5 ms·

> If you really want something fast and secure, run your own caching DNS that uses root DNS servers. is there a good tutorial for this somewhere?

by plg 9y ago

oelmekki 9y ago
If you want to do it on your local linux system, it's pretty easy: you just need to install bind9 and use `nameserver 127.0.0.1` in your /etc/resolv.conf Bind9 has a poor reputation because of how difficult it is to use it to define zones (manage a domain name), but if you want to use it as a resolver, it's basically plug'n'play. Huge bonus included : if you want to flush the cache, you just need to run `sudo rndc flush`, so you don't have to wait for TTL timeout to test your newly configured domain name when you setup a website (you still have to restart your browser, because most of them do their own dns caching).
- vertex-four 9y ago
  Honestly, isn’t Unbound a better shout if you’re not going to be fiddling with it? Just install, run, and edit /etc/resolv.conf to point at 127.0.0.1.
  - oelmekki 9y ago
    Well, you're describing exactly how to do it with bind9 :) What make you say Unbound is better?
    - swinglock 9y ago
      Unbound is more lightweight. All it does is recursive lookups, it has no option for being authoritative. If that's all you need then that's better. There are other options too, I don't know what makes Unbound better than PowerDNS Recursor or Knot Resolver.
    - LinuxBender 9y ago
      I prefer Unbound as it lets me set a min-ttl. This of course is taboo and comes with caveats, so you have to know what you are doing and the implications. Unbound has better support for DNSSEC as well.
    - vertex-four 9y ago
      Unbound is a bit less likely to come with distro-specific oddities in the default config, I think, mostly. It's a matter of preference.
- jsjohnst 9y ago
  > Bind9 has a poor reputation because of how difficult it is to use it to define zones YMMV, but bind’s poor reputation in my circles has completely to do with this: https://www.cvedetails.com/product/144/ISC-Bind.html?vendor_id=64 https://www.cvedetails.com/product/144/ISC-Bind.html?vendor_...
alwillis 9y ago
What you want is DNSSEC-trigger, which installs Unbound on 127.0.0.1: https://www.nlnetlabs.nl/projects/dnssec-trigger/ https://www.nlnetlabs.nl/projects/dnssec-trigger/
vavrusa 9y ago
I ran a full recursor on my laptop for about two years. It's not a great choice, especially if you're not stationary. A lot as a lot of environments intercept DNS and poison your cache, the answers for lb'd names also change depending on your geolocation (so you have to flush it every time you move). Your queries are also not really private as you the resolver has to talk to multiple authoritatives to get you your name in a plain text. The performance is also not as great even with prefetching, as you don't benefit from a shared cache. Probably the best thing you can do is to run something like https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy which at least retains privacy between you and the resolver, and use public resolvers you trust. If you don't trust any of them, you could start a resolver on a VM somewhere, but then again that can be traced back to you, so it depends on your threat model. Both of these options are better than running a full resolver on localhost (unless you expect the recursive DNS infrastructure to fail, while authoritative remains operational).

> If you really want something fast and secure, run your own caching DNS that uses root DNS servers. is there a good tutorial for this somewhere?

by plg 9y ago

> If you really want something fast and secure, run your own caching DNS that uses root DNS servers. is there a good tutorial for this somewhere?

oelmekki 9y ago

If you want to do it on your local linux system, it's pretty easy: you just need to install bind9 and use `nameserver 127.0.0.1` in your /etc/resolv.conf Bind9 has a poor reputation because of how difficult it is to use it to define zones (manage a domain name), but if you want to use it as a resolver, it's basically plug'n'play. Huge bonus included : if you want to flush the cache, you just need to run `sudo rndc flush`, so you don't have to wait for TTL timeout to test your newly configured domain name when you setup a website (you still have to restart your browser, because most of them do their own dns caching).

vertex-four 9y ago
Honestly, isn’t Unbound a better shout if you’re not going to be fiddling with it? Just install, run, and edit /etc/resolv.conf to point at 127.0.0.1.
- oelmekki 9y ago
  Well, you're describing exactly how to do it with bind9 :) What make you say Unbound is better?
  - swinglock 9y ago
    Unbound is more lightweight. All it does is recursive lookups, it has no option for being authoritative. If that's all you need then that's better. There are other options too, I don't know what makes Unbound better than PowerDNS Recursor or Knot Resolver.
  - LinuxBender 9y ago
    I prefer Unbound as it lets me set a min-ttl. This of course is taboo and comes with caveats, so you have to know what you are doing and the implications. Unbound has better support for DNSSEC as well.
  - vertex-four 9y ago
    Unbound is a bit less likely to come with distro-specific oddities in the default config, I think, mostly. It's a matter of preference.
jsjohnst 9y ago
> Bind9 has a poor reputation because of how difficult it is to use it to define zones YMMV, but bind’s poor reputation in my circles has completely to do with this: https://www.cvedetails.com/product/144/ISC-Bind.html?vendor_id=64 https://www.cvedetails.com/product/144/ISC-Bind.html?vendor_...

alwillis 9y ago

What you want is DNSSEC-trigger, which installs Unbound on 127.0.0.1: https://www.nlnetlabs.nl/projects/dnssec-trigger/ https://www.nlnetlabs.nl/projects/dnssec-trigger/

vavrusa 9y ago

I ran a full recursor on my laptop for about two years. It's not a great choice, especially if you're not stationary. A lot as a lot of environments intercept DNS and poison your cache, the answers for lb'd names also change depending on your geolocation (so you have to flush it every time you move). Your queries are also not really private as you the resolver has to talk to multiple authoritatives to get you your name in a plain text. The performance is also not as great even with prefetching, as you don't benefit from a shared cache. Probably the best thing you can do is to run something like https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy which at least retains privacy between you and the resolver, and use public resolvers you trust. If you don't trust any of them, you could start a resolver on a VM somewhere, but then again that can be traced back to you, so it depends on your threat model. Both of these options are better than running a full resolver on localhost (unless you expect the recursive DNS infrastructure to fail, while authoritative remains operational).