27 ms·

DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS

860 points by nykolasz 9y ago

anilgulecha 9y ago
I think we'll start seeing the standard configuration of 1.1.1.1,8.8.8.8 everywhere. Google/Cloudflare tackled the UX of free DNS spectacularly with these gold IP addresses. It's the primary reason I use them instead of OpenDNS, which was an earlier player in this space.
- deleted 9y ago
  [deleted]
- JepZ 9y ago
  I wonder how much Cloudflare paid/pays for the 1.1.1.1
  - larrybud 9y ago
    Read the announcement: https://blog.cloudflare.com/announcing-1111/ https://blog.cloudflare.com/announcing-1111/ "APNIC's research group held the IP addresses 1.1.1.1 and 1.0.0.1. While the addresses were valid, so many people had entered them into various random systems that they were continuously overwhelmed by a flood of garbage traffic. APNIC wanted to study this garbage traffic but any time they'd tried to announce the IPs, the flood would overwhelm any conventional network. We talked to the APNIC team about how we wanted to create a privacy-first, extremely fast DNS system. They thought it was a laudable goal. We offered Cloudflare's network to receive and study the garbage traffic in exchange for being able to offer a DNS resolver on the memorable IPs. And, with that, 1.1.1.1 was born."
    - stordoff 9y ago
      Have they discussed what this means in terms of the privacy promises? What "garbage traffic" does APNIC have access to in order to study?
      - burntwater 9y ago
        I think that's part of the point of all this - to find out what all that garbage traffic is.
      - X-Istence 9y ago
        HA failover pings that get routed rather than being sent to their peer, captive portal requests that no longer exist. Things of that nature. There is a lot of documentation, Cisco being one of the primary at-fault companies, that uses 1.1.1.1 for all kinds of various internal configuration. Given hundreds of thousands of devices configured with 1.1.1.1, even a simple misconfiguration on just 10% of those is a lot of garbage traffic.
  - notreallyauser 9y ago
    No cash outlay. Read the blog, but tl;dr is that it's quid pro quo as the owners can't afford to stand it up due to the volume of junk traffic (but want to, to study the junk) -- cloudflare can and will let the owner study the junk. What cloudflare don't say in any of their materials that I've seen is the agreement is for an initial 5 years, so YMMV after that.
- keeperofdakeys 9y ago
  Be careful with that, Google DNS (as an example) will start ignoring your DNS requests if you go over the rate-limit. Not an issue for home users, but an issue for any sizeable business.
  - noonespecial 9y ago
    I have run into this in the wild. Presented as a weird, intermittent, "hey the internet is out" at the office around the same time each afternoon.
  - sytse 9y ago
    Yep, don't configure your servers with Google's public DNS servers but use the ones your public cloud provides.
  - r1ch 9y ago
    Google DNS also has issues resolving DNSSEC-enabled Cloudflare domains.
    - fanf2 9y ago
      Interesting! Do you have any examples?
      - r1ch 9y ago
        Hmm, it seems like they may have fixed it, I can't seem to reproduce the problem I had (it would randomly fail to resolve CAA records for DNSSEC enabled domains).
  - mjevans 9y ago
    Doesn't this just mean that you should be running your own caching resolver so that requests for common things don't constantly hit the upstream server? For those same common sites it should also be better performance anyway.
  - vamin 9y ago
    Do we know yet if CloudFlare has similar rate limits?
- brightball 9y ago
  OpenDNS still has a lot of value beyond just free DNS service though. When I was very active in dealing with phishing, we found that OpenDNS flagged phishing sites about 4 times faster than any other DNS provider, which I assume is because of PhishTank. It's the primary reason I recommend it to my parents. Between that and some of the content filtering options you can get with the paid plan, I find that it's a very full-featured option for homes with young kids. I'm pretty sure you get to control the logs on the paid plan too. Need to double check.
cbg0 9y ago
I wasn't aware of Quad9, it seems like a pretty great option for those that are easy targets of scams/phishing.
- akerro 9y ago
  Quad9 is supported/funded by City Of London Police, the same police that cooperates with ad companies to track people online. https://www.theguardian.com/media-network/media-network-blog/2014/apr/17/police-advertising-industry-copyright-infringement https://www.theguardian.com/media-network/media-network-blog... Keep away from this.
  - cbg0 9y ago
    Actually Quad9 seems to be a non-profit, founded by IBM, PCH and GCA (of which the City of London Police is a founder). The simple fact that it's supported by the CoLP doesn't seem sufficient to point out that Quad9 should be avoided since it will track people online.
  - mft_ 9y ago
    Interesting question: would I rather protect my elderly Mum from known malicious domains potentially trying to scam/phish, or from potential tracking and ad targeting? (Actually, it's not really a difficult choice at all, is it?)
    - foepys 9y ago
      Why not install an ad blocker with a malware blocking list in her browser?
    - hollander 9y ago
      Why not both? You're smart enough I guess to find a good solution.
  - bogomipz 9y ago
    Quad9 is a consortium of 3 founding companies, none of which is the London Police Department. Additionally nowhere in your link is either Quad9, IBM, PCH or GCA mentioned. Please stop spreading and disinformation and FUD. See: https://www.quad9.net/about/ https://www.quad9.net/about/
dbg31415 9y ago
dig +noall +stats @1.0.0.1 news.ycombinator.com; dig +noall +stats @1.1.1.1 news.ycombinator.com; dig +noall +stats @208.67.220.220 news.ycombinator.com; dig +noall +stats @208.67.222.222 news.ycombinator.com; dig +noall +stats @8.8.4.4 news.ycombinator.com; dig +noall +stats @8.8.8.8 news.ycombinator.com Fixed? =P I removed some of the records form the article after reading some of the comments here. Cloudflare, Google, and OpenDNS only. Kind of cool, I switched it up and ran it against 10 sites I frequent... was pretty impressed to see how well OpenDNS was doing.
- Maledictus 9y ago
  That tests ICMP echo requests not name resolution.
  - Dolores12 9y ago
    That is what original test was testing.
    - Buge 9y ago
      What? It says >Our test was very simple and we performed 70 DNS lookups That's not ICMP.
      - Dolores12 9y ago
        Well, the article says so, but they actually measured icmp response. All major domains are in DNS cache anyway. If you look at Yandex result you see it performed very poorly. Why does it resolve popular domains so slow? The reason is it has one server and it is located in Moscow. So i would say icmp is good proxy to actual performance.
        Buge 9y ago
        It would be a measure of ping + cache latency. That's still different than just ping. And is your point that the tested sites aren't popular in Russia? >for different popular domains (google, facebook, twitter, gmail, etc) google.com facebook.com and twitter.com are all in the top 50 sites in Russia[1]. And gmail.com is number 6000 globally[2], so it's unpopular everywhere, not just Russia. Popular sites in Russia tend to be popular elsewhere, and vice versa. [1] https://www.similarweb.com/top-websites/russian-federation https://www.similarweb.com/top-websites/russian-federation [2] https://www.alexa.com/siteinfo/gmail.com https://www.alexa.com/siteinfo/gmail.com
yread 9y ago
It would be more interesting to see how are they doing for some websites in the long tail, try the 900th, 9000th, and 90000th most popular sites instead of the top. And try some locations which are not actual datacenters?
- iforgotpassword 9y ago
  And test consistency. Stddev, and get the worst results from 1000 runs.
  - jobigoud 9y ago
    Worst result can be an outlier, maybe better to use the 95th percentile or something.
sajal83 9y ago
https://pulse.turbobytes.com/results/5ac1f967ecbe4078c200ee4a/ https://pulse.turbobytes.com/results/5ac1f967ecbe4078c200ee4... Cloudflare consistently times out from these networks. Netherlands - AS13127 Philippines - AS135132 Thailand - AS17552 (One of the largest consumer internet providers) US - AS7018 (AT&T)
- iforgotpassword 9y ago
  Probably some smart people working there using 1.1.1.1 for internal stuff instead of one of the reserved subnets (private or "for documentation").
- therealmarv 9y ago
  I'm sure this is because 1.1.1.1 does not work everywhere well. Maybe with 1.0.0.1 it will work more reliable.
  - sajal83 9y ago
    Yep you are right right. ~# mtr --report --address 192.168.2.2 1.1.1.1 Start: Mon Apr 2 16:53:31 2018 HOST: apu Loss% Snt Last Avg Best Wrst StDev 1.|-- 192.168.2.1 0.0% 10 0.9 1.1 0.9 1.2 0.0 2.|-- 10.137.128.1 0.0% 10 11.3 12.8 10.7 17.1 1.8 3.|-- 10.246.253.133 0.0% 10 7.7 8.2 7.5 9.1 0.0 4.|-- 10.185.94.203 0.0% 10 9.1 8.4 6.9 9.4 0.6 5.|-- 10.185.94.25 0.0% 10 9.5 8.7 7.7 10.0 0.5 6.|-- 61-91-220-101.static.asia 0.0% 10 11.7 11.7 8.6 25.7 5.2 7.|-- 58-97-82-116.static.asian 0.0% 10 10.7 10.2 8.6 15.4 1.9 8.|-- ppp-171-102-254-81.revip1 0.0% 10 9.2 9.2 7.1 10.8 0.9 9.|-- ppp-171-102-250-134.revip 0.0% 10 8.4 10.0 8.4 11.3 0.7 10.|-- ppp-171-102-250-149.revip 0.0% 10 9.0 9.7 9.0 10.9 0.3 11.|-- ??? 100.0 10 0.0 0.0 0.0 0.0 0.0 ~# mtr --report --address 192.168.2.2 1.0.0.1 Start: Mon Apr 2 16:54:05 2018 HOST: apu Loss% Snt Last Avg Best Wrst StDev 1.|-- 192.168.2.1 0.0% 10 1.2 1.1 0.8 1.3 0.0 2.|-- 10.137.128.1 0.0% 10 12.1 12.8 9.2 18.2 2.4 3.|-- 10.246.253.133 0.0% 10 9.8 9.0 7.5 14.7 2.0 4.|-- 10.185.94.203 0.0% 10 4.4 7.9 4.4 8.8 1.2 5.|-- 10.185.94.17 0.0% 10 9.2 9.1 7.2 10.3 0.9 6.|-- 61-91-220-55.static.asian 0.0% 10 9.7 10.6 8.0 17.2 2.6 7.|-- 58-97-82-120.static.asian 0.0% 10 10.5 9.7 8.2 11.2 0.7 8.|-- ppp-171-102-254-65.revip1 0.0% 10 10.5 9.7 8.8 10.7 0.0 9.|-- ppp-171-102-254-227.revip 0.0% 10 8.9 13.1 8.8 44.0 10.8 10.|-- 61-91-213-130.static.asia 0.0% 10 10.9 9.8 8.3 10.9 0.6 11.|-- TIG-Net242-40.trueinterga 0.0% 10 15.0 14.1 10.9 16.1 1.8 12.|-- TIG-Net245-243.trueinterg 0.0% 10 38.1 38.0 36.4 40.6 0.9 13.|-- 13335.sgw.equinix.com 0.0% 10 37.4 38.6 36.4 48.5 3.5 14.|-- 1dot1dot1dot1.cloudflare- 0.0% 10 36.9 36.3 35.0 36.9 0.5 Edit: Formating
MikeGale 9y ago
I presume that Google uses this as part of it's surveillance operation.
- gaius 9y ago
  Yes, they aren’t providing 8.8.8.8 out of the goodness of their black hearts
  - HenryBemis 9y ago
    And I wanted to add a similar comment, why on earth would any privacy-oriented person would use Google's 8.8.8.8 when there are other options out there? Oh, and I definitely don't buy this for Google: "The Privacy option above is based on the providers promise to do not log or share your DNS requests."
- Isomer 9y ago
  Google has a separate, stricter, privacy policy for Google Public DNS: https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy Basically there are two log files kept: - One for up to 48 hours which contains IP addresses, which is used for handling abuse. - One is permanent which doesn't contain any personal identifying information (eg IP addresses), which is used for things like internal performance monitoring, load testing, and tracking frequency of longer term abuse etc. Google provides Google public DNS because if you see the internet as being slow because of poor DNS performance, then you don't use websearch as much. Google doesn't need to use Google Public DNS to track users, and would rather not have the information (as it makes it available for government requests etc which are a major pain to deal with). But running a large scale recursive DNS server tends to attract a _lot_ of abuse, both intentional, and unintentional as I'm sure 9.9.9.9 and 1.1.1.1 are discovering. Google provides Google Public DNS because a lot of ISPs provide extremely poor default recursive nameservers (having tiny caches, dropping queries due to overload, not implementing IPv6, DNSSEC validation, EDNS0 payload size, or other important modern DNS features. Some ISPs also hijack domains for their own purposes, or "stretching" DNS TTLs etc) so providing a better alternative to improve overall Internet use is clearly in Google's best interest. Having other public resolvers, with different trade offs is clearly better for everyone, including Google as long as they are reliable, trustworthy, and provide low latency responses. Good luck to everyone who's joining in the fun of running a planet scale recursive DNS server. (Disclaimer: I have previously worked on Google Public DNS, but no longer do)
nvarsj 9y ago
Just run your own DNS resolver if you value your privacy. With prefetching and caching there will be little difference in performance.
- jamra 9y ago
  But your DNS will have to query other DNS providers so if you’re the only one using it, it won’t be private.
  - Daviey 9y ago
    There is 2 main different ways, one which does what you say - the other i'd say is pretty much OK. If your local DNS server is merely querying an upstream resolver (like 1.1.1.1 / 8.8.8.8) on your behalf, then yes - it is no different. If however, you query the root nameservers for the glue record for a domain and query the domain's own nameservers directly, then it is pretty good... As you are neither querying your ISP or TheMan.. which means that logically only the domain nameserver owner knows what queries you made (and you are probably hitting that domain in a moment anyway!). (The caveat is that some ISP's do transparent DNS proxying.. in which case, you have much larger trust issues with your ISP and need to take greater measures!) That said.. I cba with that.
    - phire 9y ago
      > (The caveat is that some ISP's do transparent DNS proxying.. in which case, you have much larger trust issues with your ISP and need to take greater measures!) I once had an ISP which did transparent http proxying. You could theoretically query an external DNS server and get back the correct result, but it would intercept your http connection, discard the ip address you were trying to connect to then do a new DNS lookup to the ISP's DNS server on the HOST header. Took me ages to work out what was going on with the various issues it was causing. I dumped that ISP like a rock after they refused to disable that caching proxy, which they claimed was only there to improve customer experience.
      - stordoff 9y ago
bjslade 9y ago
Besides response time, the next level of comparison is how well geo-DNS-based services (global load balancing, etc.) support these resolvers. AFAIK 8.8.8.8 gives decent results in most places, though I've seen suboptimal US-centric results from Quad9 in Asia. Support for RFC 7871 (Client Subnet in DNS Queries) comes into play here too.
- dbg31415 9y ago
  I always used 8.8.8.8, since I couldn't remember OpenDNS's IPs. But just found out today that, from Sydney, OpenDNS and Cloudflare are kicking Google's ass for speed. 8.8.8.8 is on par with my ISP-default DNS.
  - jg2leet 9y ago
    Ever since The Great Comcast DNS Outage of 2010, I've had the OpenDNS IPs burned into my memory from telling so many people. I like the fact that you can sign up for OpenDNS and customize some of the filtering (ads, spam/malware, etc.) They used to have crappy handling of nxdomains (by default) redirecting you to a website with ads, but I believe that's no longer the case?
    - coaxial 9y ago
      As250 is running a free DNS server with adblocking enabled FWIW: https://twitter.com/as250/status/790593201832857601?s=20 https://twitter.com/as250/status/790593201832857601?s=20 Pihole is also a great alternative if you have a spare raspi lying around.
      - mynameisvlad 9y ago
        > if you have a spare raspi lying around. Really, if you have a spare computer of any type. I run it on a VM and it works just fine. It was made for Raspberry Pis but it'll work on any system.
enz 9y ago
9.9.9.9 does not seem to be geographically-aware. Here are the resolutions for the same domain name (CNAME referring to the hopefully closest edge server), from France. % dig [domain] @8.8.8.8 +short [id].kxcdn.com. p-frpa00.kxcdn.com. # France % dig [domain] @9.9.9.9 +short [id].kxcdn.com. s-us-ca00.kvcdn.com. # America p-ussj00.kxcdn.com. % dig [domain] @1.1.1.1 +short [id].kxcdn.com. p-frpa00.kxcdn.com. # France % dig [domain] @ns0.fdn.fr +short # My ISP resolver [id].kxcdn.com. p-frpa00.kxcdn.com. # France
- swinglock 9y ago
  A more comprehensive benchmark would also measure a ping or HTTP request to each resolved IP take to this into account. Actual browser performance is very skewed now without it.
  - q3k 9y ago
    And throughput to the content as well - RTT (even time to first byte) by itself does not a benchmark make.
- sajal83 9y ago
  9.9.9.9 does not pass along EDNS client subnet resulting in wrong geo-located responses. It is their "feature".
  - bjslade 9y ago
    According to the FAQ[1], they also offer 9.9.9.10, which passes client subnet at the cost of other features. [1] https://www.quad9.net/faq https://www.quad9.net/faq
    - sajal83 9y ago
      Fair enough, but most users won't care enough look it up and use 9.9.9.10 instead of 9.9.9.9 if they want better performance in exchange for allegedly lower privacy. It appears 1.1.1.1 also does not pass client-subnet, atleast not by default. Queries to my authoritative from Google always includes client subnet, OpenDNS required request for whitelist. For Cloudflare its unclear.
swinglock 9y ago
You can run a benchmark of your own using namebench. I recommend you uncheck the options for the included nameservers or it will take a very long time to run and enter only the DNS servers you want to test manually. It can use your Firefox browsing history as a source for domains to resolve. Ignore the "incorrect" and "hijacked" warnings, I think the program has hardcoded, outdated IP ranges for popular services which causes those. https://code.google.com/archive/p/namebench/ https://code.google.com/archive/p/namebench/
- agumonkey 9y ago
  for the curious arch user, it's on AUR ps: namebench is quite extensive. thousands of queries and a nice and long report. enjoy it
leowinterde 9y ago
Quad9 has several IPs and different services, see (https://www.heise.de/imgs/18/2/3/1/7/9/4/7/quad9-feature-matrix-72311e6ae96e13b1.png https://www.heise.de/imgs/18/2/3/1/7/9/4/7/quad9-feature-mat...). For some reason this is hidden on the quad9 website.
- DesertBattery 9y ago
  dig @9.9.9.11 +short ;; connection timed out; no servers could be reached dig @9.9.9.12 +short ;; connection timed out; no servers could be reached
- mynameisvlad 9y ago
  It's in their FAQ: https://www.quad9.net/faq/#Is_there_a_service_that_Quad9_offers_that_does_not_have_the_blocklist_or_other_security https://www.quad9.net/faq/#Is_there_a_service_that_Quad9_off... Seems they've sunset .11 and .12, but .10 is still up.
jimaek 9y ago
If you want to see the performance from even more locations here is a more detailed benchmark https://www.cdnperf.com/tools/cdn-latency-benchmark/0d8b484e2b77537487e5170c4c38647e https://www.cdnperf.com/tools/cdn-latency-benchmark/0d8b484e... Or you can even use a CLI https://perfops.net/cli https://perfops.net/cli to run custom tests from any location
djsumdog 9y ago
I feel like people forgot about how CloudFlare, Google, et. al. can new effectively censor content they don't agree with: https://fightthefuture.org/article/the-new-era-of-corporate-censorship/ https://fightthefuture.org/article/the-new-era-of-corporate-... ..and even though CloudFlare back pedaled on that particular decision somewhat, it still happened. If you really want something fast and secure, run your own caching DNS that uses root DNS servers.
- syshum 9y ago
  This is the most alarming thing about this trend that has been happening for the last few years The Internet should be DECENTRALIZED yet it seems we are attempting to do everything in our power to ensure only a handful of companies control access to all information. For what to save 3 ms off a ping time? Facebook is in hot water over privacy issues, but that is just the tip of the ice berg Google, AWS, Cloudflare are IMO are larger threat then facebook ever could be.
  - duskwuff 9y ago
    You're barking up the wrong tree here. DNS is already an inherently centralized service -- using one company's resolvers instead of another doesn't change that.
    - syshum 9y ago
      Yes and No the problem with Cloudflare is not simply the fact that DNS is centralized, it is a combination of all their services that is concerning for Cloudflare, between the DDOS Proxy, the CDN, the Other Services, and now DNS that is a lot of services in a single basket, so while it is true that dns is some what centralized, having all traffic and all services dependent upon a single company seems to be a bad idea to me But clearly everyone sees not issue with it provided they "claim" to providing a "privacy first" service for free (ya riiiiiggghhhhttttt and Facebook cares about their users privacy as well) and they have better performance, who cares what the long term effects are... We should be working to make DNS less centralized, or replace it with something less centralized, not moving to DNS over HTTP to a few "cloud" providers who also control all of the content...
userbinator 9y ago
I wonder how well 4.2.2.x compares... Then again, a few ms of difference is unlikely to make any noticeable effect in real-world use cases where clients already have local DNS caching and the bulk of the time is data transfer, not DNS lookups.
- jsjohnst 9y ago
  > the bulk of the time is data transfer, not DNS lookups You’d be surprised.
- jpalmer 9y ago
  In my tests 4.2.2.1 performs 50% faster than 1.1.1.1 and is twice as fast as 8.8.8.8.
- vavrusa 9y ago
  4.2.2.x (Level3) is one of those resolvers hijacking negative answers and redirecting your to their "search pages".
lucb1e 9y ago
Which ISPs are so bad that you want to use external services, which are further in distance than your ISP, for speed? When I test with my ISP, they beat all of these services (both IPv4 and IPv6). They're simply closer to me in terms of hops. My router is another story though. The Fritzbox (>200eur router) adds 6ms of latency, and that's what is advertised over DHCP. (Might still be fine, since cached queries are faster than the ping time to the ISP.) Note that my tests were all with uncached queries (random subdomains of a domain), so it always had to go out and ask an external server (though it could cache the NS record for the domain).
- isostatic 9y ago
  I've had several ISPs in different countries that do horrible things. Not using NXDomain is one, but I've had some that return NXdomain when they shouldn't, then cache that result! 8.8.8.8 is consistent and easy to remember, and now so is 1.1.1.1
- coaxial 9y ago
  My isp got the brilliant idea of rolling their own YouTube cache servers. It's great in theory but in or active they're under powered and so at peak hours I can't even stream 240p on my 500mbits connection. I've had to block their cache servers in my firewall for YouTube to be butter smooth at 1080p consistently. Another example is bell Canada who used to mine your DNS queries to profile you for ads, or ISPs that high jack the nxdomain result to send you sponsored results of vaguely similar sounding websites.
  - gruez 9y ago
    >My isp got the brilliant idea of rolling their own YouTube cache servers Are YouTube videos not served using https? Sounds like it's google/YouTube servers but they're underprovsioned
  - mino 9y ago
    It is common for ISP to host instances of the Google Global Cache (GGC, see https://peering.google.com/ https://peering.google.com/) which are used for many Google services, most importantly YouTube. In fact, in many cases Google itself "suggests" to ISP that they host a few GGC servers. They are directly monitored by Google, and the ISP has basically no say in how they are run. Capacity is managed by Google directly.
Klasiaster 9y ago
The OpenNIC project has a database of community/private DNS servers with certain standards. https://www.opennic.org/ https://www.opennic.org/
qwerty456127 9y ago
Is there a tutorial on setting up your own? I've got a huge hosts file and would like it to affect all the devices at my home but setting up a DNS server always seemed high-level black magic to me.
- AntonyGarand 9y ago
  https://pi-hole.net https://pi-hole.net
- ronsor 9y ago
  On Linux, the easiest thing to do is to install busybox; it has a DNS server, dnsd. It will accept your hosts file directly.
- jedisct1 9y ago
  https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy
Isomer 9y ago
Things to look for in comparing recursive DNS servers performance: The 95%ile DNS response time for cached/uncached names. The 95%ile DNS response when one/some of the authoritative nameservers is "lame" or not responding. (better yet, 99%ile, but that requires even more queries...) The average packet loss to the nameserver. (As many resolvers use the default of a 5s timeout, better resolvers use a 1s timeout, the best stub resolvers would use a dynamic timeout, but afaik, none do...). Do they implement DNSSEC validation? What is their story for domains that break DNSSEC (eg: https://www.internetsociety.org/resources/deploy360/2014/case-study-comcasts-dnssec-implementation/ https://www.internetsociety.org/resources/deploy360/2014/cas...)? Do they implement RFC7129 (authenticated denial of existence)? This can be used to prevent your service being used to attack an authoritative nameserver, prevents leaks of useless domains (eg machines looking up untitled.pdf as a domain), and allows you to return NXDOMAIN with much lower latency, making DNS search paths faster. RFC8020 (NXDOMAIN: There is really nothing underneath) would be another example where you can prevent leaking names, and return faster responses from a smaller cache (although I admit I've never seen anyone implement RFC8020 yet). Will they accept (signed) responses into their cache in the additional section? Again, this can significantly reduce the time for uncached responses. [hint: These are good reasons you should sign your domain, it can make things faster and reduce load on your authoritative nameserver!] What is their story for domains that need a cache flush? Do they (correctly) implement IPv6 from the recursive to the authoritative nameservers? Do they (correctly) implement IPv6 from the stub to the recursive nameserver? How big is their cache? How long do things stay in their cache? There's no point being close to a nameserver with an empty cache. Querying www.google.com isn't really going to tell you much about their cache depth, nor is the Alexa 1M. You need a very very wide variety of names. Do they provide good GeoIP responses? There's no point in getting an answer for the middle of the US in <1ms if you happen to be 300ms away in Asia somewhere. The DNS response was fast, but the webserver it sent you to is going to give you abysmal performance. This is often done with EDNS0-Client-Subnet, but it can also be fudged by making the outbound IPs for the iterative requests being diverse enough for different localities. Do they "lie" about names? In what circumstances do they lie? Do they NXDOMAIN malicious domains? adult websites? ad domains? random websites? Do they redirect ad websites to their own ad farm? How do their lies handle DNSSEC? Do they perform QNAME minimalisation to help protect your queries from servers that don't need it? What other features do they implement to make sure their cache is never poisoned? What is their abuse plan? If I send them a vast number of queries what happens? Do they send back TrunCated responses and force me over TCP? Will they respond with SERVFAIL? Or will they drop the queries? Or will they pass them all through to the authoritative nameservers? Do I need to do anything (other than stop sending abusive amounts of load) to be unblocked? What if the reason I'm sending a large number of queries is because I'm a carrier grade NAT IP pool and I have one broken/bad user? What is their reliability story? Is it expected that they will go down for 10 minutes every now and again? What do they do about general Internet Hygiene? Do they have protects against being used for reflection attacks? Do they do preemptive lookups to keep their cache warm or is someone always guaranteed to have to wait for the full resolution? How do they make sure they don't accidentally DoS authoritative nameservers with preemptive resolutions? Things not to look for: ICMP/mtr times are essentially meaningless, except as providing general information about routing decisions. The mean response time, as it tends to be washed out by cached response times, and what you don't care about is if it takes 15ms or 17ms on average, as you can't perceive the difference. What you _do_ care about is if one nameserver has 1/5000 queries which take >1s as that will become a frequent noticeable problem when your surfing. Just looking at a few common names that are likely to be in the cache. Yes, those are important, but as with anything at scale, it's the long tail that's actually interesting and will dominate your perception of performance. You can set up your own domain, and search for random strings and force the full end-to-end query flow. (Beware about wildcard domains for this, if your domain is signed, in theory the nameserver could synthesize responses without going back to your nameserver). Where are your vantage points for measurements? Many people appear to measure from places like AWS zones, and then report spectacular performance for DNS servers also hosted in the same AWS zones – despite most of their users not being hosted there. Hmm, I'm sure there's more, but that's off the top of my head. (Disclaimer: Once upon a time, I was one of the engineers oncall for Google Public DNS, so I have Opinions)
deleted 9y ago
[deleted]
cagenut 9y ago
Mentally you need to add a big asterisk to tests of CDNs, and by extension "dns done like a cdn" from VPS provider networks (content networks). That's not where users come from (eyeball networks), and therefore not where they focus their efforts in peering and route-optimizing.
halayli 9y ago
This tests the performance / distance between vps data centers and the dns server's data centers. imho it's better to have a test web page that consumers visit and establishes a tcp connection to those dns services and estimate the rtt of a single packet from the time it took to establish the connection, or test via the https interface for services that support it.
- jsjohnst 9y ago
  While I whole-heartedly agree with your objection, I question the solution. How do you get high accuracy timing of DNS resolution in JavaScript inside the browser?
  - halayli 9y ago
    It's an estimate of rtt + dns resolution. The challenge in providing a good dns service is more about having nodes closer to the user than the dns resolution step itself because that in theory is almost constant for cached responses (it's usually in the microseconds) and when it's not cached the response time is really dependent on recursive querying of other dns servers. So the dns resolution can me estimated by measuring it from a data center manually and subtracting the rtt and use that as a constant. To estimate the rtt, you can do an xhr request and grab the connectStart and connectEnd using window.performance API keeping in mind it takes 3 rtt to do the handshake. Note that the request will fail for services that don't provide https support but that's ok because we just want to measure connect. The reason cloudflare has a better performance is most likely because they have better coverage and not because their servers are faster. Faster servers are a small factor in the final response time. For services that provide https support you can accurately measure the connect and response time of the XHR request using window.performance interface and subtract the dns resolution of the request. Also if you do the request twice, the second time is likely to have a dns and connect time = 0.
  - falcolas 9y ago
    Not a JavaScript developer, but if they can do timings fine enough to run Meltdown attacks in JS, I think they can safely and accurately measure network timings.
tambre 9y ago
Unfortunately no tests for IPv6 connections. Disappointing considering that all DNS traffic I generate will be over IPv6.
christogreeff 9y ago
No tests for Africa?
mtgx 9y ago
OpenNIC offers DNSCrypt. https://www.opennic.org/ https://www.opennic.org/
paulcarroty 9y ago
I switched all my devices to CloudFlare 'cause it 2x faster than Google DNS in my location - Europe.
- patrickaljord 9y ago
  I'm in Europe too which is in Paris and Google DNS is way faster at 4ms vs 15ms for cloudflare.
sabujp 9y ago
google is faster for me in the bay area from comcast network. Using both ping and dig for testing
ralfm 9y ago
Why is Montreal abnormally high for all services?
- Thaxll 9y ago
  It goes to NYC ...
ralfm 9y ago
Why is Montreal reporting abnormally high response times across the board? For example: # Cloudflare Toronto 3.42ms vs. Montreal 17ms; # Google Toronto 9.42ms vs. Montreal 16.71ms.
- concatime 9y ago
  I live in Montréal, and I saw the same tendency. Cloudflare has a datacenter here. Waiting for a tangible explanation…
  - betaby 9y ago
    Are you using BIG ISP or small? Big guys don't peer at QIX and drag your traffic to US. On other side, smaller players peer at QIX https://qix.ca/members https://qix.ca/members
- betaby 9y ago
  Perhaps that particular test setup doesn't go to QIX where both of them are present. Cloidflare much faster from QIX peering nonetheless.
monochromatic 9y ago
Does anyone actually believe that google isn’t hoovering up personal data with its DNS service?
- charleslmunger 9y ago
  https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy
  - kakarot 9y ago
    we don't keep personally identifiable information We all know what that means. "Anonymous" user IDs that can trivially be traced when combined with another database.
    - hahainternet 9y ago
      Except that if you click the link, that's not what this means.
      - kakarot 9y ago
        I read the policy before quoting it... How can I verify that's not what it means? It's all about subtlety in language. It's just a fact that centralized DNS servers are a bad idea and cannot be trusted, regardless of what it very carefully says on a policy page or whatever speed gains you could get. It's a broken system and I have no reason to trust Google with even more data.
- jeremy7600 9y ago
  All this tasty data: Request domain name, e.g. www.google.com Request type, e.g. A (which stands for IPv4 record), AAAA (IPv6 record), NS, MX, TXT, etc. Transport protocol on which the request arrived, i.e. TCP, UDP, or HTTPS Client's AS (autonomous system or ISP), e.g. AS15169 User's geolocation information: i.e. geocode, region ID, city ID, and metro code Response code sent, e.g. SUCCESS, SERVFAIL, NXDOMAIN, etc. Whether the request hit our frontend cache Whether the request hit a cache elsewhere in the system (but not in the frontend) Absolute arrival time in seconds Total time taken to process the request end-to-end, in seconds Name of the Google machine that processed this request, e.g. machine101 Google target IP to which this request was addressed, e.g. one of our anycast IP addresses (no relation to the user's IP)
vermaden 9y ago
Google and Privacy=Yes ... sure.
reaperducer 9y ago
What I don't understand is how these services are offered at apparently no cost. Sure, I expect Google is slurping all of my connections to help build an ad profile on me. But what about the other companies? They've got to keep the lights on somehow.
- Isomer 9y ago
  See my other reply here: https://news.ycombinator.com/item?id=16733619 https://news.ycombinator.com/item?id=16733619 tl;dr: These companies are successful when more people use the Internet. DNS is a major contributor to poor perceived internet performance. Thus providing better DNS services encourages people to use the Internet more.
- drivebycomment 9y ago
  > I expect Google is slurping all of my connections to help build an ad profile on me. Google says they don't - from https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy: > We don't correlate or combine information from our temporary or permanent logs with any personal information that you have provided Google for other services. Honestly, Google DNS policy seems largely similar to Cloudflare, with the exception of 3rd party audit. Cloudfare apparently doesn't do GeoIP mapping, so, till they implement that, it's not going to be useful for me.
Hyva 9y ago
There's a lot more to consider than just performance when deciding whom to share your browsing habits with. Why would you choose Cloudflare or Google? This isn't an endorsement of Quad9 or OpenDNS; I just don't know enough about them. However, the fact that Cloudflare and Google are privacy-and-security nightmares is well documented.
feelin_googley 9y ago
Is DNS configuration ever considered as a factor in "DNS performance"? IME as an end user, it makes a significant difference. For example if it takes seven queries to resolve a name "A" versus two queries to look up a name "B", then in almost all cases, irrespective of the distance to a cache, looking up A is going to be noticeably slower than looking up B. Indirection is only one example. Even worse are configuations that knowingly trigger retries and wait for client timeouts in order to present a client with a particular nameserver. Indirection and other "DNS tricks" come at a cost. IME, these are not compensated for via the proximity of a cache.
scrumper 9y ago
Safari barfs on visiting https://1.1.1.1 https://1.1.1.1 as linked in the article. Certificate invalid (though it looks fine). Rather unfortunate regarding perception; it's an interesting service!
- sjwright 9y ago
  Works for me; Safari 11.0.3 on High Sierra. (I'm surprised it works at all though... I wouldn't have thought you could have an HTTPS certificate for an IP address? You learn something new every day.)
  - Kalium 9y ago
    The actual domain name is https://cloudflare-dns.com/ https://cloudflare-dns.com/ (found by inspecting the cert) Before SNI, every cert had to go to a static public IP address. Everything between you and the TLS terminator had to handle this. As a side-effect, you didn't actually need to know the domain name to get the tunnel, because everything handling the packets was running on the destination IP. tl;dr: Trickery based on dated TLS quirks.
    - scrumper 9y ago
      That works fine (the URL directly). The certificate is valid. Entering https://1.1.1.1 https://1.1.1.1 doesn't, but shows the same certificate. Don't really understand what's happening here. Anyway thanks for the info there.
      - Kalium 9y ago
        How odd. What browser are you using? It appears to be deviating from spec.
        scrumper 9y ago
        Safari 11.1 (13605.33.1.2). Mac OSX 10.13.4.
rdtsc 9y ago
I've been using Quad9, if anything just because I feel Google already knows too much about me anyway. So far no complaints about it.
darkhorn 9y ago
It is blocked in Turkey.
ryanlol 9y ago
Why is google DNS listed as "private"? They permanently log all of your DNS queries. https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy
- oasisbob 9y ago
  That page specifically says that they don't: > Google Public DNS stores two sets of logs: temporary and permanent. The temporary logs store the full IP address of the machine you're using. [...] We delete these temporary logs within 24 to 48 hours. > In the permanent logs, we don't keep personally identifiable information or IP information. We do keep some location information (at the city/metro level) so that we can conduct debugging, analyze abuse phenomena. After keeping this data for two weeks, we randomly sample a small subset for permanent storage.
  - ryanlol 9y ago
    Read the page. >Finally, if you're interested in knowing what else we log when you use Google Public DNS, here is the full list of items that are included in our permanent logs: >Request domain name, e.g. www.google.com >Client's AS (autonomous system or ISP), e.g. AS15169 >User's geolocation information: i.e. geocode, region ID, city ID, and metro code >Absolute arrival time in seconds Not tracking individual IPs doesn't mean shit.
nextlevelwizard 9y ago
GRC's DNS Benchmark[0] For anyone who wants to test their DNS servers. It is Windows binary, but works fine on Wine. [0] https://www.grc.com/dns/benchmark.htm https://www.grc.com/dns/benchmark.htm
- manigandham 9y ago
  This is the only proper way to test nameservers as a consumer. Everything else using any virtual servers in data centers will be skewed.
cleanbrowsing 9y ago
Pushed a shell script to compare all of them from your location: https://github.com/cleanbrowsing/dnsperftest https://github.com/cleanbrowsing/dnsperftest $ sh ./dnstest.sh |sort -k 22 -n test1 test2 test3 test4 test5 test6 test7 test8 test9 test10 Average cloudflare 1 ms 1 ms 1 ms 4 ms 1 ms 1 ms 1 ms 1 ms 1 ms 1 ms 1.30 norton 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2.00 neustar 2 ms 2 ms 2 ms 2 ms 1 ms 2 ms 2 ms 2 ms 2 ms 22 ms 3.90 cleanbrowsing 11 ms 23 ms 11 ms 11 ms 11 ms 11 ms 11 ms 13 ms 12 ms 11 ms 12.50 google 4 ms 4 ms 3 ms 21 ms 21 ms 61 ms 3 ms 21 ms 21 ms 22 ms 18.10 opendns 2 ms 2 ms 2 ms 39 ms 2 ms 75 ms 2 ms 21 ms 39 ms 13 ms 19.70 comodo 22 ms 23 ms 22 ms 22 ms 22 ms 22 ms 22 ms 22 ms 22 ms 23 ms 22.20 quad9 10 ms 37 ms 10 ms 10 ms 10 ms 145 ms 10 ms 10 ms 10 ms 20 ms 27.20 yandex 177 ms 216 ms 178 ms 182 ms 186 ms 177 ms 183 ms 174 ms 186 ms 222 ms 188.10 adguard 199 ms 210 ms 200 ms 201 ms 202 ms 202 ms 199 ms 200 ms 198 ms 201 ms 201.20
- ori_b 9y ago
  I'm seeing much closer results: cloudflare 32 ms 33 ms 34 ms 39 ms 36 ms 35 ms 29 ms 57 ms 48 ms 33 ms 37.60 google 43 ms 38 ms 37 ms 60 ms 34 ms 30 ms 30 ms 50 ms 32 ms 67 ms 42.10 quad9 30 ms 139 ms 25 ms 35 ms 49 ms 36 ms 34 ms 32 ms 27 ms 47 ms 45.40 opendns 32 ms 33 ms 28 ms 69 ms 32 ms 91 ms 37 ms 75 ms 67 ms 39 ms 50.30 norton 35 ms 33 ms 33 ms 31 ms 39 ms 34 ms 22 ms 25 ms 24 ms 33 ms 30.90 cleanbrowsing 36 ms 48 ms 40 ms 49 ms 56 ms 35 ms 36 ms 49 ms 49 ms 46 ms 44.40 yandex 217 ms 233 ms 203 ms 199 ms 215 ms 380 ms 210 ms 204 ms 258 ms 205 ms 232.40 adguard 98 ms 95 ms 101 ms 97 ms 104 ms 129 ms 103 ms 110 ms 95 ms 111 ms 104.30 neustar 32 ms 30 ms 32 ms 35 ms 31 ms 34 ms 29 ms 28 ms 138 ms 34 ms 42.30 comodo 55 ms 52 ms 51 ms 52 ms 47 ms 48 ms 58 ms 59 ms 48 ms 48 ms 51.80
  - 9y ago
eikenberry 9y ago
What about services which use anycast/geolocation to decide where to serve you data from? They will get bad location data as they will get the location of the resolver. This can have a direct impact on services. An example of my own is from about 10 years ago when Netflix started streaming. We got a Roku and signed up but the service terrible due to the stream stopping to buffer every few minutes. After researching and trying several things I eventually came across the fact that the stream was coming from servers in over a thousand miles away with pretty bad latency between. Long story short, I eventually figured out it was due to my using the level3 resolvers for DNS. As soon as I changed to our ISP's DNS servers it worked great and the data was streaming from very close.
- unethical_ban 9y ago
  I wonder if location data would/could/should be an optional flag in DNS requests, instead of relying on physical location of the resolver.
beaconfield 9y ago
I let it (the story) sit a day after 4/1 just to make sure it wasn't really an April Fools' joke. But today I made it my primary DNS server and it's performing very well. Glad there's another player in the private DNS space.
justicezyx 9y ago
Anecdotally, I know a guy who runs a local Cloud provider in the greater-Beijing area (part of Hebei proveince). He told me Cloudflare has struck a deal with the government to have integration with them, presumably with higher standard than normal tech providers. That might explain why CloudFlare has good performance across the globe, which in a large part related to China.
jsgo 9y ago
Out of curiosity, are there any negatives for everyone to funnel their DNS traffic through a single provider? Might be paranoia, and it may in this case just be putting all of your traffic through company_a vs all of your traffic through company_b scenario, but I've been curious since this was announced.
retirw 9y ago
Hi, could someone explain to me what this DNS stuff is about like I'm 5? How is it related to private browsing?
- ohiovr 9y ago
  DNS is a service that converts easy to remember names like google.com or youtube.com to hard to remember ip addresses so you don't have to. We find it easier to remember names than strings of numbers. So usually your isp assigns their own dns server for you to use automatically and most people don't think about it. Sometimes a DNS server can go bad or become slow and people use services like google's dns services to speed up access to the sites they use. Google could use dns look up information from your computer to know what sites you visit even when you don't search google.com for it. I don't know if they do or not but I was thinking, if I was google I would probably do that. Its not that google needs your browsing habits to find web sites but it can use the querys it recieves to measure the popularity of web sites or web pages. As to why the current interest in DNS I'm not sure. A lot of trust is in DNS and a lot of people don't realize that an evil dns server can make your browser think you are going to good sites but could actually be an imposter. Other annoyances are NXDOMAIN (non existant domain) querys that are hyjacked to serve you ads. Controling DNS servers is a great way for a nation state to censor communication. They could take any site they wish and forward your browser to an automatic service that logs you with other "wrong thinkers". Or just resolve the domain name to null reference. Speed, security, privacy are things to consider for DNS. But like a lot of things on the internet, it all about trust...
timdavila 9y ago
What is the benefit to Google/CloudFlare of providing free DNS resolution? Why do they offer it?
- Isomer 9y ago
  See my reply here: https://news.ycombinator.com/item?id=16733619 https://news.ycombinator.com/item?id=16733619 tl;dr: Google succeeds when people use websearch. Cloudfare succeeds when people use the Internet in general. People use websearch more when the Internet is fast and reliable. ISPs resolvers are frequently not fast nor reliable. Thus if you can improve peoples Internet experience with a better resolver, you improve your core business. No need to track anyone via DNS for this to be successful.
- sseth 9y ago
  Long back when this started, OpenDNS was the largest public DNS provider. And I know at one point they started "hijacking" google requests - you can read this here : http://www.dslreports.com/forum/r21284386-Google-Com-Hijacked-by-OpenDNS http://www.dslreports.com/forum/r21284386-Google-Com-Hijacke.... This was in 2008. They used to also hijack DNS requests to show their own ads. And i am pretty sure many ISPs always played around with DNS in this way. In 2009, Google launched its own Public DNS - the reasons given were to make the web faster and safer, and i think there is some sense in which they have delivered. But I think another reason was defensive - provide an alternative to OpenDNS and to crappy ISP DNSs. In 2014 - OpenDNS stopped using DNS to show ads : https://umbrella.cisco.com/blog/2014/05/29/no-more-ads/ https://umbrella.cisco.com/blog/2014/05/29/no-more-ads/.
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
jradd 9y ago
Thanks, great response times from my NYC droplet. test1 test2 test3 test4 test5 test6 test7 test8 test9 test10 Average quad9 1 ms 2 ms 1 ms 1 ms 1 ms 1 ms 1 ms 1 ms 1 ms 1 ms 1.10 cloudflare 2 ms 1 ms 1 ms 2 ms 1 ms 1 ms 1 ms 2 ms 1 ms 1 ms 1.30 comodo 1 ms 2 ms 2 ms 3 ms 2 ms 1 ms 2 ms 1 ms 1 ms 2 ms 1.70 adguard 2 ms 2 ms 3 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2.10 cleanbrowsing 2 ms 4 ms 2 ms 2 ms 2 ms 2 ms 14 ms 16 ms 2 ms 2 ms 4.80 norton 6 ms 7 ms 7 ms 7 ms 8 ms 7 ms 6 ms 7 ms 7 ms 7 ms 6.90 namecheap 7 ms 7 ms 7 ms 7 ms 7 ms 7 ms 7 ms 7 ms 7 ms 7 ms 7.00 neustar 8 ms 7 ms 7 ms 8 ms 9 ms 6 ms 7 ms 7 ms 7 ms 7 ms 7.30 namecheap2nd 8 ms 8 ms 7 ms 9 ms 9 ms 8 ms 10 ms 8 ms 8 ms 8 ms 8.30 opendns 20 ms 1 ms 1 ms 30 ms 2 ms 8 ms 1 ms 16 ms 15 ms 3 ms 9.70 google2nd 16 ms 1 ms 1 ms 17 ms 1 ms 24 ms 1 ms 16 ms 17 ms 14 ms 10.80 google 17 ms 1 ms 1 ms 17 ms 1 ms 41 ms 1 ms 17 ms 18 ms 15 ms 12.90 cloudflare2nd 1 ms 2 ms 1 ms 1 ms 1000 ms 2 ms 2 ms 1 ms 2 ms 2 ms 101.40 yandex 101 ms 102 ms 104 ms 101 ms 115 ms 103 ms 107 ms 100 ms 105 ms 136 ms 107.40 Not so much from my home ISP: test1 test2 test3 test4 test5 test6 test7 test8 test9 test10 Average namecheap2nd 45 ms 45 ms 44 ms 45 ms 48 ms 45 ms 45 ms 46 ms 48 ms 45 ms 45.60 cloudflare2nd 45 ms 49 ms 48 ms 47 ms 45 ms 44 ms 45 ms 45 ms 46 ms 46 ms 46.00 namecheap 46 ms 48 ms 48 ms 44 ms 45 ms 45 ms 46 ms 45 ms 45 ms 48 ms 46.00 cleanbrowsing 46 ms 46 ms 44 ms 56 ms 45 ms 44 ms 48 ms 46 ms 44 ms 46 ms 46.50 google2nd 49 ms 47 ms 47 ms 45 ms 51 ms 47 ms 46 ms 44 ms 43 ms 46 ms 46.50 comodo 46 ms 47 ms 48 ms 49 ms 46 ms 47 ms 44 ms 45 ms 47 ms 50 ms 46.90 adguard 49 ms 48 ms 45 ms 46 ms 46 ms 48 ms 49 ms 48 ms 48 ms 48 ms 47.50 google 46 ms 49 ms 47 ms 47 ms 45 ms 47 ms 47 ms 49 ms 44 ms 67 ms 48.80 opendns 47 ms 46 ms 47 ms 64 ms 48 ms 49 ms 46 ms 64 ms 64 ms 48 ms 52.30 cloudflare 44 ms 48 ms 45 ms 50 ms 48 ms 110 ms 45 ms 48 ms 45 ms 47 ms 53.00 quad9 46 ms 49 ms 45 ms 47 ms 49 ms 153 ms 46 ms 45 ms 48 ms 46 ms 57.40 neustar 66 ms 66 ms 66 ms 67 ms 66 ms 66 ms 66 ms 67 ms 66 ms 67 ms 66.30 norton 91 ms 67 ms 67 ms 67 ms 66 ms 66 ms 67 ms 66 ms 67 ms 67 ms 69.10 yandex 176 ms 279 ms 176 ms 174 ms 188 ms 178 ms 179 ms 176 ms 174 ms 179 ms 187.90
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
Jaruzel 9y ago
Hmmm. Off the bat, CloudFlare ICMP for me is worse than Google: http://www.jaruzel.com/files/ICMP-CloudFlareDNS-vs-Google-tetx.png http://www.jaruzel.com/files/ICMP-CloudFlareDNS-vs-Google-te... I'll stick with Google I think. UK/London btw.
pouetpouet 9y ago
How do other services compare? Like https://blog.uncensoreddns.org/dns-servers/ https://blog.uncensoreddns.org/dns-servers/ https://dns.watch/ https://dns.watch/ https://ipredator.se/page/services#service_dns https://ipredator.se/page/services#service_dns
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
ManishKrishna 9y ago
Will website name in certificate shared by server during handshake kill the DNS over https purpose?
bitrazor123 9y ago
but why would you compare something like cloudflare which is a DDOS prevention service to DNS service?
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
v0id24 9y ago
Moscow, Russia test1 test2 test3 test4 test5 test6 test7 test8 test9 test10 Average adguard 6 ms 8 ms 4 ms 8 ms 11 ms 5 ms 7 ms 4 ms 4 ms 22 ms 7.90 google2nd 4 ms 4 ms 5 ms 22 ms 30 ms 18 ms 3 ms 27 ms 3 ms 3 ms 11.90 yandex 5 ms 9 ms 5 ms 9 ms 87 ms 50 ms 9 ms 9 ms 5 ms 60 ms 24.80 google 3 ms 18 ms 3 ms 20 ms 29 ms 165 ms 3 ms 18 ms 3 ms 19 ms 28.10 cloudflare2nd 45 ms 44 ms 46 ms 44 ms 46 ms 44 ms 44 ms 45 ms 65 ms 48 ms 47.10 quad9 47 ms 48 ms 47 ms 48 ms 46 ms 57 ms 46 ms 44 ms 46 ms 45 ms 47.40 opendns 45 ms 47 ms 46 ms 59 ms 47 ms 45 ms 47 ms 49 ms 51 ms 44 ms 48.00 norton 52 ms 49 ms 53 ms 52 ms 58 ms 56 ms 51 ms 48 ms 54 ms 52 ms 52.50 cleanbrowsing 96 ms 48 ms 60 ms 46 ms 49 ms 46 ms 45 ms 49 ms 44 ms 46 ms 52.90 neustar 54 ms 56 ms 52 ms 59 ms 50 ms 57 ms 55 ms 57 ms 59 ms 54 ms 55.30 comodo 80 ms 88 ms 73 ms 113 ms 79 ms 75 ms 75 ms 74 ms 74 ms 90 ms 82.10 cloudflare 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000.00
deleted 9y ago
[deleted]
delhanty 9y ago
From Waimanalo, Hawaii cloudflare times out: test1 test2 test3 test4 test5 test6 test7 test8 test9 test10 Average 192.168.50.1 154 ms 157 ms 154 ms 154 ms 154 ms 154 ms 156 ms 158 ms 155 ms 184 ms 158.00 cloudflare 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000.00 google 106 ms 82 ms 80 ms 158 ms 113 ms 148 ms 82 ms 107 ms 106 ms 81 ms 106.30 quad9 91 ms 99 ms 111 ms 106 ms 90 ms 97 ms 89 ms 91 ms 89 ms 88 ms 95.10 opendns 105 ms 81 ms 96 ms 120 ms 82 ms 110 ms 81 ms 115 ms 105 ms 83 ms 97.80 norton 82 ms 80 ms 82 ms 94 ms 84 ms 91 ms 82 ms 80 ms 82 ms 83 ms 84.00 cleanbrowsing 135 ms 158 ms 245 ms 136 ms 132 ms 132 ms 133 ms 138 ms 133 ms 145 ms 148.70 yandex 287 ms 389 ms 256 ms 256 ms 258 ms 256 ms 258 ms 257 ms 258 ms 255 ms 273.00 adguard 290 ms 270 ms 319 ms 295 ms 433 ms 340 ms 261 ms 351 ms 290 ms 264 ms 311.30 neustar 86 ms 82 ms 83 ms 84 ms 80 ms 90 ms 80 ms 81 ms 84 ms 83 ms 83.30 comodo 149 ms 148 ms 152 ms 152 ms 153 ms 148 ms 150 ms 147 ms 148 ms 151 ms 149.80
unixhero 9y ago
Cloudflare it is then!
deleted 9y ago
[deleted]

860 points by nykolasz 9y ago

I think we'll start seeing the standard configuration of 1.1.1.1,8.8.8.8 everywhere. Google/Cloudflare tackled the UX of free DNS spectacularly with these gold IP addresses. It's the primary reason I use them instead of OpenDNS, which was an earlier player in this space.

deleted 9y ago
[deleted]
JepZ 9y ago
I wonder how much Cloudflare paid/pays for the 1.1.1.1
- larrybud 9y ago
  Read the announcement: https://blog.cloudflare.com/announcing-1111/ https://blog.cloudflare.com/announcing-1111/ "APNIC's research group held the IP addresses 1.1.1.1 and 1.0.0.1. While the addresses were valid, so many people had entered them into various random systems that they were continuously overwhelmed by a flood of garbage traffic. APNIC wanted to study this garbage traffic but any time they'd tried to announce the IPs, the flood would overwhelm any conventional network. We talked to the APNIC team about how we wanted to create a privacy-first, extremely fast DNS system. They thought it was a laudable goal. We offered Cloudflare's network to receive and study the garbage traffic in exchange for being able to offer a DNS resolver on the memorable IPs. And, with that, 1.1.1.1 was born."
  - stordoff 9y ago
    Have they discussed what this means in terms of the privacy promises? What "garbage traffic" does APNIC have access to in order to study?
    - burntwater 9y ago
      I think that's part of the point of all this - to find out what all that garbage traffic is.
    - X-Istence 9y ago
      HA failover pings that get routed rather than being sent to their peer, captive portal requests that no longer exist. Things of that nature. There is a lot of documentation, Cisco being one of the primary at-fault companies, that uses 1.1.1.1 for all kinds of various internal configuration. Given hundreds of thousands of devices configured with 1.1.1.1, even a simple misconfiguration on just 10% of those is a lot of garbage traffic.
- notreallyauser 9y ago
  No cash outlay. Read the blog, but tl;dr is that it's quid pro quo as the owners can't afford to stand it up due to the volume of junk traffic (but want to, to study the junk) -- cloudflare can and will let the owner study the junk. What cloudflare don't say in any of their materials that I've seen is the agreement is for an initial 5 years, so YMMV after that.
keeperofdakeys 9y ago
Be careful with that, Google DNS (as an example) will start ignoring your DNS requests if you go over the rate-limit. Not an issue for home users, but an issue for any sizeable business.
- noonespecial 9y ago
  I have run into this in the wild. Presented as a weird, intermittent, "hey the internet is out" at the office around the same time each afternoon.
- sytse 9y ago
  Yep, don't configure your servers with Google's public DNS servers but use the ones your public cloud provides.
- r1ch 9y ago
  Google DNS also has issues resolving DNSSEC-enabled Cloudflare domains.
  - fanf2 9y ago
    Interesting! Do you have any examples?
    - r1ch 9y ago
      Hmm, it seems like they may have fixed it, I can't seem to reproduce the problem I had (it would randomly fail to resolve CAA records for DNSSEC enabled domains).
- mjevans 9y ago
  Doesn't this just mean that you should be running your own caching resolver so that requests for common things don't constantly hit the upstream server? For those same common sites it should also be better performance anyway.
- vamin 9y ago
  Do we know yet if CloudFlare has similar rate limits?
brightball 9y ago
OpenDNS still has a lot of value beyond just free DNS service though. When I was very active in dealing with phishing, we found that OpenDNS flagged phishing sites about 4 times faster than any other DNS provider, which I assume is because of PhishTank. It's the primary reason I recommend it to my parents. Between that and some of the content filtering options you can get with the paid plan, I find that it's a very full-featured option for homes with young kids. I'm pretty sure you get to control the logs on the paid plan too. Need to double check.

cbg0 9y ago

I wasn't aware of Quad9, it seems like a pretty great option for those that are easy targets of scams/phishing.

akerro 9y ago
Quad9 is supported/funded by City Of London Police, the same police that cooperates with ad companies to track people online. https://www.theguardian.com/media-network/media-network-blog/2014/apr/17/police-advertising-industry-copyright-infringement https://www.theguardian.com/media-network/media-network-blog... Keep away from this.
- cbg0 9y ago
  Actually Quad9 seems to be a non-profit, founded by IBM, PCH and GCA (of which the City of London Police is a founder). The simple fact that it's supported by the CoLP doesn't seem sufficient to point out that Quad9 should be avoided since it will track people online.
- mft_ 9y ago
  Interesting question: would I rather protect my elderly Mum from known malicious domains potentially trying to scam/phish, or from potential tracking and ad targeting? (Actually, it's not really a difficult choice at all, is it?)
  - foepys 9y ago
    Why not install an ad blocker with a malware blocking list in her browser?
  - hollander 9y ago
    Why not both? You're smart enough I guess to find a good solution.
- bogomipz 9y ago
  Quad9 is a consortium of 3 founding companies, none of which is the London Police Department. Additionally nowhere in your link is either Quad9, IBM, PCH or GCA mentioned. Please stop spreading and disinformation and FUD. See: https://www.quad9.net/about/ https://www.quad9.net/about/

dbg31415 9y ago

dig +noall +stats @1.0.0.1 news.ycombinator.com; dig +noall +stats @1.1.1.1 news.ycombinator.com; dig +noall +stats @208.67.220.220 news.ycombinator.com; dig +noall +stats @208.67.222.222 news.ycombinator.com; dig +noall +stats @8.8.4.4 news.ycombinator.com; dig +noall +stats @8.8.8.8 news.ycombinator.com Fixed? =P I removed some of the records form the article after reading some of the comments here. Cloudflare, Google, and OpenDNS only. Kind of cool, I switched it up and ran it against 10 sites I frequent... was pretty impressed to see how well OpenDNS was doing.

Maledictus 9y ago
That tests ICMP echo requests not name resolution.
- Dolores12 9y ago
  That is what original test was testing.
  - Buge 9y ago
    What? It says >Our test was very simple and we performed 70 DNS lookups That's not ICMP.
    - Dolores12 9y ago
      Well, the article says so, but they actually measured icmp response. All major domains are in DNS cache anyway. If you look at Yandex result you see it performed very poorly. Why does it resolve popular domains so slow? The reason is it has one server and it is located in Moscow. So i would say icmp is good proxy to actual performance.
      - Buge 9y ago
        It would be a measure of ping + cache latency. That's still different than just ping. And is your point that the tested sites aren't popular in Russia? >for different popular domains (google, facebook, twitter, gmail, etc) google.com facebook.com and twitter.com are all in the top 50 sites in Russia[1]. And gmail.com is number 6000 globally[2], so it's unpopular everywhere, not just Russia. Popular sites in Russia tend to be popular elsewhere, and vice versa. [1] https://www.similarweb.com/top-websites/russian-federation https://www.similarweb.com/top-websites/russian-federation [2] https://www.alexa.com/siteinfo/gmail.com https://www.alexa.com/siteinfo/gmail.com

yread 9y ago

It would be more interesting to see how are they doing for some websites in the long tail, try the 900th, 9000th, and 90000th most popular sites instead of the top. And try some locations which are not actual datacenters?

iforgotpassword 9y ago
And test consistency. Stddev, and get the worst results from 1000 runs.
- jobigoud 9y ago
  Worst result can be an outlier, maybe better to use the 95th percentile or something.

sajal83 9y ago

https://pulse.turbobytes.com/results/5ac1f967ecbe4078c200ee4a/ https://pulse.turbobytes.com/results/5ac1f967ecbe4078c200ee4... Cloudflare consistently times out from these networks. Netherlands - AS13127 Philippines - AS135132 Thailand - AS17552 (One of the largest consumer internet providers) US - AS7018 (AT&T)

iforgotpassword 9y ago
Probably some smart people working there using 1.1.1.1 for internal stuff instead of one of the reserved subnets (private or "for documentation").
therealmarv 9y ago
I'm sure this is because 1.1.1.1 does not work everywhere well. Maybe with 1.0.0.1 it will work more reliable.
- sajal83 9y ago
  Yep you are right right. ~# mtr --report --address 192.168.2.2 1.1.1.1 Start: Mon Apr 2 16:53:31 2018 HOST: apu Loss% Snt Last Avg Best Wrst StDev 1.|-- 192.168.2.1 0.0% 10 0.9 1.1 0.9 1.2 0.0 2.|-- 10.137.128.1 0.0% 10 11.3 12.8 10.7 17.1 1.8 3.|-- 10.246.253.133 0.0% 10 7.7 8.2 7.5 9.1 0.0 4.|-- 10.185.94.203 0.0% 10 9.1 8.4 6.9 9.4 0.6 5.|-- 10.185.94.25 0.0% 10 9.5 8.7 7.7 10.0 0.5 6.|-- 61-91-220-101.static.asia 0.0% 10 11.7 11.7 8.6 25.7 5.2 7.|-- 58-97-82-116.static.asian 0.0% 10 10.7 10.2 8.6 15.4 1.9 8.|-- ppp-171-102-254-81.revip1 0.0% 10 9.2 9.2 7.1 10.8 0.9 9.|-- ppp-171-102-250-134.revip 0.0% 10 8.4 10.0 8.4 11.3 0.7 10.|-- ppp-171-102-250-149.revip 0.0% 10 9.0 9.7 9.0 10.9 0.3 11.|-- ??? 100.0 10 0.0 0.0 0.0 0.0 0.0 ~# mtr --report --address 192.168.2.2 1.0.0.1 Start: Mon Apr 2 16:54:05 2018 HOST: apu Loss% Snt Last Avg Best Wrst StDev 1.|-- 192.168.2.1 0.0% 10 1.2 1.1 0.8 1.3 0.0 2.|-- 10.137.128.1 0.0% 10 12.1 12.8 9.2 18.2 2.4 3.|-- 10.246.253.133 0.0% 10 9.8 9.0 7.5 14.7 2.0 4.|-- 10.185.94.203 0.0% 10 4.4 7.9 4.4 8.8 1.2 5.|-- 10.185.94.17 0.0% 10 9.2 9.1 7.2 10.3 0.9 6.|-- 61-91-220-55.static.asian 0.0% 10 9.7 10.6 8.0 17.2 2.6 7.|-- 58-97-82-120.static.asian 0.0% 10 10.5 9.7 8.2 11.2 0.7 8.|-- ppp-171-102-254-65.revip1 0.0% 10 10.5 9.7 8.8 10.7 0.0 9.|-- ppp-171-102-254-227.revip 0.0% 10 8.9 13.1 8.8 44.0 10.8 10.|-- 61-91-213-130.static.asia 0.0% 10 10.9 9.8 8.3 10.9 0.6 11.|-- TIG-Net242-40.trueinterga 0.0% 10 15.0 14.1 10.9 16.1 1.8 12.|-- TIG-Net245-243.trueinterg 0.0% 10 38.1 38.0 36.4 40.6 0.9 13.|-- 13335.sgw.equinix.com 0.0% 10 37.4 38.6 36.4 48.5 3.5 14.|-- 1dot1dot1dot1.cloudflare- 0.0% 10 36.9 36.3 35.0 36.9 0.5 Edit: Formating

MikeGale 9y ago

I presume that Google uses this as part of it's surveillance operation.

gaius 9y ago
Yes, they aren’t providing 8.8.8.8 out of the goodness of their black hearts
- HenryBemis 9y ago
  And I wanted to add a similar comment, why on earth would any privacy-oriented person would use Google's 8.8.8.8 when there are other options out there? Oh, and I definitely don't buy this for Google: "The Privacy option above is based on the providers promise to do not log or share your DNS requests."
Isomer 9y ago
Google has a separate, stricter, privacy policy for Google Public DNS: https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy Basically there are two log files kept: - One for up to 48 hours which contains IP addresses, which is used for handling abuse. - One is permanent which doesn't contain any personal identifying information (eg IP addresses), which is used for things like internal performance monitoring, load testing, and tracking frequency of longer term abuse etc. Google provides Google public DNS because if you see the internet as being slow because of poor DNS performance, then you don't use websearch as much. Google doesn't need to use Google Public DNS to track users, and would rather not have the information (as it makes it available for government requests etc which are a major pain to deal with). But running a large scale recursive DNS server tends to attract a _lot_ of abuse, both intentional, and unintentional as I'm sure 9.9.9.9 and 1.1.1.1 are discovering. Google provides Google Public DNS because a lot of ISPs provide extremely poor default recursive nameservers (having tiny caches, dropping queries due to overload, not implementing IPv6, DNSSEC validation, EDNS0 payload size, or other important modern DNS features. Some ISPs also hijack domains for their own purposes, or "stretching" DNS TTLs etc) so providing a better alternative to improve overall Internet use is clearly in Google's best interest. Having other public resolvers, with different trade offs is clearly better for everyone, including Google as long as they are reliable, trustworthy, and provide low latency responses. Good luck to everyone who's joining in the fun of running a planet scale recursive DNS server. (Disclaimer: I have previously worked on Google Public DNS, but no longer do)

nvarsj 9y ago

Just run your own DNS resolver if you value your privacy. With prefetching and caching there will be little difference in performance.

jamra 9y ago
But your DNS will have to query other DNS providers so if you’re the only one using it, it won’t be private.
- Daviey 9y ago
  There is 2 main different ways, one which does what you say - the other i'd say is pretty much OK. If your local DNS server is merely querying an upstream resolver (like 1.1.1.1 / 8.8.8.8) on your behalf, then yes - it is no different. If however, you query the root nameservers for the glue record for a domain and query the domain's own nameservers directly, then it is pretty good... As you are neither querying your ISP or TheMan.. which means that logically only the domain nameserver owner knows what queries you made (and you are probably hitting that domain in a moment anyway!). (The caveat is that some ISP's do transparent DNS proxying.. in which case, you have much larger trust issues with your ISP and need to take greater measures!) That said.. I cba with that.
  - phire 9y ago
    > (The caveat is that some ISP's do transparent DNS proxying.. in which case, you have much larger trust issues with your ISP and need to take greater measures!) I once had an ISP which did transparent http proxying. You could theoretically query an external DNS server and get back the correct result, but it would intercept your http connection, discard the ip address you were trying to connect to then do a new DNS lookup to the ISP's DNS server on the HOST header. Took me ages to work out what was going on with the various issues it was causing. I dumped that ISP like a rock after they refused to disable that caching proxy, which they claimed was only there to improve customer experience.
    - stordoff 9y ago

bjslade 9y ago

Besides response time, the next level of comparison is how well geo-DNS-based services (global load balancing, etc.) support these resolvers. AFAIK 8.8.8.8 gives decent results in most places, though I've seen suboptimal US-centric results from Quad9 in Asia. Support for RFC 7871 (Client Subnet in DNS Queries) comes into play here too.

dbg31415 9y ago
I always used 8.8.8.8, since I couldn't remember OpenDNS's IPs. But just found out today that, from Sydney, OpenDNS and Cloudflare are kicking Google's ass for speed. 8.8.8.8 is on par with my ISP-default DNS.
- jg2leet 9y ago
  Ever since The Great Comcast DNS Outage of 2010, I've had the OpenDNS IPs burned into my memory from telling so many people. I like the fact that you can sign up for OpenDNS and customize some of the filtering (ads, spam/malware, etc.) They used to have crappy handling of nxdomains (by default) redirecting you to a website with ads, but I believe that's no longer the case?
  - coaxial 9y ago
    As250 is running a free DNS server with adblocking enabled FWIW: https://twitter.com/as250/status/790593201832857601?s=20 https://twitter.com/as250/status/790593201832857601?s=20 Pihole is also a great alternative if you have a spare raspi lying around.
    - mynameisvlad 9y ago
      > if you have a spare raspi lying around. Really, if you have a spare computer of any type. I run it on a VM and it works just fine. It was made for Raspberry Pis but it'll work on any system.

enz 9y ago

9.9.9.9 does not seem to be geographically-aware. Here are the resolutions for the same domain name (CNAME referring to the hopefully closest edge server), from France. % dig [domain] @8.8.8.8 +short [id].kxcdn.com. p-frpa00.kxcdn.com. # France % dig [domain] @9.9.9.9 +short [id].kxcdn.com. s-us-ca00.kvcdn.com. # America p-ussj00.kxcdn.com. % dig [domain] @1.1.1.1 +short [id].kxcdn.com. p-frpa00.kxcdn.com. # France % dig [domain] @ns0.fdn.fr +short # My ISP resolver [id].kxcdn.com. p-frpa00.kxcdn.com. # France

swinglock 9y ago
A more comprehensive benchmark would also measure a ping or HTTP request to each resolved IP take to this into account. Actual browser performance is very skewed now without it.
- q3k 9y ago
  And throughput to the content as well - RTT (even time to first byte) by itself does not a benchmark make.
sajal83 9y ago
9.9.9.9 does not pass along EDNS client subnet resulting in wrong geo-located responses. It is their "feature".
- bjslade 9y ago
  According to the FAQ[1], they also offer 9.9.9.10, which passes client subnet at the cost of other features. [1] https://www.quad9.net/faq https://www.quad9.net/faq
  - sajal83 9y ago
    Fair enough, but most users won't care enough look it up and use 9.9.9.10 instead of 9.9.9.9 if they want better performance in exchange for allegedly lower privacy. It appears 1.1.1.1 also does not pass client-subnet, atleast not by default. Queries to my authoritative from Google always includes client subnet, OpenDNS required request for whitelist. For Cloudflare its unclear.

swinglock 9y ago

You can run a benchmark of your own using namebench. I recommend you uncheck the options for the included nameservers or it will take a very long time to run and enter only the DNS servers you want to test manually. It can use your Firefox browsing history as a source for domains to resolve. Ignore the "incorrect" and "hijacked" warnings, I think the program has hardcoded, outdated IP ranges for popular services which causes those. https://code.google.com/archive/p/namebench/ https://code.google.com/archive/p/namebench/

agumonkey 9y ago
for the curious arch user, it's on AUR ps: namebench is quite extensive. thousands of queries and a nice and long report. enjoy it

leowinterde 9y ago

Quad9 has several IPs and different services, see (https://www.heise.de/imgs/18/2/3/1/7/9/4/7/quad9-feature-matrix-72311e6ae96e13b1.png https://www.heise.de/imgs/18/2/3/1/7/9/4/7/quad9-feature-mat...). For some reason this is hidden on the quad9 website.

DesertBattery 9y ago
dig @9.9.9.11 +short ;; connection timed out; no servers could be reached dig @9.9.9.12 +short ;; connection timed out; no servers could be reached
mynameisvlad 9y ago
It's in their FAQ: https://www.quad9.net/faq/#Is_there_a_service_that_Quad9_offers_that_does_not_have_the_blocklist_or_other_security https://www.quad9.net/faq/#Is_there_a_service_that_Quad9_off... Seems they've sunset .11 and .12, but .10 is still up.

jimaek 9y ago

If you want to see the performance from even more locations here is a more detailed benchmark https://www.cdnperf.com/tools/cdn-latency-benchmark/0d8b484e2b77537487e5170c4c38647e https://www.cdnperf.com/tools/cdn-latency-benchmark/0d8b484e... Or you can even use a CLI https://perfops.net/cli https://perfops.net/cli to run custom tests from any location

djsumdog 9y ago

I feel like people forgot about how CloudFlare, Google, et. al. can new effectively censor content they don't agree with: https://fightthefuture.org/article/the-new-era-of-corporate-censorship/ https://fightthefuture.org/article/the-new-era-of-corporate-... ..and even though CloudFlare back pedaled on that particular decision somewhat, it still happened. If you really want something fast and secure, run your own caching DNS that uses root DNS servers.

syshum 9y ago
This is the most alarming thing about this trend that has been happening for the last few years The Internet should be DECENTRALIZED yet it seems we are attempting to do everything in our power to ensure only a handful of companies control access to all information. For what to save 3 ms off a ping time? Facebook is in hot water over privacy issues, but that is just the tip of the ice berg Google, AWS, Cloudflare are IMO are larger threat then facebook ever could be.
- duskwuff 9y ago
  You're barking up the wrong tree here. DNS is already an inherently centralized service -- using one company's resolvers instead of another doesn't change that.
  - syshum 9y ago
    Yes and No the problem with Cloudflare is not simply the fact that DNS is centralized, it is a combination of all their services that is concerning for Cloudflare, between the DDOS Proxy, the CDN, the Other Services, and now DNS that is a lot of services in a single basket, so while it is true that dns is some what centralized, having all traffic and all services dependent upon a single company seems to be a bad idea to me But clearly everyone sees not issue with it provided they "claim" to providing a "privacy first" service for free (ya riiiiiggghhhhttttt and Facebook cares about their users privacy as well) and they have better performance, who cares what the long term effects are... We should be working to make DNS less centralized, or replace it with something less centralized, not moving to DNS over HTTP to a few "cloud" providers who also control all of the content...

userbinator 9y ago

I wonder how well 4.2.2.x compares... Then again, a few ms of difference is unlikely to make any noticeable effect in real-world use cases where clients already have local DNS caching and the bulk of the time is data transfer, not DNS lookups.

jsjohnst 9y ago
> the bulk of the time is data transfer, not DNS lookups You’d be surprised.
jpalmer 9y ago
In my tests 4.2.2.1 performs 50% faster than 1.1.1.1 and is twice as fast as 8.8.8.8.
vavrusa 9y ago
4.2.2.x (Level3) is one of those resolvers hijacking negative answers and redirecting your to their "search pages".

lucb1e 9y ago

Which ISPs are so bad that you want to use external services, which are further in distance than your ISP, for speed? When I test with my ISP, they beat all of these services (both IPv4 and IPv6). They're simply closer to me in terms of hops. My router is another story though. The Fritzbox (>200eur router) adds 6ms of latency, and that's what is advertised over DHCP. (Might still be fine, since cached queries are faster than the ping time to the ISP.) Note that my tests were all with uncached queries (random subdomains of a domain), so it always had to go out and ask an external server (though it could cache the NS record for the domain).

isostatic 9y ago
I've had several ISPs in different countries that do horrible things. Not using NXDomain is one, but I've had some that return NXdomain when they shouldn't, then cache that result! 8.8.8.8 is consistent and easy to remember, and now so is 1.1.1.1
coaxial 9y ago
My isp got the brilliant idea of rolling their own YouTube cache servers. It's great in theory but in or active they're under powered and so at peak hours I can't even stream 240p on my 500mbits connection. I've had to block their cache servers in my firewall for YouTube to be butter smooth at 1080p consistently. Another example is bell Canada who used to mine your DNS queries to profile you for ads, or ISPs that high jack the nxdomain result to send you sponsored results of vaguely similar sounding websites.
- gruez 9y ago
  >My isp got the brilliant idea of rolling their own YouTube cache servers Are YouTube videos not served using https? Sounds like it's google/YouTube servers but they're underprovsioned
- mino 9y ago
  It is common for ISP to host instances of the Google Global Cache (GGC, see https://peering.google.com/ https://peering.google.com/) which are used for many Google services, most importantly YouTube. In fact, in many cases Google itself "suggests" to ISP that they host a few GGC servers. They are directly monitored by Google, and the ISP has basically no say in how they are run. Capacity is managed by Google directly.

Klasiaster 9y ago

The OpenNIC project has a database of community/private DNS servers with certain standards. https://www.opennic.org/ https://www.opennic.org/

qwerty456127 9y ago

Is there a tutorial on setting up your own? I've got a huge hosts file and would like it to affect all the devices at my home but setting up a DNS server always seemed high-level black magic to me.

AntonyGarand 9y ago
https://pi-hole.net https://pi-hole.net
ronsor 9y ago
On Linux, the easiest thing to do is to install busybox; it has a DNS server, dnsd. It will accept your hosts file directly.
jedisct1 9y ago
https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy

Isomer 9y ago

Things to look for in comparing recursive DNS servers performance: The 95%ile DNS response time for cached/uncached names. The 95%ile DNS response when one/some of the authoritative nameservers is "lame" or not responding. (better yet, 99%ile, but that requires even more queries...) The average packet loss to the nameserver. (As many resolvers use the default of a 5s timeout, better resolvers use a 1s timeout, the best stub resolvers would use a dynamic timeout, but afaik, none do...). Do they implement DNSSEC validation? What is their story for domains that break DNSSEC (eg: https://www.internetsociety.org/resources/deploy360/2014/case-study-comcasts-dnssec-implementation/ https://www.internetsociety.org/resources/deploy360/2014/cas...)? Do they implement RFC7129 (authenticated denial of existence)? This can be used to prevent your service being used to attack an authoritative nameserver, prevents leaks of useless domains (eg machines looking up untitled.pdf as a domain), and allows you to return NXDOMAIN with much lower latency, making DNS search paths faster. RFC8020 (NXDOMAIN: There is really nothing underneath) would be another example where you can prevent leaking names, and return faster responses from a smaller cache (although I admit I've never seen anyone implement RFC8020 yet). Will they accept (signed) responses into their cache in the additional section? Again, this can significantly reduce the time for uncached responses. [hint: These are good reasons you should sign your domain, it can make things faster and reduce load on your authoritative nameserver!] What is their story for domains that need a cache flush? Do they (correctly) implement IPv6 from the recursive to the authoritative nameservers? Do they (correctly) implement IPv6 from the stub to the recursive nameserver? How big is their cache? How long do things stay in their cache? There's no point being close to a nameserver with an empty cache. Querying www.google.com isn't really going to tell you much about their cache depth, nor is the Alexa 1M. You need a very very wide variety of names. Do they provide good GeoIP responses? There's no point in getting an answer for the middle of the US in <1ms if you happen to be 300ms away in Asia somewhere. The DNS response was fast, but the webserver it sent you to is going to give you abysmal performance. This is often done with EDNS0-Client-Subnet, but it can also be fudged by making the outbound IPs for the iterative requests being diverse enough for different localities. Do they "lie" about names? In what circumstances do they lie? Do they NXDOMAIN malicious domains? adult websites? ad domains? random websites? Do they redirect ad websites to their own ad farm? How do their lies handle DNSSEC? Do they perform QNAME minimalisation to help protect your queries from servers that don't need it? What other features do they implement to make sure their cache is never poisoned? What is their abuse plan? If I send them a vast number of queries what happens? Do they send back TrunCated responses and force me over TCP? Will they respond with SERVFAIL? Or will they drop the queries? Or will they pass them all through to the authoritative nameservers? Do I need to do anything (other than stop sending abusive amounts of load) to be unblocked? What if the reason I'm sending a large number of queries is because I'm a carrier grade NAT IP pool and I have one broken/bad user? What is their reliability story? Is it expected that they will go down for 10 minutes every now and again? What do they do about general Internet Hygiene? Do they have protects against being used for reflection attacks? Do they do preemptive lookups to keep their cache warm or is someone always guaranteed to have to wait for the full resolution? How do they make sure they don't accidentally DoS authoritative nameservers with preemptive resolutions? Things not to look for: ICMP/mtr times are essentially meaningless, except as providing general information about routing decisions. The mean response time, as it tends to be washed out by cached response times, and what you don't care about is if it takes 15ms or 17ms on average, as you can't perceive the difference. What you _do_ care about is if one nameserver has 1/5000 queries which take >1s as that will become a frequent noticeable problem when your surfing. Just looking at a few common names that are likely to be in the cache. Yes, those are important, but as with anything at scale, it's the long tail that's actually interesting and will dominate your perception of performance. You can set up your own domain, and search for random strings and force the full end-to-end query flow. (Beware about wildcard domains for this, if your domain is signed, in theory the nameserver could synthesize responses without going back to your nameserver). Where are your vantage points for measurements? Many people appear to measure from places like AWS zones, and then report spectacular performance for DNS servers also hosted in the same AWS zones – despite most of their users not being hosted there. Hmm, I'm sure there's more, but that's off the top of my head. (Disclaimer: Once upon a time, I was one of the engineers oncall for Google Public DNS, so I have Opinions)

deleted 9y ago

[deleted]

cagenut 9y ago

Mentally you need to add a big asterisk to tests of CDNs, and by extension "dns done like a cdn" from VPS provider networks (content networks). That's not where users come from (eyeball networks), and therefore not where they focus their efforts in peering and route-optimizing.

halayli 9y ago

This tests the performance / distance between vps data centers and the dns server's data centers. imho it's better to have a test web page that consumers visit and establishes a tcp connection to those dns services and estimate the rtt of a single packet from the time it took to establish the connection, or test via the https interface for services that support it.

jsjohnst 9y ago
While I whole-heartedly agree with your objection, I question the solution. How do you get high accuracy timing of DNS resolution in JavaScript inside the browser?
- halayli 9y ago
  It's an estimate of rtt + dns resolution. The challenge in providing a good dns service is more about having nodes closer to the user than the dns resolution step itself because that in theory is almost constant for cached responses (it's usually in the microseconds) and when it's not cached the response time is really dependent on recursive querying of other dns servers. So the dns resolution can me estimated by measuring it from a data center manually and subtracting the rtt and use that as a constant. To estimate the rtt, you can do an xhr request and grab the connectStart and connectEnd using window.performance API keeping in mind it takes 3 rtt to do the handshake. Note that the request will fail for services that don't provide https support but that's ok because we just want to measure connect. The reason cloudflare has a better performance is most likely because they have better coverage and not because their servers are faster. Faster servers are a small factor in the final response time. For services that provide https support you can accurately measure the connect and response time of the XHR request using window.performance interface and subtract the dns resolution of the request. Also if you do the request twice, the second time is likely to have a dns and connect time = 0.
- falcolas 9y ago
  Not a JavaScript developer, but if they can do timings fine enough to run Meltdown attacks in JS, I think they can safely and accurately measure network timings.

tambre 9y ago

Unfortunately no tests for IPv6 connections. Disappointing considering that all DNS traffic I generate will be over IPv6.

christogreeff 9y ago

No tests for Africa?

mtgx 9y ago

OpenNIC offers DNSCrypt. https://www.opennic.org/ https://www.opennic.org/

paulcarroty 9y ago

I switched all my devices to CloudFlare 'cause it 2x faster than Google DNS in my location - Europe.

patrickaljord 9y ago
I'm in Europe too which is in Paris and Google DNS is way faster at 4ms vs 15ms for cloudflare.

sabujp 9y ago

google is faster for me in the bay area from comcast network. Using both ping and dig for testing

ralfm 9y ago

Why is Montreal abnormally high for all services?

Thaxll 9y ago
It goes to NYC ...

ralfm 9y ago

Why is Montreal reporting abnormally high response times across the board? For example: # Cloudflare Toronto 3.42ms vs. Montreal 17ms; # Google Toronto 9.42ms vs. Montreal 16.71ms.

concatime 9y ago
I live in Montréal, and I saw the same tendency. Cloudflare has a datacenter here. Waiting for a tangible explanation…
- betaby 9y ago
  Are you using BIG ISP or small? Big guys don't peer at QIX and drag your traffic to US. On other side, smaller players peer at QIX https://qix.ca/members https://qix.ca/members
betaby 9y ago
Perhaps that particular test setup doesn't go to QIX where both of them are present. Cloidflare much faster from QIX peering nonetheless.

monochromatic 9y ago

Does anyone actually believe that google isn’t hoovering up personal data with its DNS service?

charleslmunger 9y ago
https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy
- kakarot 9y ago
  we don't keep personally identifiable information We all know what that means. "Anonymous" user IDs that can trivially be traced when combined with another database.
  - hahainternet 9y ago
    Except that if you click the link, that's not what this means.
    - kakarot 9y ago
      I read the policy before quoting it... How can I verify that's not what it means? It's all about subtlety in language. It's just a fact that centralized DNS servers are a bad idea and cannot be trusted, regardless of what it very carefully says on a policy page or whatever speed gains you could get. It's a broken system and I have no reason to trust Google with even more data.
jeremy7600 9y ago
All this tasty data: Request domain name, e.g. www.google.com Request type, e.g. A (which stands for IPv4 record), AAAA (IPv6 record), NS, MX, TXT, etc. Transport protocol on which the request arrived, i.e. TCP, UDP, or HTTPS Client's AS (autonomous system or ISP), e.g. AS15169 User's geolocation information: i.e. geocode, region ID, city ID, and metro code Response code sent, e.g. SUCCESS, SERVFAIL, NXDOMAIN, etc. Whether the request hit our frontend cache Whether the request hit a cache elsewhere in the system (but not in the frontend) Absolute arrival time in seconds Total time taken to process the request end-to-end, in seconds Name of the Google machine that processed this request, e.g. machine101 Google target IP to which this request was addressed, e.g. one of our anycast IP addresses (no relation to the user's IP)

vermaden 9y ago

Google and Privacy=Yes ... sure.

reaperducer 9y ago

What I don't understand is how these services are offered at apparently no cost. Sure, I expect Google is slurping all of my connections to help build an ad profile on me. But what about the other companies? They've got to keep the lights on somehow.

Isomer 9y ago
See my other reply here: https://news.ycombinator.com/item?id=16733619 https://news.ycombinator.com/item?id=16733619 tl;dr: These companies are successful when more people use the Internet. DNS is a major contributor to poor perceived internet performance. Thus providing better DNS services encourages people to use the Internet more.
drivebycomment 9y ago
> I expect Google is slurping all of my connections to help build an ad profile on me. Google says they don't - from https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy: > We don't correlate or combine information from our temporary or permanent logs with any personal information that you have provided Google for other services. Honestly, Google DNS policy seems largely similar to Cloudflare, with the exception of 3rd party audit. Cloudfare apparently doesn't do GeoIP mapping, so, till they implement that, it's not going to be useful for me.

Hyva 9y ago

There's a lot more to consider than just performance when deciding whom to share your browsing habits with. Why would you choose Cloudflare or Google? This isn't an endorsement of Quad9 or OpenDNS; I just don't know enough about them. However, the fact that Cloudflare and Google are privacy-and-security nightmares is well documented.

feelin_googley 9y ago

Is DNS configuration ever considered as a factor in "DNS performance"? IME as an end user, it makes a significant difference. For example if it takes seven queries to resolve a name "A" versus two queries to look up a name "B", then in almost all cases, irrespective of the distance to a cache, looking up A is going to be noticeably slower than looking up B. Indirection is only one example. Even worse are configuations that knowingly trigger retries and wait for client timeouts in order to present a client with a particular nameserver. Indirection and other "DNS tricks" come at a cost. IME, these are not compensated for via the proximity of a cache.

scrumper 9y ago

Safari barfs on visiting https://1.1.1.1 https://1.1.1.1 as linked in the article. Certificate invalid (though it looks fine). Rather unfortunate regarding perception; it's an interesting service!

sjwright 9y ago
Works for me; Safari 11.0.3 on High Sierra. (I'm surprised it works at all though... I wouldn't have thought you could have an HTTPS certificate for an IP address? You learn something new every day.)
- Kalium 9y ago
  The actual domain name is https://cloudflare-dns.com/ https://cloudflare-dns.com/ (found by inspecting the cert) Before SNI, every cert had to go to a static public IP address. Everything between you and the TLS terminator had to handle this. As a side-effect, you didn't actually need to know the domain name to get the tunnel, because everything handling the packets was running on the destination IP. tl;dr: Trickery based on dated TLS quirks.
  - scrumper 9y ago
    That works fine (the URL directly). The certificate is valid. Entering https://1.1.1.1 https://1.1.1.1 doesn't, but shows the same certificate. Don't really understand what's happening here. Anyway thanks for the info there.
    - Kalium 9y ago
      How odd. What browser are you using? It appears to be deviating from spec.
      - scrumper 9y ago
        Safari 11.1 (13605.33.1.2). Mac OSX 10.13.4.

rdtsc 9y ago

I've been using Quad9, if anything just because I feel Google already knows too much about me anyway. So far no complaints about it.

darkhorn 9y ago

It is blocked in Turkey.

ryanlol 9y ago

Why is google DNS listed as "private"? They permanently log all of your DNS queries. https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy

oasisbob 9y ago
That page specifically says that they don't: > Google Public DNS stores two sets of logs: temporary and permanent. The temporary logs store the full IP address of the machine you're using. [...] We delete these temporary logs within 24 to 48 hours. > In the permanent logs, we don't keep personally identifiable information or IP information. We do keep some location information (at the city/metro level) so that we can conduct debugging, analyze abuse phenomena. After keeping this data for two weeks, we randomly sample a small subset for permanent storage.
- ryanlol 9y ago
  Read the page. >Finally, if you're interested in knowing what else we log when you use Google Public DNS, here is the full list of items that are included in our permanent logs: >Request domain name, e.g. www.google.com >Client's AS (autonomous system or ISP), e.g. AS15169 >User's geolocation information: i.e. geocode, region ID, city ID, and metro code >Absolute arrival time in seconds Not tracking individual IPs doesn't mean shit.

nextlevelwizard 9y ago

GRC's DNS Benchmark[0] For anyone who wants to test their DNS servers. It is Windows binary, but works fine on Wine. [0] https://www.grc.com/dns/benchmark.htm https://www.grc.com/dns/benchmark.htm

manigandham 9y ago
This is the only proper way to test nameservers as a consumer. Everything else using any virtual servers in data centers will be skewed.

cleanbrowsing 9y ago

Pushed a shell script to compare all of them from your location: https://github.com/cleanbrowsing/dnsperftest https://github.com/cleanbrowsing/dnsperftest $ sh ./dnstest.sh |sort -k 22 -n test1 test2 test3 test4 test5 test6 test7 test8 test9 test10 Average cloudflare 1 ms 1 ms 1 ms 4 ms 1 ms 1 ms 1 ms 1 ms 1 ms 1 ms 1.30 norton 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2.00 neustar 2 ms 2 ms 2 ms 2 ms 1 ms 2 ms 2 ms 2 ms 2 ms 22 ms 3.90 cleanbrowsing 11 ms 23 ms 11 ms 11 ms 11 ms 11 ms 11 ms 13 ms 12 ms 11 ms 12.50 google 4 ms 4 ms 3 ms 21 ms 21 ms 61 ms 3 ms 21 ms 21 ms 22 ms 18.10 opendns 2 ms 2 ms 2 ms 39 ms 2 ms 75 ms 2 ms 21 ms 39 ms 13 ms 19.70 comodo 22 ms 23 ms 22 ms 22 ms 22 ms 22 ms 22 ms 22 ms 22 ms 23 ms 22.20 quad9 10 ms 37 ms 10 ms 10 ms 10 ms 145 ms 10 ms 10 ms 10 ms 20 ms 27.20 yandex 177 ms 216 ms 178 ms 182 ms 186 ms 177 ms 183 ms 174 ms 186 ms 222 ms 188.10 adguard 199 ms 210 ms 200 ms 201 ms 202 ms 202 ms 199 ms 200 ms 198 ms 201 ms 201.20

ori_b 9y ago
I'm seeing much closer results: cloudflare 32 ms 33 ms 34 ms 39 ms 36 ms 35 ms 29 ms 57 ms 48 ms 33 ms 37.60 google 43 ms 38 ms 37 ms 60 ms 34 ms 30 ms 30 ms 50 ms 32 ms 67 ms 42.10 quad9 30 ms 139 ms 25 ms 35 ms 49 ms 36 ms 34 ms 32 ms 27 ms 47 ms 45.40 opendns 32 ms 33 ms 28 ms 69 ms 32 ms 91 ms 37 ms 75 ms 67 ms 39 ms 50.30 norton 35 ms 33 ms 33 ms 31 ms 39 ms 34 ms 22 ms 25 ms 24 ms 33 ms 30.90 cleanbrowsing 36 ms 48 ms 40 ms 49 ms 56 ms 35 ms 36 ms 49 ms 49 ms 46 ms 44.40 yandex 217 ms 233 ms 203 ms 199 ms 215 ms 380 ms 210 ms 204 ms 258 ms 205 ms 232.40 adguard 98 ms 95 ms 101 ms 97 ms 104 ms 129 ms 103 ms 110 ms 95 ms 111 ms 104.30 neustar 32 ms 30 ms 32 ms 35 ms 31 ms 34 ms 29 ms 28 ms 138 ms 34 ms 42.30 comodo 55 ms 52 ms 51 ms 52 ms 47 ms 48 ms 58 ms 59 ms 48 ms 48 ms 51.80
- 9y ago

eikenberry 9y ago

What about services which use anycast/geolocation to decide where to serve you data from? They will get bad location data as they will get the location of the resolver. This can have a direct impact on services. An example of my own is from about 10 years ago when Netflix started streaming. We got a Roku and signed up but the service terrible due to the stream stopping to buffer every few minutes. After researching and trying several things I eventually came across the fact that the stream was coming from servers in over a thousand miles away with pretty bad latency between. Long story short, I eventually figured out it was due to my using the level3 resolvers for DNS. As soon as I changed to our ISP's DNS servers it worked great and the data was streaming from very close.

unethical_ban 9y ago
I wonder if location data would/could/should be an optional flag in DNS requests, instead of relying on physical location of the resolver.

beaconfield 9y ago

I let it (the story) sit a day after 4/1 just to make sure it wasn't really an April Fools' joke. But today I made it my primary DNS server and it's performing very well. Glad there's another player in the private DNS space.

justicezyx 9y ago

Anecdotally, I know a guy who runs a local Cloud provider in the greater-Beijing area (part of Hebei proveince). He told me Cloudflare has struck a deal with the government to have integration with them, presumably with higher standard than normal tech providers. That might explain why CloudFlare has good performance across the globe, which in a large part related to China.

jsgo 9y ago

Out of curiosity, are there any negatives for everyone to funnel their DNS traffic through a single provider? Might be paranoia, and it may in this case just be putting all of your traffic through company_a vs all of your traffic through company_b scenario, but I've been curious since this was announced.

retirw 9y ago

Hi, could someone explain to me what this DNS stuff is about like I'm 5? How is it related to private browsing?

ohiovr 9y ago
DNS is a service that converts easy to remember names like google.com or youtube.com to hard to remember ip addresses so you don't have to. We find it easier to remember names than strings of numbers. So usually your isp assigns their own dns server for you to use automatically and most people don't think about it. Sometimes a DNS server can go bad or become slow and people use services like google's dns services to speed up access to the sites they use. Google could use dns look up information from your computer to know what sites you visit even when you don't search google.com for it. I don't know if they do or not but I was thinking, if I was google I would probably do that. Its not that google needs your browsing habits to find web sites but it can use the querys it recieves to measure the popularity of web sites or web pages. As to why the current interest in DNS I'm not sure. A lot of trust is in DNS and a lot of people don't realize that an evil dns server can make your browser think you are going to good sites but could actually be an imposter. Other annoyances are NXDOMAIN (non existant domain) querys that are hyjacked to serve you ads. Controling DNS servers is a great way for a nation state to censor communication. They could take any site they wish and forward your browser to an automatic service that logs you with other "wrong thinkers". Or just resolve the domain name to null reference. Speed, security, privacy are things to consider for DNS. But like a lot of things on the internet, it all about trust...

timdavila 9y ago

What is the benefit to Google/CloudFlare of providing free DNS resolution? Why do they offer it?

Isomer 9y ago
See my reply here: https://news.ycombinator.com/item?id=16733619 https://news.ycombinator.com/item?id=16733619 tl;dr: Google succeeds when people use websearch. Cloudfare succeeds when people use the Internet in general. People use websearch more when the Internet is fast and reliable. ISPs resolvers are frequently not fast nor reliable. Thus if you can improve peoples Internet experience with a better resolver, you improve your core business. No need to track anyone via DNS for this to be successful.
sseth 9y ago
Long back when this started, OpenDNS was the largest public DNS provider. And I know at one point they started "hijacking" google requests - you can read this here : http://www.dslreports.com/forum/r21284386-Google-Com-Hijacked-by-OpenDNS http://www.dslreports.com/forum/r21284386-Google-Com-Hijacke.... This was in 2008. They used to also hijack DNS requests to show their own ads. And i am pretty sure many ISPs always played around with DNS in this way. In 2009, Google launched its own Public DNS - the reasons given were to make the web faster and safer, and i think there is some sense in which they have delivered. But I think another reason was defensive - provide an alternative to OpenDNS and to crappy ISP DNSs. In 2014 - OpenDNS stopped using DNS to show ads : https://umbrella.cisco.com/blog/2014/05/29/no-more-ads/ https://umbrella.cisco.com/blog/2014/05/29/no-more-ads/.

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

jradd 9y ago

Thanks, great response times from my NYC droplet. test1 test2 test3 test4 test5 test6 test7 test8 test9 test10 Average quad9 1 ms 2 ms 1 ms 1 ms 1 ms 1 ms 1 ms 1 ms 1 ms 1 ms 1.10 cloudflare 2 ms 1 ms 1 ms 2 ms 1 ms 1 ms 1 ms 2 ms 1 ms 1 ms 1.30 comodo 1 ms 2 ms 2 ms 3 ms 2 ms 1 ms 2 ms 1 ms 1 ms 2 ms 1.70 adguard 2 ms 2 ms 3 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2 ms 2.10 cleanbrowsing 2 ms 4 ms 2 ms 2 ms 2 ms 2 ms 14 ms 16 ms 2 ms 2 ms 4.80 norton 6 ms 7 ms 7 ms 7 ms 8 ms 7 ms 6 ms 7 ms 7 ms 7 ms 6.90 namecheap 7 ms 7 ms 7 ms 7 ms 7 ms 7 ms 7 ms 7 ms 7 ms 7 ms 7.00 neustar 8 ms 7 ms 7 ms 8 ms 9 ms 6 ms 7 ms 7 ms 7 ms 7 ms 7.30 namecheap2nd 8 ms 8 ms 7 ms 9 ms 9 ms 8 ms 10 ms 8 ms 8 ms 8 ms 8.30 opendns 20 ms 1 ms 1 ms 30 ms 2 ms 8 ms 1 ms 16 ms 15 ms 3 ms 9.70 google2nd 16 ms 1 ms 1 ms 17 ms 1 ms 24 ms 1 ms 16 ms 17 ms 14 ms 10.80 google 17 ms 1 ms 1 ms 17 ms 1 ms 41 ms 1 ms 17 ms 18 ms 15 ms 12.90 cloudflare2nd 1 ms 2 ms 1 ms 1 ms 1000 ms 2 ms 2 ms 1 ms 2 ms 2 ms 101.40 yandex 101 ms 102 ms 104 ms 101 ms 115 ms 103 ms 107 ms 100 ms 105 ms 136 ms 107.40 Not so much from my home ISP: test1 test2 test3 test4 test5 test6 test7 test8 test9 test10 Average namecheap2nd 45 ms 45 ms 44 ms 45 ms 48 ms 45 ms 45 ms 46 ms 48 ms 45 ms 45.60 cloudflare2nd 45 ms 49 ms 48 ms 47 ms 45 ms 44 ms 45 ms 45 ms 46 ms 46 ms 46.00 namecheap 46 ms 48 ms 48 ms 44 ms 45 ms 45 ms 46 ms 45 ms 45 ms 48 ms 46.00 cleanbrowsing 46 ms 46 ms 44 ms 56 ms 45 ms 44 ms 48 ms 46 ms 44 ms 46 ms 46.50 google2nd 49 ms 47 ms 47 ms 45 ms 51 ms 47 ms 46 ms 44 ms 43 ms 46 ms 46.50 comodo 46 ms 47 ms 48 ms 49 ms 46 ms 47 ms 44 ms 45 ms 47 ms 50 ms 46.90 adguard 49 ms 48 ms 45 ms 46 ms 46 ms 48 ms 49 ms 48 ms 48 ms 48 ms 47.50 google 46 ms 49 ms 47 ms 47 ms 45 ms 47 ms 47 ms 49 ms 44 ms 67 ms 48.80 opendns 47 ms 46 ms 47 ms 64 ms 48 ms 49 ms 46 ms 64 ms 64 ms 48 ms 52.30 cloudflare 44 ms 48 ms 45 ms 50 ms 48 ms 110 ms 45 ms 48 ms 45 ms 47 ms 53.00 quad9 46 ms 49 ms 45 ms 47 ms 49 ms 153 ms 46 ms 45 ms 48 ms 46 ms 57.40 neustar 66 ms 66 ms 66 ms 67 ms 66 ms 66 ms 66 ms 67 ms 66 ms 67 ms 66.30 norton 91 ms 67 ms 67 ms 67 ms 66 ms 66 ms 67 ms 66 ms 67 ms 67 ms 69.10 yandex 176 ms 279 ms 176 ms 174 ms 188 ms 178 ms 179 ms 176 ms 174 ms 179 ms 187.90

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

Jaruzel 9y ago

Hmmm. Off the bat, CloudFlare ICMP for me is worse than Google: http://www.jaruzel.com/files/ICMP-CloudFlareDNS-vs-Google-tetx.png http://www.jaruzel.com/files/ICMP-CloudFlareDNS-vs-Google-te... I'll stick with Google I think. UK/London btw.

pouetpouet 9y ago

How do other services compare? Like https://blog.uncensoreddns.org/dns-servers/ https://blog.uncensoreddns.org/dns-servers/ https://dns.watch/ https://dns.watch/ https://ipredator.se/page/services#service_dns https://ipredator.se/page/services#service_dns

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

ManishKrishna 9y ago

Will website name in certificate shared by server during handshake kill the DNS over https purpose?

bitrazor123 9y ago

but why would you compare something like cloudflare which is a DDOS prevention service to DNS service?

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

v0id24 9y ago

Moscow, Russia test1 test2 test3 test4 test5 test6 test7 test8 test9 test10 Average adguard 6 ms 8 ms 4 ms 8 ms 11 ms 5 ms 7 ms 4 ms 4 ms 22 ms 7.90 google2nd 4 ms 4 ms 5 ms 22 ms 30 ms 18 ms 3 ms 27 ms 3 ms 3 ms 11.90 yandex 5 ms 9 ms 5 ms 9 ms 87 ms 50 ms 9 ms 9 ms 5 ms 60 ms 24.80 google 3 ms 18 ms 3 ms 20 ms 29 ms 165 ms 3 ms 18 ms 3 ms 19 ms 28.10 cloudflare2nd 45 ms 44 ms 46 ms 44 ms 46 ms 44 ms 44 ms 45 ms 65 ms 48 ms 47.10 quad9 47 ms 48 ms 47 ms 48 ms 46 ms 57 ms 46 ms 44 ms 46 ms 45 ms 47.40 opendns 45 ms 47 ms 46 ms 59 ms 47 ms 45 ms 47 ms 49 ms 51 ms 44 ms 48.00 norton 52 ms 49 ms 53 ms 52 ms 58 ms 56 ms 51 ms 48 ms 54 ms 52 ms 52.50 cleanbrowsing 96 ms 48 ms 60 ms 46 ms 49 ms 46 ms 45 ms 49 ms 44 ms 46 ms 52.90 neustar 54 ms 56 ms 52 ms 59 ms 50 ms 57 ms 55 ms 57 ms 59 ms 54 ms 55.30 comodo 80 ms 88 ms 73 ms 113 ms 79 ms 75 ms 75 ms 74 ms 74 ms 90 ms 82.10 cloudflare 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000.00

deleted 9y ago

[deleted]

delhanty 9y ago

From Waimanalo, Hawaii cloudflare times out: test1 test2 test3 test4 test5 test6 test7 test8 test9 test10 Average 192.168.50.1 154 ms 157 ms 154 ms 154 ms 154 ms 154 ms 156 ms 158 ms 155 ms 184 ms 158.00 cloudflare 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000 ms 1000.00 google 106 ms 82 ms 80 ms 158 ms 113 ms 148 ms 82 ms 107 ms 106 ms 81 ms 106.30 quad9 91 ms 99 ms 111 ms 106 ms 90 ms 97 ms 89 ms 91 ms 89 ms 88 ms 95.10 opendns 105 ms 81 ms 96 ms 120 ms 82 ms 110 ms 81 ms 115 ms 105 ms 83 ms 97.80 norton 82 ms 80 ms 82 ms 94 ms 84 ms 91 ms 82 ms 80 ms 82 ms 83 ms 84.00 cleanbrowsing 135 ms 158 ms 245 ms 136 ms 132 ms 132 ms 133 ms 138 ms 133 ms 145 ms 148.70 yandex 287 ms 389 ms 256 ms 256 ms 258 ms 256 ms 258 ms 257 ms 258 ms 255 ms 273.00 adguard 290 ms 270 ms 319 ms 295 ms 433 ms 340 ms 261 ms 351 ms 290 ms 264 ms 311.30 neustar 86 ms 82 ms 83 ms 84 ms 80 ms 90 ms 80 ms 81 ms 84 ms 83 ms 83.30 comodo 149 ms 148 ms 152 ms 152 ms 153 ms 148 ms 150 ms 147 ms 148 ms 151 ms 149.80

unixhero 9y ago

Cloudflare it is then!

deleted 9y ago

[deleted]