3 ms·

For almost every service this genuinely doesn't matter, becasue the authorative DNS server for a given domain will most likely be run by the same entity that ru

For almost every service this genuinely doesn't matter, becasue the authorative DNS server for a given domain will most likely be run by the same entity that runs the server you want to talk to. I wanna point out that a recursive resolver normally caches everything it is allowed to cache, so visting the same site a few times will not, in general, produce any extra DNS requests.

akvadrako 7y ago
Not really. You first have to talk to the root server, then .xxx, then the server for the domain.
- blattimwind 7y ago
  The first steps of the chain are so generic there will be no useful data in there and the TTL is normally high (~a day). The last one or two steps are pretty directly connected to the service you are connecting to anyway. I don't really see an argument how caching RR is worse than centralized DNS at Google or Cloudflare or whomever, from a privacy perspective.
  - akvadrako 7y ago
    They do contain useful data. You are telling the root servers what tlds you are talking to and telling the tld operator what 2nd level domain you are talking to.
    - pdkl95 7y ago
      Yes, you hae to ask the tld's server for the NS record - the delegated domain's authoritative server. That's one request that usually has a much longer TTL. I've seen TTLs of multiple days or even weeks for NS records, compared to 5 minute TTLs (or less!) for A records. Every few days/weeks the tld gets a single query that tells them you were making some sort of request so an unknown domain anywhere in queried delegation. That query only includes the 2nd level domain and a request for that domain's nameserver(s). The rest of the recursive resolution and most future queries only need to involve the domain's nameserver. Yes, some information is leaked. This is unfortunate, but there is a huge difference between leaking that you occasionally visit something at exsmple.com and leaking your pattern of life (the exact subdomains you visit with ~minute-ish granularity).

akvadrako 7y ago

Not really. You first have to talk to the root server, then .xxx, then the server for the domain.

blattimwind 7y ago
The first steps of the chain are so generic there will be no useful data in there and the TTL is normally high (~a day). The last one or two steps are pretty directly connected to the service you are connecting to anyway. I don't really see an argument how caching RR is worse than centralized DNS at Google or Cloudflare or whomever, from a privacy perspective.
- akvadrako 7y ago
  They do contain useful data. You are telling the root servers what tlds you are talking to and telling the tld operator what 2nd level domain you are talking to.
  - pdkl95 7y ago
    Yes, you hae to ask the tld's server for the NS record - the delegated domain's authoritative server. That's one request that usually has a much longer TTL. I've seen TTLs of multiple days or even weeks for NS records, compared to 5 minute TTLs (or less!) for A records. Every few days/weeks the tld gets a single query that tells them you were making some sort of request so an unknown domain anywhere in queried delegation. That query only includes the 2nd level domain and a request for that domain's nameserver(s). The rest of the recursive resolution and most future queries only need to involve the domain's nameserver. Yes, some information is leaked. This is unfortunate, but there is a huge difference between leaking that you occasionally visit something at exsmple.com and leaking your pattern of life (the exact subdomains you visit with ~minute-ish granularity).