4 ms·
I do the same, but I read that that is also sending your IP all around the internet, which can have repercussions? The alternative is to not use a recursive res
by minerjoe 6y ago
I do the same, but I read that that is also sending your IP all around the internet, which can have repercussions? The alternative is to not use a recursive resolver, but just punt to one of the "safer" ones such as 1.1.1.1?
edit: downvoting honest questions?
- jlgaddis 6y agoWhat, exactly, does "sending your IP all around the internet" even mean?
- minerjoe 6y agoMeaning, if you don't want people to know you are searching for snm.donkeyporn.com than going out to the nameserver that donkeyporn is using is not exactly keeping the information private.
- viraptor 6y agoIn practice with 1.1.1.1 you're trading the parties who know about your access from: Donkeyporn's DNS provider, com's DNS provider (0.1% chance it's not already cached), your ISP, transit providers, donkeyporn's ISP, donkeyporn service To: cloudflare, your ISP, transit providers, donkeyporn's ISP, donkeyporn service It's not a huge change and it's really about whether you trust CloudFlare more than the service donkeyporn has chosen.
- Arnavion 6y agoYou are correct that if you run your own resolver, then all the DNS traffic from your resolver to other nameservers is in cleartext. DoH and DoT only get used by forwarders.
- _-___________-_ 6y agoWorth noting that until Encrypted SNI is universally used, you probably transmit snm.donkeyporn.com in the clear when your browser does the initial TLS exchange anyway. I personally feel that concentrating all the information of "what DNS names are people looking up" into the hands of a few parties (e.g. CloudFlare) makes it much easier to collect and analyze this information.