o.myaddr.l.google.com @8.8.8.8 +short "74.125.74.3" "edns0-client-subnet 94.181.44.185/32"
    • d33 9y ago
      What is your question? I think we're seeing load balancing here.
      • DesertBattery 9y ago
• squarefoot 9y ago
  PING 1.1.1.1 (1.1.1.1) 56(84) bytes of data. 64 bytes from 1.1.1.1: icmp_seq=1 ttl=57 time=11.6 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=57 time=11.2 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=57 time=10.8 ms 64 bytes from 1.1.1.1: icmp_seq=4 ttl=57 time=11.1 ms 64 bytes from 1.1.1.1: icmp_seq=5 ttl=57 time=10.9 ms PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=57 time=15.0 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=57 time=15.9 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=57 time=15.1 ms 64 bytes from 8.8.8.8: icmp_seq=4 ttl=57 time=15.0 ms 64 bytes from 8.8.8.8: icmp_seq=5 ttl=57 time=15.1 ms FTTC, southern EU.
• mike-cardwell 9y ago
  "Cloudflare's 1.1.1.1 DNS will respond very fast, but the big sites you access, the whole reason for resolving DNS, will be SLOWER ∵ no edns-client-subnet support, so no geolocation of results." - https://twitter.com/philpennock/status/980561009961299968 https://twitter.com/philpennock/status/980561009961299968
  • kentonv 9y ago
    edns-client-subnet leads to a surprising number of privacy concerns. See: https://00f.net/2013/08/07/edns-client-subnet/ https://00f.net/2013/08/07/edns-client-subnet/ I find the cache timing issue particularly worrying. Cloudflare runs from 151 (and growing rapidly) locations worldwide. Without edns-client-subnet, the upstream DNS server will probably respond according to the geolocation of the Cloudflare location you're talking to -- which is probably pretty close to you, and therefore will probably produce a good outcome for you, while largely avoiding the privacy concerns.
  • deleted 9y ago
    [deleted]
• tajen 9y ago
  > Through the project we protect groups like LGBTQ organizations targeted in the Middle East, journalists covering political corruption in Africa, human rights workers in Asia, and bloggers on the ground covering the conflict in Crimea. And in occident? Do they protect MRAs and Christians? I love how their view of political targeting is limited to what the West wants to impose to all countries. Yet, the organization “A Voice For Men” was flagged as hate speech for funding the movie The Red Pill (2016), the most censored movie of 2017 in occident. If they haven’t identified them as political oppression victims, they don’t know much about Free Speech.
• jason_slack 9y ago
  From someone that takes DNS for granted every day, can someone shed some light on why the current state of DNS has been called archaic and needs to be replaced with something better?
  • patrickmcmanus 9y ago
    one reason: https://www.ietf.org/proceedings/99/slides/slides-99-maprg-fingerprint-based-detection-of-dns-hijacks-using-ripe-atlas-01.pdf https://www.ietf.org/proceedings/99/slides/slides-99-maprg-f...
  • jlgaddis 9y ago
    It basically comes down to being insecure. It's all plain-text over UDP. This is easily exploited for various purposes: spoofing (DDoS attacks), surveillance (such as by ISPs), hijacking/tampering, censorship, privacy concerns, and so on. As everything else relies on DNS, the DNS must also be secure.
    • jason_slack 9y ago
      Are there replacement options being worked on? What about wrapping each request and unwrapping on the other end. Something like how Tor wraps requests in many layers?
      • written 9y ago
        https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions https://en.wikipedia.org/wiki/Domain_Name_System_Security_Ex... + DNS-over-TLS for privacy
      • jlgaddis 9y ago
        Yes, several: DNS-over-TLS, DNS-over-HTTPS, DNSSEC, DNSCrypt, DNSCurve, and probably a few others I'm forgetting at the moment.
      • jedisct1 9y ago
        https://dnscrypt.info/faq/ https://dnscrypt.info/faq/
• y0ghur7_xxx 9y ago
  > Both DNS-over-TLS and DNS-over-HTTPS are open standards. And, at launch, we've ensured 1.1.1.1 supports both I like this. Do the root servers support this too?
• moeadham 9y ago
  Is this an april fools joke? We're trusting Cloudflare with privacy now?
• mhuffman 9y ago
  Is this an April Fool's joke since Cloudflare overtly hates privacy (see stance on TOR)?
  • zackbloom 9y ago
    Cloudflare invested a ton of time to create Privacy Pass to make it easier to use with Tor: https://blog.cloudflare.com/cloudflare-supports-privacy-pass/ https://blog.cloudflare.com/cloudflare-supports-privacy-pass...
• natbobc 9y ago
  Not accessible from Buenos Aires, Argentina on Fibertel. ping 1.1.1.1 PING 1.1.1.1 (1.1.1.1): 56 data bytes Request timeout for icmp_seq 0 Request timeout for icmp_seq 1
  • huxflux 9y ago
    Same here (timeout), Shanghai, China on China Unicom. Pinging 1.1.1.1 with 32 bytes of data: Request timed out. Request timed out. Request timed out. Request timed out. Ping statistics for 1.1.1.1: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
    • natbobc 9y ago
      Found out via Twitter you can also use 1.0.0.1 which is another of their resolvers and works for me in Argentina. Although 1.1.1.1 is accessible for me know so I suspect it was a propagation issue.
• a-b 9y ago
  Any suggestions about anonymous "Search Domains"?
• tbarbugli 9y ago
  > "Why Did We Build It?" Marketing
• BlueGh0st 9y ago
  In Florida I'm getting identical times with 1.1.1.1 and 8.8.8.8 ~56ms
• riquito 9y ago
  Will the day come when we're able to set the dns on smartphones too?
• yorby 9y ago
  I think that Cloudflare has enough data as-is...
• gerdesj 9y ago
  The Linux instructions don't mention adding 1.1.1.1, only 1.0.0.1! However, I think I can work that out 8)
• chisleu 9y ago
  I'm pretty sure that CloudFlare has people working with US intelligence and supply information that cant be used in court, requiring parallel reconstruction..
  • zackbloom 9y ago
    What is your evidence of this?
    • chisleu 9y ago
      I am not allowed to share that information. I now work for a Infosec/Intel company. I've worked on IBM/Watson's days systems, and before that I worked at another Intel Agency. I have terribly worked with Packet Forensics, FBI, Secret Service, and yes... Cloudflare. Don't be daft.
      • jlgaddis 9y ago
        He asked for evidence, not more unverifiable claims. I'm not a huge fan of Cloudflare and do not use any of their services but you can't just go around making shit up and then refuse to back up your claims.
        • chisleu 9y ago
          Actually, I have every right to share information that I have. People can complain and ask for information that I can't provide. That's your right. I have the same responsibility to provide proof as you do to believe me, even if I provided "proof". Bother someone else.
• pmoriarty 9y ago
  "Visit https://1.1.1.1/ https://1.1.1.1/ from any device to get started with the Internet's fastest, privacy-first DNS service." When I try, my browser tells me: Bad cert ident from 1.1.1.1: dNSName=*.cloudflare-dns.com cloudf: accept? (y or n)
  • cwp 9y ago
    I get ERR_CONNECTION_REFUSED
    • prdonahue 9y ago
      Likely that IP address is being used (inadvisably) by something on your network.
      • cwp 9y ago
        Looks that way. 1.0.0.1 works fine though.
        • cwp 9y ago
          And now, so does 1.1.1.1. I suspect it was something sonic.net was doing, and they had to fix it when this announcement was made.
  • prdonahue 9y ago
    What browser are you using? Almost looks like it doesn't support SANs. Either that or the debug is only printing DNS.1. $ openssl s_client -connect 1.1.1.1:443 </dev/null 2>&1 | openssl x509 -noout -text | grep "CN=\|DNS" Issuer: C=US, O=DigiCert Inc, CN=DigiCert ECC Secure Server CA Subject: C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=*.cloudflare-dns.com DNS:*.cloudflare-dns.com, IP Address:1.1.1.1, IP Address:1.0.0.1, DNS:cloudflare-dns.com, IP Address:2606:4700:4700:0:0:0:0:1111, IP Address:2606:4700:4700:0:0:0:0:1001
• SeoxyS 9y ago
  My main problem with these DNS services is that they often break gated wifi networks that require a login page to access. It's horrible that it has become standard practice to take over DNS to redirect to a access gate — but as users, your choices are either: suck it up, or no internet. Does anyone have a better solution for this? (Also — why no IPv6 DNS?)
• Angostura 9y ago
  I see a lot of criticism of the choice of KPMG. Who should they have chosen as auditors? And which is the better fast privacy-minded DNS service I should be using?
  • colordrops 9y ago
    Maybe they could do some form of auditing that is traceable by the average consumer. For instance: They could make their deployment setup completely automated and publish the tooling to github, and have video evidence of them deploying the same SHA-256 stamped tooling to their data centers. They could expose operational details and transactions on their DNS servers as far as possible without revealing identifiable information. They could have regular physical audits by a constantly rotating set of well known and trusted parties (i.e. EFF, Mozilla).
• calimac 9y ago
  Cloud flare showed their colors when they pulled down the political sites because their CEO interpreted it as hate. Cloudflare, you are zealots and are not to be trusted.
• wnevets 9y ago
  According to grc's dns benchmark tool its not the fastest dns server for me https://www.grc.com/dns/benchmark.htm https://www.grc.com/dns/benchmark.htm
• johnhenry 9y ago
  Not relevant, but I just realized that I've been ignoring this post for hours and I think that it's because the "1.1.1.1" threw me off. I wonder if anyone else has experienced this?
• tracker1 9y ago
  Looks like 1.1.1.1 gets about half the ping time of google's dns for me.
• buremba 9y ago
  > DNS resolvers inherently can't use a catchy domain because they are what have to be queried in order to figure out the IP address of a domain. It's a chicken and egg problem. And, if we wanted the service to be of help in times of crisis like the attempted Turkish coup, we needed something easy enough to remember and spraypaint on walls. In fact, people wrote that DNS address on walls just to get away with the censorship of the government so you wouldn't be helping the government..
• aquova 9y ago
  Can someone explain to me what exactly this is? I thought DNS was something to match URLs with IP addresses? How exactly is it private and fast?
• 15charlimitdumb 9y ago
  mid missouri US sample size; gregs-Air:~ greg$ ping 1.1.1.1 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: icmp_seq=0 ttl=55 time=51.035 ms 64 bytes from 1.1.1.1: icmp_seq=1 ttl=55 time=52.024 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=55 time=52.945 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=55 time=77.263 ms 64 bytes from 1.1.1.1: icmp_seq=4 ttl=55 time=53.427 ms 64 bytes from 1.1.1.1: icmp_seq=5 ttl=55 time=57.311 ms 64 bytes from 1.1.1.1: icmp_seq=6 ttl=55 time=192.017 ms 64 bytes from 1.1.1.1: icmp_seq=7 ttl=55 time=174.206 ms 64 bytes from 1.1.1.1: icmp_seq=8 ttl=55 time=142.224 ms 64 bytes from 1.1.1.1: icmp_seq=9 ttl=55 time=288.815 ms ^C --- 1.1.1.1 ping statistics --- 10 packets transmitted, 10 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 51.035/114.127/288.815/77.996 ms gregs-Air:~ greg$ curl ifconfig.co 174.125.4.196 gregs-Air:~ greg$
• deleted 9y ago
  [deleted]
• wemdyjreichert 9y ago
  Thanks, Cloudflare. Not just for the fast DNS (yay!) but also for being one of the nice tech companies (ahem, Facebook).
• huxflux 9y ago
  Timeout from Shanghai, China on China Unicom. Pinging 1.1.1.1 with 32 bytes of data: Request timed out. Request timed out. Request timed out. Request timed out. Ping statistics for 1.1.1.1: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
  • rqs 9y ago
    China Mobile here, same result. Not sure whether or not it already been blocked. LOL UPDATE: Maybe the routing is not ready yet, let's wait for a moment and check it out later.
  • cocoggu 9y ago
    In Shanghai, Jing'an with China Telecom Fiber PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: icmp_seq=0 ttl=53 time=188.730 ms 64 bytes from 1.1.1.1: icmp_seq=1 ttl=53 time=178.453 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=53 time=179.869 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=53 time=177.808 ms Google : PING 8.8.8.8 (8.8.8.8): 56 data bytes Request timeout for icmp_seq 0 64 bytes from 8.8.8.8: icmp_seq=1 ttl=42 time=58.368 ms Request timeout for icmp_seq 2 Request timeout for icmp_seq 3 Request timeout for icmp_seq 4 64 bytes from 8.8.8.8: icmp_seq=5 ttl=42 time=51.636 ms 64 bytes from 8.8.8.8: icmp_seq=6 ttl=42 time=55.772 ms Request timeout for icmp_seq 7 64 bytes from 8.8.8.8: icmp_seq=8 ttl=42 time=42.365 ms 64 bytes from 8.8.8.8: icmp_seq=9 ttl=42 time=45.782 ms Cloudflare seems more stable here
• ktosobcy 9y ago
  Chile, Temuco: --- 1.1.1.1 ping statistics --- 26 packets transmitted, 26 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 56.440/62.916/106.933/10.084 ms --- 8.8.8.8 ping statistics --- 10 packets transmitted, 10 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 27.454/30.733/33.344/1.456 ms --- 9.9.9.9 ping statistics --- 13 packets transmitted, 13 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 29.041/35.952/75.558/11.780 ms
• TheSwordsman 9y ago
  From Comcast in San Francisco, I'm seeing that CloudFlare is the slowest of Google Public DNS, OpenDNS, Level 3, and Comcast's resolver. Definitely not what I was expecting... CloudFlare: $ ping -c 240 -i 0.25 1.1.1.1 ... --- 1.1.1.1 ping statistics --- 240 packets transmitted, 240 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 16.271/17.286/25.105/1.236 ms Google Public DNS: $ ping -c 240 -i 0.25 8.8.8.8 ... --- 8.8.8.8 ping statistics --- 240 packets transmitted, 240 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 5.092/10.083/35.949/2.426 ms OpenDNS: $ ping -c 240 -i 0.25 208.67.222.222 ... --- 208.67.222.222 ping statistics --- 240 packets transmitted, 240 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 8.596/9.847/25.898/1.788 ms Level 3: $ ping -c 240 -i 0.25 4.2.2.2 ... --- 4.2.2.2 ping statistics --- 240 packets transmitted, 240 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 8.479/9.563/18.971/1.336 ms Comcast's Resolver: $ ping -c 240 -i 0.25 75.75.75.75 ... --- 75.75.75.75 ping statistics --- 240 packets transmitted, 240 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 8.410/9.717/19.428/1.487 ms It even looks like OpenDNS and Level 3 are better than Google Public DNS in terms of latency.
  • eridius 9y ago
    You should be measuring DNS time, not ping time. There's more to how fast a DNS resolver responds than the time it takes to send the packet over the wire. As a Comcast@Home subscriber in SF, 1.1.1.1 is approximately 3x as fast as Comcast's own DNS (testing using dig).
• djfergus 9y ago
  Can't ISPs just monitor the DNS protocol and still gather a list of all sites you visit?
• dbg31415 9y ago
  From Sydney --- 1.1.1.1 ping statistics --- 100 packets transmitted, 100 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 10.536/13.084/19.910/3.284 ms --- 8.8.4.4 ping statistics --- 100 packets transmitted, 100 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 10.931/15.141/32.453/6.498 ms --- 1.0.0.1 ping statistics --- 100 packets transmitted, 100 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 10.219/16.709/29.498/6.960 ms --- 9.9.9.9 ping statistics --- 100 packets transmitted, 100 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 10.290/22.336/43.267/10.238 ms --- 208.67.222.222 ping statistics --- 100 packets transmitted, 100 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 12.985/22.786/46.929/10.036 ms --- 208.67.220.220 ping statistics --- 100 packets transmitted, 100 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 16.273/27.225/49.783/10.246 ms --- 8.8.8.8 ping statistics --- 100 packets transmitted, 100 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 10.581/35.527/125.641/33.204 ms
• iod 9y ago
  Very impressed so far. I wonder if Cloudflare already has or is going to provide an IP address lookup service too, like OpenDNS and Google have? I find it quite useful to be able to just do something like: dig -4 +short myip.opendns.com a @resolver1.opendns.com dig -6 +short myip.opendns.com aaaa @resolver1.ipv6-sandbox.opendns.com dig -4 +short o-o.myaddr.l.google.com txt @8.8.8.8 dig -6 +short o-o.myaddr.l.google.com txt @2001:4860:4860::8888 to get back my IPv4/IPv6 addresses; especially if Cloudflare can do it faster. Does anyone know if they already have something like this?
• nykolasz 9y ago
  Ran a comparison between all major DNS resolvers (including CloudFlare, Google, OpenDNS, etc): https://medium.com/@nykolas.z/dns-resolvers-performance-compared-cloudflare-x-google-x-quad9-x-opendns-149e803734e5 https://medium.com/@nykolas.z/dns-resolvers-performance-comp...
• arikr 9y ago
  What's the right way to set this up for cellular traffic on iOS? (The instructions are for wi-fi only) Is there anything better than https://www.dnsoverride.com/ https://www.dnsoverride.com/ (found via google)?
• relieferator 9y ago
  I wrote up a guide on how to configure a pfSense firewall with CloudFlare DNS on my blog [here](https://jasoncoltrin.com https://jasoncoltrin.com).
• sajal83 9y ago
  https://pulse.turbobytes.com/results/5ac1deefecbe4078c200ed8a/ https://pulse.turbobytes.com/results/5ac1deefecbe4078c200ed8... Query times and rechability from 58 locations. 3 locations still can't reach 1.1.1.1, but for most users cached response is faster from Cloudflare.
• c8456 9y ago
  well.. for ipv6 doesn't perform that well.. == CloudFlare == Ping statistics for 1.1.1.1: Minimum = 10ms, Maximum = 10ms, Average = 10ms Ping statistics for 2606:4700:4700::1111 Minimum = 40ms, Maximum = 40ms, Average = 40ms == OpenDNS == Ping statistics for 208.67.222.222: Minimum = 38ms, Maximum = 38ms, Average = 38ms Ping statistics for 2620:0:ccc::2: Minimum = 34ms, Maximum = 34ms, Average = 34ms
• davewasthere 9y ago
  In Bendigo Australia, and Steve Gibson's DNSBenchmark tells me that of my 50 optimised resolvers (with 1.1.1.1 and 9.9.9.9 added), the two fastest public DNS services I should use are 9.9.9.9 followed by 8.8.8.8. I also add a couple of others for redundancy..
• dojo999 9y ago
  1.0.0.1 and 2606:4700:4700::1001 return the same PTR info as 1.1.1.1 and 2606:4700:4700::1111 do. $ host 1.0.0.1 1.0.0.1.in-addr.arpa domain name pointer 1dot1dot1dot1.cloudflare-dns.com. $ host 2606:4700:4700::1001 1.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.4.0.0.7.4.6.0.6.2.ip6.arpa domain name pointer 1dot1dot1dot1.cloudflare-dns.com. I would've expected these to return 1dot0dot0dot1.cloudflare-dns.com.
• franga2000 9y ago
  Holy shit! Ping from a server in Germany: 8.8.8.8: 6.4 ms 1.1.1.1: 0.45 ms That's really impressive! Well done!
  • MertsA 9y ago
    The call is coming from inside the data center! https://www.youtube.com/watch?v=rkcGm-pWwsQ https://www.youtube.com/watch?v=rkcGm-pWwsQ
• originalsimba 9y ago
  The idea is solid on the surface, but I don't trust it's parent. Setting up hundreds of millions of internet machines to be reliant on a single corporation's service offerings is asking for disaster, and Cloudflare has a sleeeeaazy history. But hey, they say their product is legitimate, so it must be true.
• deleted 9y ago
  [deleted]
• meow81 9y ago
  my results: https://pastebin.com/TwjakL0Q https://pastebin.com/TwjakL0Q Verizon still the fastest, my ISP, but switched to 1.1.1.1 for the perceived privacy benefit. The speed difference wouldn't be noticeable for me between Verizon, Google, Cloudflare. used https://www.grc.com/dns/benchmark.htm https://www.grc.com/dns/benchmark.htm
• eric_lu 9y ago
  how do i ping