4 ms·

I think we'll start seeing the standard configuration of 1.1.1.1,8.8.8.8 everywhere. Google/Cloudflare tackled the UX of free DNS spectacularly with these gold

I think we'll start seeing the standard configuration of 1.1.1.1,8.8.8.8 everywhere. Google/Cloudflare tackled the UX of free DNS spectacularly with these gold IP addresses. It's the primary reason I use them instead of OpenDNS, which was an earlier player in this space.

deleted 9y ago
[deleted]
JepZ 9y ago
I wonder how much Cloudflare paid/pays for the 1.1.1.1
- larrybud 9y ago
  Read the announcement: https://blog.cloudflare.com/announcing-1111/ https://blog.cloudflare.com/announcing-1111/ "APNIC's research group held the IP addresses 1.1.1.1 and 1.0.0.1. While the addresses were valid, so many people had entered them into various random systems that they were continuously overwhelmed by a flood of garbage traffic. APNIC wanted to study this garbage traffic but any time they'd tried to announce the IPs, the flood would overwhelm any conventional network. We talked to the APNIC team about how we wanted to create a privacy-first, extremely fast DNS system. They thought it was a laudable goal. We offered Cloudflare's network to receive and study the garbage traffic in exchange for being able to offer a DNS resolver on the memorable IPs. And, with that, 1.1.1.1 was born."
  - stordoff 9y ago
    Have they discussed what this means in terms of the privacy promises? What "garbage traffic" does APNIC have access to in order to study?
    - burntwater 9y ago
      I think that's part of the point of all this - to find out what all that garbage traffic is.
    - X-Istence 9y ago
      HA failover pings that get routed rather than being sent to their peer, captive portal requests that no longer exist. Things of that nature. There is a lot of documentation, Cisco being one of the primary at-fault companies, that uses 1.1.1.1 for all kinds of various internal configuration. Given hundreds of thousands of devices configured with 1.1.1.1, even a simple misconfiguration on just 10% of those is a lot of garbage traffic.
- notreallyauser 9y ago
  No cash outlay. Read the blog, but tl;dr is that it's quid pro quo as the owners can't afford to stand it up due to the volume of junk traffic (but want to, to study the junk) -- cloudflare can and will let the owner study the junk. What cloudflare don't say in any of their materials that I've seen is the agreement is for an initial 5 years, so YMMV after that.
keeperofdakeys 9y ago
Be careful with that, Google DNS (as an example) will start ignoring your DNS requests if you go over the rate-limit. Not an issue for home users, but an issue for any sizeable business.
- noonespecial 9y ago
  I have run into this in the wild. Presented as a weird, intermittent, "hey the internet is out" at the office around the same time each afternoon.
- sytse 9y ago
  Yep, don't configure your servers with Google's public DNS servers but use the ones your public cloud provides.
- r1ch 9y ago
  Google DNS also has issues resolving DNSSEC-enabled Cloudflare domains.
  - fanf2 9y ago
    Interesting! Do you have any examples?
    - r1ch 9y ago
      Hmm, it seems like they may have fixed it, I can't seem to reproduce the problem I had (it would randomly fail to resolve CAA records for DNSSEC enabled domains).
- mjevans 9y ago
  Doesn't this just mean that you should be running your own caching resolver so that requests for common things don't constantly hit the upstream server? For those same common sites it should also be better performance anyway.
- vamin 9y ago
  Do we know yet if CloudFlare has similar rate limits?
brightball 9y ago
OpenDNS still has a lot of value beyond just free DNS service though. When I was very active in dealing with phishing, we found that OpenDNS flagged phishing sites about 4 times faster than any other DNS provider, which I assume is because of PhishTank. It's the primary reason I recommend it to my parents. Between that and some of the content filtering options you can get with the paid plan, I find that it's a very full-featured option for homes with young kids. I'm pretty sure you get to control the logs on the paid plan too. Need to double check.

deleted 9y ago

[deleted]

JepZ 9y ago

I wonder how much Cloudflare paid/pays for the 1.1.1.1

larrybud 9y ago
Read the announcement: https://blog.cloudflare.com/announcing-1111/ https://blog.cloudflare.com/announcing-1111/ "APNIC's research group held the IP addresses 1.1.1.1 and 1.0.0.1. While the addresses were valid, so many people had entered them into various random systems that they were continuously overwhelmed by a flood of garbage traffic. APNIC wanted to study this garbage traffic but any time they'd tried to announce the IPs, the flood would overwhelm any conventional network. We talked to the APNIC team about how we wanted to create a privacy-first, extremely fast DNS system. They thought it was a laudable goal. We offered Cloudflare's network to receive and study the garbage traffic in exchange for being able to offer a DNS resolver on the memorable IPs. And, with that, 1.1.1.1 was born."
- stordoff 9y ago
  Have they discussed what this means in terms of the privacy promises? What "garbage traffic" does APNIC have access to in order to study?
  - burntwater 9y ago
    I think that's part of the point of all this - to find out what all that garbage traffic is.
  - X-Istence 9y ago
    HA failover pings that get routed rather than being sent to their peer, captive portal requests that no longer exist. Things of that nature. There is a lot of documentation, Cisco being one of the primary at-fault companies, that uses 1.1.1.1 for all kinds of various internal configuration. Given hundreds of thousands of devices configured with 1.1.1.1, even a simple misconfiguration on just 10% of those is a lot of garbage traffic.
notreallyauser 9y ago
No cash outlay. Read the blog, but tl;dr is that it's quid pro quo as the owners can't afford to stand it up due to the volume of junk traffic (but want to, to study the junk) -- cloudflare can and will let the owner study the junk. What cloudflare don't say in any of their materials that I've seen is the agreement is for an initial 5 years, so YMMV after that.

keeperofdakeys 9y ago

Be careful with that, Google DNS (as an example) will start ignoring your DNS requests if you go over the rate-limit. Not an issue for home users, but an issue for any sizeable business.

noonespecial 9y ago
I have run into this in the wild. Presented as a weird, intermittent, "hey the internet is out" at the office around the same time each afternoon.
sytse 9y ago
Yep, don't configure your servers with Google's public DNS servers but use the ones your public cloud provides.
r1ch 9y ago
Google DNS also has issues resolving DNSSEC-enabled Cloudflare domains.
- fanf2 9y ago
  Interesting! Do you have any examples?
  - r1ch 9y ago
    Hmm, it seems like they may have fixed it, I can't seem to reproduce the problem I had (it would randomly fail to resolve CAA records for DNSSEC enabled domains).
mjevans 9y ago
Doesn't this just mean that you should be running your own caching resolver so that requests for common things don't constantly hit the upstream server? For those same common sites it should also be better performance anyway.
vamin 9y ago
Do we know yet if CloudFlare has similar rate limits?

brightball 9y ago

OpenDNS still has a lot of value beyond just free DNS service though. When I was very active in dealing with phishing, we found that OpenDNS flagged phishing sites about 4 times faster than any other DNS provider, which I assume is because of PhishTank. It's the primary reason I recommend it to my parents. Between that and some of the content filtering options you can get with the paid plan, I find that it's a very full-featured option for homes with young kids. I'm pretty sure you get to control the logs on the paid plan too. Need to double check.