46 ms·

DNS servers that offer privacy and filtering

125 points by petercooper 8y ago

krylon 8y ago
I know this is not for everyone, but I strongly prefer to run my own recursive resolver at home. Performance is great, plus I get regular DNS for the machines on my home network. Also, it was a fun little project. :)
- dbg31415 8y ago
  I love my Pi Hole! Great for blocking ads on everything. * Pi-hole®: A black hole for Internet advertisements – curl -sSL https://install.pi-hole.net https://install.pi-hole.net | bash || https://pi-hole.net/ https://pi-hole.net/
  - yaleman 8y ago
    The docker image is pretty trivial to set up too, so it's even easier :)
- dspillett 8y ago
  That and handy for network level filtering, such as PiHole.
- sascha_sl 8y ago
  I really like the flexibility of CoreDNS for that. I use Cloudflare with dnscrypt as my resolver and still get to use intranet things at work because I can just forward the zones I need there elsewhere.
- skrause 8y ago
  I like to share the cache of the DNS resolver with as many people as possible because that's what gives you the best performance. A local resolver just for me can't really do that.
  - deleted 8y ago
    [deleted]
  - ingenium 8y ago
    Google DNS (and likely others) doesn't really work that well for this unless it's a very popular domain because of the sheer number of servers that they run and the short TTLs on most records. Even on subsequent lookups, you're likely to hit a different backend server that doesn't have a record cached that you just looked up. Google's servers don't seem to share their cache between one another. Even reddit.com often has to do the full lookup. For a full local resolver, you can configure it to use and serve expired records, with a 0 TTL. In the background it will then lookup all records used, so that it's refreshed for next time. Cloudflare does this. Likewise, you can configure it to prefetch frequently requested records before they expire.
- kingo55 8y ago
  More people should do this. I recently switched my home network DNS forwarder from Bind to DNS Crypt Proxy (https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy). You can get ad/content filtering lists along with some little privacy enhancements like DNS Crypt and DNS over HTTPS support for encrypted DNS queries to supported services, like CloudFlare.
  - kakarot 8y ago
    Even with DNS/HTTPS and such, wouldn't using a home DNS resolver with a VPN on both ends of the connection still make you a little more vulnerable to network analysis and timing attacks since your DNS requests are guaranteed to go through a specific IP which only serves you?
    - klodolph 8y ago
      Not sure what timing attacks you are talking about. Having traffic analysis in your threat model is an extreme choice, typically it means your adversaries include law enforcement agencies or state-level actors. Sending DNS over VPN might just mean that you don’t trust your ISP and think they might intercept the request and forge a response—something which does happen, and I’ve personally observed it at two different ISPs.
      - kakarot 8y ago
        It's not in my threat model per se, but it's something I give a lot of thought to because systems like this are expected to be used by political dissidents, whistleblowers and other persecuted individuals who are subject to such threat models. My ISP probably forges responses because they have no problem injecting html/js and hijacking ad space on unencrypted connections. As far as timing attacks, an example would be such: Even though you are at a coffee shop in an undisclosed location miles away from home, if LE has a reason to profile the IP you're broadcasting from at home they could do look at request times and try to link a request from the coffee shop to your home DNS server. If you use a public DNS server, you have the same benefit of using a public VPN vs a private VPN, in that your traffic gets bundled with everyone else's and obfuscated. It's harder to establish a link between you and the DNS server using network analysis because potentially thousands of connections are being made to that same DNS server from the same VPN node at the same time.
- acranox 8y ago
  That's great and all, but you still need to pick an upstream DNS server. The conventional advice is to use one of these public services, or your ISP's resolvers, to avoid hitting the root servers constantly. A lot of services these days have very short TTLs, so running your own recursive resolver still causes a lot of requests to get forwarded. Also, as counterintuitive as it might seem, when I use namebench ( https://code.google.com/archive/p/namebench/ https://code.google.com/archive/p/namebench/ ) it still says cloudflare and google are faster than my local resolver. (not by a lot though)
  - deleted 8y ago
    [deleted]
  - ingenium 8y ago
    You actually don't have to. The TTLs on NS records are generally pretty long, especially the root servers (6 days for root, 2 days for both .com and my domain's NS). You will hit the .com for example the first time you go to a domain, but so does Google. In my experience, Google's DNS has so many servers that even on subsequent requests, you hit a different server and it has to do the full lookup again (likely querying a root unless it's a popular domain). It's not really decreasing the load on the root servers that much, if at all. It might actually increase the load. One trick you can do to speed up your local recursive resolver is allowing it to serve expired records. Unbound in pfsense allows for this. If the record has been previously retrieved but is expired, it returns the record with a 0 TTL (to force the client to look it up again next time). This includes internally using expired NS records, for example to lookup a different subdomain. Meanwhile, in the background, it looks up all the records used to refresh the TTL, and serves/uses this next time. Generally speaking, expired records still work fine. I noticed that Cloudflare DNS does this as well, and regularly serves 0 TTL records. I've found that this consistently makes my local resolver faster than any public DNS server, except sometimes the very first time it looks up a domain. The slowest DNS queries are records which use lots of nested CNAMES on different domains with short TTLs, such as www.microsoft.com / most sites using akamai, which takes 500ms for the first lookup. There was a domain I saw the other day which had 4 or 5 layers of CNAMES which took 1-1.5 seconds to resolve initially.
- agumonkey 8y ago
  I use pdnsd as a local cache. It used to make browsing lightning fast. Although I might have messed up something since because dns resolution seems laggy. But in theory it is of great benefits.
- tracker1 8y ago
  Most home routers already do this for you, it's a bit abstracted but there, just need to specify the network and have it in the list of networks to resolve for DHCP. Or you can DIY it on another box. I find it's still best to defer to an upstream forward server vs. root resolution. Most of the providers mentioned have multiple points of presence and will likely be closer and resolve MUCH faster for most cases. DNS resolution time can be a huge factor in web responsiveness.
tw1010 8y ago
Do I have to?
- JdeBP 8y ago
  (You are referring to the original title.) Actually, no. Even if one does accept the premise that one should use these third-party non-contracted services, challenged elsewhere in this very discussion, there's no reason that one need have these things memorized. Written in a handy pocketbook, perhaps. But not necessarily memorized.
palijer 8y ago
DNS servers should not be used as "internet connectivity tests" by pinging them. They are not maintained as ICMP test servers, and that is not their purpose. While many do not block ICMP packets, there are typically rate limiting systems in place, and other reasons why they would not respond to ping requests. Pinging DNS servers is a shitty inconclusive test for internet connectivity, or SLA measurements etc etc.
- johnchristopher 8y ago
  So, what should we ping for testing Internet connectivity ?
  - teddyh 8y ago
    There’s ping.sunet.se as maintained by the Swedish University Network (i.e. the network connecting Swedish Universities; there is no single “Swedish University”).
    - snazz 8y ago
      The advantage of pinging IPs is that you don’t have to have a working DNS setup to test your connection. If DNS does work, then your connection probably works, too.
      - 1_player 8y ago
        In this case one should run "ping -n", otherwise ping will hang trying to resolve the IP into an hostname, if the DNS is misbehaving or not responding.
        sathackr 8y ago
        what default(included in OS) ping utility tries to reverse-lookup an address before pinging, and hangs if it can't. I've never observed this in any version of Windows nor Linux.
  - 8y ago
skrause 8y ago
The best tip is in the sidebar on that page: > 1.0.0.1 abbreviates to 1.1, so you can literally test by typing "ping 1.1"
- geocar 8y ago
  You can also ping 16843009 and 16777217 -- perhaps less memorable, but if your dot key is broken…
- 300bps 8y ago
  IP addresses are fundamentally 32 bit numbers. The a.b.c.d format is just for ease of use on humans and as the tip in the sidebar shows has its own shortcuts. But there are several formats that most operating systems support such as decimal, binary, hex, octal: https://www.abuseipdb.com/tools/ip-address-converter?ip=1.1.1.1 https://www.abuseipdb.com/tools/ip-address-converter?ip=1.1....
sangaya 8y ago
https://pi-hole.net/ https://pi-hole.net/ is a project to consider for home and small business networks that you're looking to protect via DNS without sending all your requests to a third party.
- snazz 8y ago
  Your requests are still forwarded to a third party with a Pi-hole. They are sometimes cached and sites you have blocked do not resolve, but choosing a DNS provider is still required.
  - prepend 8y ago
    Only non-cached requests go to a third party. And I don’t think there’s an easy way to prevent this unless you get a hold of all the zone files and copy in bulk. What’s nice about pi-hole is that you get one request to sites like google.com until the record expires in the cache. If you use 8.8.8.8 as your dns you might end up requesting the same domain name a bunch of times depending on how your client caches and the caching is at 8.8.8.8. So dns will see lots of requests to the same domain.
    - dx034 8y ago
      In a network of just a few computers, are there really that many cached requests? Local DNS caches will already cache short term and TTL of most domains is probably too short to get much caching beyond that.
      - snazz 8y ago
        Looking at my dnsmasq statistics, only 16.3% of 10,776 queries in the last 24 hours have been answered by the cache. Another 21.7% never left the device, since they were in the block lists, but that still leaves 62.0% of queries to be returned by 1.1.1.1 and 1.0.0.1, which is my external DNS provider. Although this doesn’t count on-client caching, it still seems to back up your guess and my original comment.
      - 8y ago
userbinator 8y ago
Surprised that 4.2.2.x (Level3) is not on the list --- it's also unfiltered DNS, and run by a company that focuses only on networking.
- becauseiam 8y ago
  4.2.2.2 is supposedly for Level3 customers only.
- Nux 8y ago
  At some point a few years back they started to redirect some of the traffic to some dodgy ad sites, that's when I stopped using them.
tyingq 8y ago
Dnsperf.com is worth a look as well, to compare performance of all of these. Public DNS resolvers: https://www.dnsperf.com/#!dns-resolvers https://www.dnsperf.com/#!dns-resolvers DNS services for your own domain: https://www.dnsperf.com/ https://www.dnsperf.com/
gmac 8y ago
Another option here is DNS servers that block ads. I can't vouch for the company itself, but I have found AdGuard DNS reliable and effective, if not memorable: 176.103.130.130, 176.103.130.131 https://adguard.com/en/adguard-dns/overview.html https://adguard.com/en/adguard-dns/overview.html
- theandrewbailey 8y ago
  Run your own: https://pi-hole.net/ https://pi-hole.net/
  - vanadium 8y ago
    And then either install Cloudflared [1], or Unbound [2]. [1] https://bendews.com/posts/implement-dns-over-https/ https://bendews.com/posts/implement-dns-over-https/ [2] https://pi-hole.net/2018/06/09/ftldns-and-unbound-combined-for-your-own-all-around-dns-solution/ https://pi-hole.net/2018/06/09/ftldns-and-unbound-combined-f...
  - gmac 8y ago
    Genuine question: what benefits does this have over using a service provided for free by someone else? Privacy?
    - theandrewbailey 8y ago
      Yes, privacy, plus it's a DNS cache that's running on your local network, so your DNS resolution is faster. Its also customizable (you can add/blacklist/whitelist specific domains from the control panel).
flox25 8y ago
So the author is a security expert who recommends two companies that are notorious for their security flaws (Norton, Cisco), two companies that track your DNS queries for profiling (Google, Cloudflare) and IBM... Yeah, this sounds totally legit...
- throwaway9d0291 8y ago
  > two companies that track your DNS queries for profiling (Google, Cloudflare) Can you elaborate? Neither Google nor CloudFlare seem to collect information for profiling. Google: https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy CloudFlare: https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/privacy-policy/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
  - flox25 8y ago
    What? How do you come to that conclusion? Google actually tells you what it is collecting, if you cannot see how, say, city of origin, cannot be used to target you with specific search result, then I really cannot explain it to you. Cloudflare does not store any information, but they are pretty frank about passing it on to APNIC for "research" as part of the deal where APNIC lend the 1.0.0.1 and 1.1.1.1 address to them. This is pretty well established and actually openly communicated by both entities, so should be easy to DDG. You are of course free to believe that this data is totally anonymized and not used for profiling / targeting at all, but imo that is pretty naive.
    - zackbloom 8y ago
      I work at Cloudflare. APNIC absolutely does not get individual DNS query logs. Their primary interest is in studying the other junk traffic which ends up hitting 1.1.1.1. For the record, we don't build any sort of profile of DNS queryiers, map them back to any existing profile we have, or even keep the data you would need to have to do that.
      - 8y ago
jcims 8y ago
Anybody remember 128.146.1.7?
TheForumTroll 8y ago
>Cisco Umbrella Resident evil. It has begun.
auslander 8y ago
> Logs are kept for 24 hours for debugging purposes, then they are purged Legalese is very hard to learn language. Do they keep aggregate data, derived from those raw logs? It is not said. Trusting Cloudflare? It is a profit driven company, to start with ...
- zackbloom 8y ago
  I work at Cloudflare. We don't sell data of any form, and we don't keep anything which could map queries back to the individual who made them. When we talk about aggregate data it's things like total number of queries made to 1.1.1.1, number made by AS, and geographic region. Its purpose is only to show us if people are using 1.1.1.1 and how that changes over time.
rndomsrmn 8y ago
Or setup your own very lightweight filtering and caching DNS at home using Dnsmasq and https://github.com/notracking/hosts-blocklists/ https://github.com/notracking/hosts-blocklists/
3xblah 8y ago
His blog post pays no mention of users whose DNS queries are being redirected. Isn't that a privacy concern? Hotels and ISPs sometimes set up captive portals that intercept and redirect port 53 to their own choice of DNS servers. As such, users might want memorise the addresses of some resolvers that listen on non-standard ports (not port 53). A user behind one of these captive portals who pings any of the resolvers in this blog post will not be pinging those servers; she will be pinging the hotel/ISP's chosen DNS servers and she may be none the wiser.
- Tor3 8y ago
  In a hotel I always first thing direct everything through a VPN server (work or home, depending on what I want to do). Some hotels block UDP, in that case I switch the VPN to go via TCP port 443. But some hotels (really!) block port 443.. fortunately not that many anymore.
  - 3xblah 8y ago
    When you use a home VPN server, is the VPN server running on a computer located at your home and reachable on the open internet? If yes, do you have fixed address or do you use dynamic DNS?
    - Tor3 8y ago
      I could have set it up at home (the address is stable), but I have a server on a hosting facility which I use as my "home central".
darrmit 8y ago
I made the jump to CleanBrowsing a few months ago from OpenDNS because OpenDNS caches records really aggressively and was just generally stagnant in terms of feature set. I've been really happy with performance and privacy. I configured DNScrypt on Tomato and I also use Tomato to redirect all DNS requests so it can't be bypassed by simply re-pointing DNS. VPN obviously bypasses it. https://cleanbrowsing.org/how-it-works https://cleanbrowsing.org/how-it-works
miyuru 8y ago
> If you care about privacy and speed and maximum memorability, I recommend CloudFlare I disagree with the speed part, because cloudflare doesn't support EDNS. This is great for privacy but not for speed. Here is proof: https://pastebin.com/raw/QnbWXU1a https://pastebin.com/raw/QnbWXU1a If he meant speed in the DNS resolution context, I somewhat agree with him.
nykolasz 8y ago
I need to point out that Norton DNS has been retired and is not supported anymore (and never offered any privacy). "On November 15, 2018, Norton ConnectSafe service is being retired or discontinued meaning the service will no longer be available or supported. You may continue to use ConnectSafe until November 15, 2018. However, we do recommend that you take a moment to review important details related to this announcement below." Some alternatives: https://medium.com/@nykolas.z/norton-connectsafe-dns-is-shutting-down-this-is-what-you-need-to-do-3e70432697d9 https://medium.com/@nykolas.z/norton-connectsafe-dns-is-shut... I am actually surprised he didn't mention CleanBrowsing in their list, which I would recommend as good alternative to Norton and OpenDNS.
wtmt 8y ago
I used OpenDNS long ago, even though it wasn't as easy to remember as the ones that came later. Then I shifted to Google DNS and stayed with it, albeit with some discomfort (even if the policies state it doesn't track, it's still a leap of faith for me). Then last year I switched to Cloudflare DNS and also learned about Quad9 DNS. I haven't done local benchmarking using a tool like namebench for a long time, and it looks like that tool has not been updated for several years. Any alternatives for it that are cross platform?
- jlgaddis 8y ago
  > I haven't done local benchmarking using a tool like namebench for a long time, and it looks like that tool has not been updated for several years. In fairness, the DNS protocol that it's testing hasn't really changed in that time either. namebench is still sufficient for general testing.
WiredShark 8y ago
Quality, latency, and uptime are also factors: https://www.dnsperf.com/#!dns-resolvers,World,quality https://www.dnsperf.com/#!dns-resolvers,World,quality

125 points by petercooper 8y ago

I know this is not for everyone, but I strongly prefer to run my own recursive resolver at home. Performance is great, plus I get regular DNS for the machines on my home network. Also, it was a fun little project. :)

dbg31415 8y ago
I love my Pi Hole! Great for blocking ads on everything. * Pi-hole®: A black hole for Internet advertisements – curl -sSL https://install.pi-hole.net https://install.pi-hole.net | bash || https://pi-hole.net/ https://pi-hole.net/
- yaleman 8y ago
  The docker image is pretty trivial to set up too, so it's even easier :)
dspillett 8y ago
That and handy for network level filtering, such as PiHole.
sascha_sl 8y ago
I really like the flexibility of CoreDNS for that. I use Cloudflare with dnscrypt as my resolver and still get to use intranet things at work because I can just forward the zones I need there elsewhere.
skrause 8y ago
I like to share the cache of the DNS resolver with as many people as possible because that's what gives you the best performance. A local resolver just for me can't really do that.
- deleted 8y ago
  [deleted]
- ingenium 8y ago
  Google DNS (and likely others) doesn't really work that well for this unless it's a very popular domain because of the sheer number of servers that they run and the short TTLs on most records. Even on subsequent lookups, you're likely to hit a different backend server that doesn't have a record cached that you just looked up. Google's servers don't seem to share their cache between one another. Even reddit.com often has to do the full lookup. For a full local resolver, you can configure it to use and serve expired records, with a 0 TTL. In the background it will then lookup all records used, so that it's refreshed for next time. Cloudflare does this. Likewise, you can configure it to prefetch frequently requested records before they expire.
kingo55 8y ago
More people should do this. I recently switched my home network DNS forwarder from Bind to DNS Crypt Proxy (https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy). You can get ad/content filtering lists along with some little privacy enhancements like DNS Crypt and DNS over HTTPS support for encrypted DNS queries to supported services, like CloudFlare.
- kakarot 8y ago
  Even with DNS/HTTPS and such, wouldn't using a home DNS resolver with a VPN on both ends of the connection still make you a little more vulnerable to network analysis and timing attacks since your DNS requests are guaranteed to go through a specific IP which only serves you?
  - klodolph 8y ago
    Not sure what timing attacks you are talking about. Having traffic analysis in your threat model is an extreme choice, typically it means your adversaries include law enforcement agencies or state-level actors. Sending DNS over VPN might just mean that you don’t trust your ISP and think they might intercept the request and forge a response—something which does happen, and I’ve personally observed it at two different ISPs.
    - kakarot 8y ago
      It's not in my threat model per se, but it's something I give a lot of thought to because systems like this are expected to be used by political dissidents, whistleblowers and other persecuted individuals who are subject to such threat models. My ISP probably forges responses because they have no problem injecting html/js and hijacking ad space on unencrypted connections. As far as timing attacks, an example would be such: Even though you are at a coffee shop in an undisclosed location miles away from home, if LE has a reason to profile the IP you're broadcasting from at home they could do look at request times and try to link a request from the coffee shop to your home DNS server. If you use a public DNS server, you have the same benefit of using a public VPN vs a private VPN, in that your traffic gets bundled with everyone else's and obfuscated. It's harder to establish a link between you and the DNS server using network analysis because potentially thousands of connections are being made to that same DNS server from the same VPN node at the same time.
acranox 8y ago
That's great and all, but you still need to pick an upstream DNS server. The conventional advice is to use one of these public services, or your ISP's resolvers, to avoid hitting the root servers constantly. A lot of services these days have very short TTLs, so running your own recursive resolver still causes a lot of requests to get forwarded. Also, as counterintuitive as it might seem, when I use namebench ( https://code.google.com/archive/p/namebench/ https://code.google.com/archive/p/namebench/ ) it still says cloudflare and google are faster than my local resolver. (not by a lot though)
- deleted 8y ago
  [deleted]
- ingenium 8y ago
  You actually don't have to. The TTLs on NS records are generally pretty long, especially the root servers (6 days for root, 2 days for both .com and my domain's NS). You will hit the .com for example the first time you go to a domain, but so does Google. In my experience, Google's DNS has so many servers that even on subsequent requests, you hit a different server and it has to do the full lookup again (likely querying a root unless it's a popular domain). It's not really decreasing the load on the root servers that much, if at all. It might actually increase the load. One trick you can do to speed up your local recursive resolver is allowing it to serve expired records. Unbound in pfsense allows for this. If the record has been previously retrieved but is expired, it returns the record with a 0 TTL (to force the client to look it up again next time). This includes internally using expired NS records, for example to lookup a different subdomain. Meanwhile, in the background, it looks up all the records used to refresh the TTL, and serves/uses this next time. Generally speaking, expired records still work fine. I noticed that Cloudflare DNS does this as well, and regularly serves 0 TTL records. I've found that this consistently makes my local resolver faster than any public DNS server, except sometimes the very first time it looks up a domain. The slowest DNS queries are records which use lots of nested CNAMES on different domains with short TTLs, such as www.microsoft.com / most sites using akamai, which takes 500ms for the first lookup. There was a domain I saw the other day which had 4 or 5 layers of CNAMES which took 1-1.5 seconds to resolve initially.
agumonkey 8y ago
I use pdnsd as a local cache. It used to make browsing lightning fast. Although I might have messed up something since because dns resolution seems laggy. But in theory it is of great benefits.
tracker1 8y ago
Most home routers already do this for you, it's a bit abstracted but there, just need to specify the network and have it in the list of networks to resolve for DHCP. Or you can DIY it on another box. I find it's still best to defer to an upstream forward server vs. root resolution. Most of the providers mentioned have multiple points of presence and will likely be closer and resolve MUCH faster for most cases. DNS resolution time can be a huge factor in web responsiveness.

tw1010 8y ago

Do I have to?

JdeBP 8y ago
(You are referring to the original title.) Actually, no. Even if one does accept the premise that one should use these third-party non-contracted services, challenged elsewhere in this very discussion, there's no reason that one need have these things memorized. Written in a handy pocketbook, perhaps. But not necessarily memorized.

palijer 8y ago

DNS servers should not be used as "internet connectivity tests" by pinging them. They are not maintained as ICMP test servers, and that is not their purpose. While many do not block ICMP packets, there are typically rate limiting systems in place, and other reasons why they would not respond to ping requests. Pinging DNS servers is a shitty inconclusive test for internet connectivity, or SLA measurements etc etc.

johnchristopher 8y ago
So, what should we ping for testing Internet connectivity ?
- teddyh 8y ago
  There’s ping.sunet.se as maintained by the Swedish University Network (i.e. the network connecting Swedish Universities; there is no single “Swedish University”).
  - snazz 8y ago
    The advantage of pinging IPs is that you don’t have to have a working DNS setup to test your connection. If DNS does work, then your connection probably works, too.
    - 1_player 8y ago
      In this case one should run "ping -n", otherwise ping will hang trying to resolve the IP into an hostname, if the DNS is misbehaving or not responding.
      - sathackr 8y ago
        what default(included in OS) ping utility tries to reverse-lookup an address before pinging, and hangs if it can't. I've never observed this in any version of Windows nor Linux.
- 8y ago

skrause 8y ago

The best tip is in the sidebar on that page: > 1.0.0.1 abbreviates to 1.1, so you can literally test by typing "ping 1.1"

geocar 8y ago
You can also ping 16843009 and 16777217 -- perhaps less memorable, but if your dot key is broken…
300bps 8y ago
IP addresses are fundamentally 32 bit numbers. The a.b.c.d format is just for ease of use on humans and as the tip in the sidebar shows has its own shortcuts. But there are several formats that most operating systems support such as decimal, binary, hex, octal: https://www.abuseipdb.com/tools/ip-address-converter?ip=1.1.1.1 https://www.abuseipdb.com/tools/ip-address-converter?ip=1.1....

sangaya 8y ago

https://pi-hole.net/ https://pi-hole.net/ is a project to consider for home and small business networks that you're looking to protect via DNS without sending all your requests to a third party.

snazz 8y ago
Your requests are still forwarded to a third party with a Pi-hole. They are sometimes cached and sites you have blocked do not resolve, but choosing a DNS provider is still required.
- prepend 8y ago
  Only non-cached requests go to a third party. And I don’t think there’s an easy way to prevent this unless you get a hold of all the zone files and copy in bulk. What’s nice about pi-hole is that you get one request to sites like google.com until the record expires in the cache. If you use 8.8.8.8 as your dns you might end up requesting the same domain name a bunch of times depending on how your client caches and the caching is at 8.8.8.8. So dns will see lots of requests to the same domain.
  - dx034 8y ago
    In a network of just a few computers, are there really that many cached requests? Local DNS caches will already cache short term and TTL of most domains is probably too short to get much caching beyond that.
    - snazz 8y ago
      Looking at my dnsmasq statistics, only 16.3% of 10,776 queries in the last 24 hours have been answered by the cache. Another 21.7% never left the device, since they were in the block lists, but that still leaves 62.0% of queries to be returned by 1.1.1.1 and 1.0.0.1, which is my external DNS provider. Although this doesn’t count on-client caching, it still seems to back up your guess and my original comment.
    - 8y ago

userbinator 8y ago

Surprised that 4.2.2.x (Level3) is not on the list --- it's also unfiltered DNS, and run by a company that focuses only on networking.

becauseiam 8y ago
4.2.2.2 is supposedly for Level3 customers only.
Nux 8y ago
At some point a few years back they started to redirect some of the traffic to some dodgy ad sites, that's when I stopped using them.

tyingq 8y ago

Dnsperf.com is worth a look as well, to compare performance of all of these. Public DNS resolvers: https://www.dnsperf.com/#!dns-resolvers https://www.dnsperf.com/#!dns-resolvers DNS services for your own domain: https://www.dnsperf.com/ https://www.dnsperf.com/

gmac 8y ago

Another option here is DNS servers that block ads. I can't vouch for the company itself, but I have found AdGuard DNS reliable and effective, if not memorable: 176.103.130.130, 176.103.130.131 https://adguard.com/en/adguard-dns/overview.html https://adguard.com/en/adguard-dns/overview.html

theandrewbailey 8y ago
Run your own: https://pi-hole.net/ https://pi-hole.net/
- vanadium 8y ago
  And then either install Cloudflared [1], or Unbound [2]. [1] https://bendews.com/posts/implement-dns-over-https/ https://bendews.com/posts/implement-dns-over-https/ [2] https://pi-hole.net/2018/06/09/ftldns-and-unbound-combined-for-your-own-all-around-dns-solution/ https://pi-hole.net/2018/06/09/ftldns-and-unbound-combined-f...
- gmac 8y ago
  Genuine question: what benefits does this have over using a service provided for free by someone else? Privacy?
  - theandrewbailey 8y ago
    Yes, privacy, plus it's a DNS cache that's running on your local network, so your DNS resolution is faster. Its also customizable (you can add/blacklist/whitelist specific domains from the control panel).

flox25 8y ago

So the author is a security expert who recommends two companies that are notorious for their security flaws (Norton, Cisco), two companies that track your DNS queries for profiling (Google, Cloudflare) and IBM... Yeah, this sounds totally legit...

throwaway9d0291 8y ago
> two companies that track your DNS queries for profiling (Google, Cloudflare) Can you elaborate? Neither Google nor CloudFlare seem to collect information for profiling. Google: https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy CloudFlare: https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/privacy-policy/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
- flox25 8y ago
  What? How do you come to that conclusion? Google actually tells you what it is collecting, if you cannot see how, say, city of origin, cannot be used to target you with specific search result, then I really cannot explain it to you. Cloudflare does not store any information, but they are pretty frank about passing it on to APNIC for "research" as part of the deal where APNIC lend the 1.0.0.1 and 1.1.1.1 address to them. This is pretty well established and actually openly communicated by both entities, so should be easy to DDG. You are of course free to believe that this data is totally anonymized and not used for profiling / targeting at all, but imo that is pretty naive.
  - zackbloom 8y ago
    I work at Cloudflare. APNIC absolutely does not get individual DNS query logs. Their primary interest is in studying the other junk traffic which ends up hitting 1.1.1.1. For the record, we don't build any sort of profile of DNS queryiers, map them back to any existing profile we have, or even keep the data you would need to have to do that.
    - 8y ago

jcims 8y ago

Anybody remember 128.146.1.7?

TheForumTroll 8y ago

>Cisco Umbrella Resident evil. It has begun.

auslander 8y ago

> Logs are kept for 24 hours for debugging purposes, then they are purged Legalese is very hard to learn language. Do they keep aggregate data, derived from those raw logs? It is not said. Trusting Cloudflare? It is a profit driven company, to start with ...

zackbloom 8y ago
I work at Cloudflare. We don't sell data of any form, and we don't keep anything which could map queries back to the individual who made them. When we talk about aggregate data it's things like total number of queries made to 1.1.1.1, number made by AS, and geographic region. Its purpose is only to show us if people are using 1.1.1.1 and how that changes over time.

rndomsrmn 8y ago

Or setup your own very lightweight filtering and caching DNS at home using Dnsmasq and https://github.com/notracking/hosts-blocklists/ https://github.com/notracking/hosts-blocklists/

3xblah 8y ago

His blog post pays no mention of users whose DNS queries are being redirected. Isn't that a privacy concern? Hotels and ISPs sometimes set up captive portals that intercept and redirect port 53 to their own choice of DNS servers. As such, users might want memorise the addresses of some resolvers that listen on non-standard ports (not port 53). A user behind one of these captive portals who pings any of the resolvers in this blog post will not be pinging those servers; she will be pinging the hotel/ISP's chosen DNS servers and she may be none the wiser.

Tor3 8y ago
In a hotel I always first thing direct everything through a VPN server (work or home, depending on what I want to do). Some hotels block UDP, in that case I switch the VPN to go via TCP port 443. But some hotels (really!) block port 443.. fortunately not that many anymore.
- 3xblah 8y ago
  When you use a home VPN server, is the VPN server running on a computer located at your home and reachable on the open internet? If yes, do you have fixed address or do you use dynamic DNS?
  - Tor3 8y ago
    I could have set it up at home (the address is stable), but I have a server on a hosting facility which I use as my "home central".

darrmit 8y ago

I made the jump to CleanBrowsing a few months ago from OpenDNS because OpenDNS caches records really aggressively and was just generally stagnant in terms of feature set. I've been really happy with performance and privacy. I configured DNScrypt on Tomato and I also use Tomato to redirect all DNS requests so it can't be bypassed by simply re-pointing DNS. VPN obviously bypasses it. https://cleanbrowsing.org/how-it-works https://cleanbrowsing.org/how-it-works

miyuru 8y ago

> If you care about privacy and speed and maximum memorability, I recommend CloudFlare I disagree with the speed part, because cloudflare doesn't support EDNS. This is great for privacy but not for speed. Here is proof: https://pastebin.com/raw/QnbWXU1a https://pastebin.com/raw/QnbWXU1a If he meant speed in the DNS resolution context, I somewhat agree with him.

nykolasz 8y ago

I need to point out that Norton DNS has been retired and is not supported anymore (and never offered any privacy). "On November 15, 2018, Norton ConnectSafe service is being retired or discontinued meaning the service will no longer be available or supported. You may continue to use ConnectSafe until November 15, 2018. However, we do recommend that you take a moment to review important details related to this announcement below." Some alternatives: https://medium.com/@nykolas.z/norton-connectsafe-dns-is-shutting-down-this-is-what-you-need-to-do-3e70432697d9 https://medium.com/@nykolas.z/norton-connectsafe-dns-is-shut... I am actually surprised he didn't mention CleanBrowsing in their list, which I would recommend as good alternative to Norton and OpenDNS.

wtmt 8y ago

I used OpenDNS long ago, even though it wasn't as easy to remember as the ones that came later. Then I shifted to Google DNS and stayed with it, albeit with some discomfort (even if the policies state it doesn't track, it's still a leap of faith for me). Then last year I switched to Cloudflare DNS and also learned about Quad9 DNS. I haven't done local benchmarking using a tool like namebench for a long time, and it looks like that tool has not been updated for several years. Any alternatives for it that are cross platform?

jlgaddis 8y ago
> I haven't done local benchmarking using a tool like namebench for a long time, and it looks like that tool has not been updated for several years. In fairness, the DNS protocol that it's testing hasn't really changed in that time either. namebench is still sufficient for general testing.

WiredShark 8y ago

Quality, latency, and uptime are also factors: https://www.dnsperf.com/#!dns-resolvers,World,quality https://www.dnsperf.com/#!dns-resolvers,World,quality