4 ms·

I would hardly consider blindly trusting a third party like cloudflare to be over-engineering.

traceroute66 5y ago
"I over-engineered my network for privacy" .... by trusting a third-party for DNS resolution. Doesn't compute ! Even more so as the OP chose Cloudflare ! US Jursisdiction + Commercial Company ?
- lostlogin 5y ago
  Have you got a recommendation? I see them as a good choice compared to my other options. but if there is better out there…
  - ignoramous 5y ago
    Use DNSCrypt with anonymized relays: https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-DNS https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-D... Or, wait until ODoH goes mainstream: https://datatracker.ietf.org/doc/html/draft-pauly-dprive-oblivious-doh-06 https://datatracker.ietf.org/doc/html/draft-pauly-dprive-obl...
  - traceroute66 5y ago
    > Have you got a recommendation? Well, if you're going to go to the trouble of building and running your own VMs or docker images then the obvious recommendation is to run your own recursive resolver (Unbound or Knot Resolver). The added bonus is that CDN content will operate as expected for your IP range instead of you talking to the CDN server nearest to whatever datacentre you spoke to the third-party DNS BGP anycast on. This may or may not be a big deal depending on your geographic location and internet connection. I am aware some third-party DNS services have options to try to fix the CDN problem, but YMMV as to whether this works in practice. Otherwise, if I was forced to name a third-party, I would likely name Quad9. Especially after their recent relocation to Swiss jurisdiction[1]. IIRC (its been a while since I read it) their privacy policy is also better than Cloudflare's too (e.g. no weird, "we'll retain some stuff for 25 hours" IIRC). [1] https://www.quad9.net/news/blog/quad9-public-domain-name-service-moves-to-switzerland-for-maximum-internet-privacy-protection/ https://www.quad9.net/news/blog/quad9-public-domain-name-ser...
  - miked85 5y ago
    Run your own DNS server such as Unbound [1]. [1] https://nlnetlabs.nl/projects/unbound/about/ https://nlnetlabs.nl/projects/unbound/about/
  - quartz 5y ago
    Setting up a local DNS server is super easy with unbound + pihole: https://docs.pi-hole.net/guides/dns/unbound/ https://docs.pi-hole.net/guides/dns/unbound/.
  - goodpoint 5y ago
    Use Tor, or at the very least, use Tor for DNS, otherwise it's pointless.
  - rsync 5y ago
    "Have you got a recommendation?" I run my own resolving nameserver (unbound) on a server in a datacenter (but could be DO or EC2 or whatever). The upstream for my nameserver is the DNS I set up for myself at nextdns.io which is ad-filtered like a pi-hole. So I use my own DNS server and distribute that address to whomever or whatever needs it - and I control the traffic and usage and monitoring of it - but I also get ad-filtering without having to run a pi-hole. Recommended.
greyivy 5y ago
This! unbound (a local DNS server) is painfully easy to set up and one of those programs that just works. Performance has been solid too and it cooperates well with Pi-hole. There are privacy-concious DNS servers that aren't based in the US too, if you insist on not self-hosting.

"I over-engineered my network for privacy" .... by trusting a third-party for DNS resolution. Doesn't compute ! Even more so as the OP chose Cloudflare ! US Jursisdiction + Commercial Company ?

lostlogin 5y ago
Have you got a recommendation? I see them as a good choice compared to my other options. but if there is better out there…
- ignoramous 5y ago
  Use DNSCrypt with anonymized relays: https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-DNS https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-D... Or, wait until ODoH goes mainstream: https://datatracker.ietf.org/doc/html/draft-pauly-dprive-oblivious-doh-06 https://datatracker.ietf.org/doc/html/draft-pauly-dprive-obl...
- traceroute66 5y ago
  > Have you got a recommendation? Well, if you're going to go to the trouble of building and running your own VMs or docker images then the obvious recommendation is to run your own recursive resolver (Unbound or Knot Resolver). The added bonus is that CDN content will operate as expected for your IP range instead of you talking to the CDN server nearest to whatever datacentre you spoke to the third-party DNS BGP anycast on. This may or may not be a big deal depending on your geographic location and internet connection. I am aware some third-party DNS services have options to try to fix the CDN problem, but YMMV as to whether this works in practice. Otherwise, if I was forced to name a third-party, I would likely name Quad9. Especially after their recent relocation to Swiss jurisdiction[1]. IIRC (its been a while since I read it) their privacy policy is also better than Cloudflare's too (e.g. no weird, "we'll retain some stuff for 25 hours" IIRC). [1] https://www.quad9.net/news/blog/quad9-public-domain-name-service-moves-to-switzerland-for-maximum-internet-privacy-protection/ https://www.quad9.net/news/blog/quad9-public-domain-name-ser...
- miked85 5y ago
  Run your own DNS server such as Unbound [1]. [1] https://nlnetlabs.nl/projects/unbound/about/ https://nlnetlabs.nl/projects/unbound/about/
- quartz 5y ago
  Setting up a local DNS server is super easy with unbound + pihole: https://docs.pi-hole.net/guides/dns/unbound/ https://docs.pi-hole.net/guides/dns/unbound/.
- goodpoint 5y ago
  Use Tor, or at the very least, use Tor for DNS, otherwise it's pointless.
- rsync 5y ago
  "Have you got a recommendation?" I run my own resolving nameserver (unbound) on a server in a datacenter (but could be DO or EC2 or whatever). The upstream for my nameserver is the DNS I set up for myself at nextdns.io which is ad-filtered like a pi-hole. So I use my own DNS server and distribute that address to whomever or whatever needs it - and I control the traffic and usage and monitoring of it - but I also get ad-filtering without having to run a pi-hole. Recommended.

greyivy 5y ago

This! unbound (a local DNS server) is painfully easy to set up and one of those programs that just works. Performance has been solid too and it cooperates well with Pi-hole. There are privacy-concious DNS servers that aren't based in the US too, if you insist on not self-hosting.