5 ms·

What free or (non-free) DNS services is everyone using?

teddyh 5y ago
Run your own resolver, on your local machine. It’s the only way. Only if you have a local network of machines can you consider making one of these machines the resolver for the local network. A typical example of this might be your router. This machine should then not forward the DNS requests to some centralized resolver, it should resolve DNS queries itself.
- 1vuio0pswjnm7 5y ago
  "Run your own resolver, on your local machine. It's the only way." It is not the only way. I use scan.io as one source of DNS data. No need for resolvers. The needed data can be saved to a zone file for a local authoritative server or a map file for a forward proxy. The later option requires no DNS at all.
  - 1vuio0pswjnm7 5y ago
    s/scan/&s/
- cubesnooper 5y ago
  But that would leak all of my DNS queries in cleartext. I use cloudflared to do DNS lookups via Cloudflare’s Tor onion. It’s weak to vulnerabilities like this one, but it disassociates my DNS lookups from myself, and TLS certificates mitigate the risk of hitting spoofed sites.
  - teddyh 5y ago
    > But that would leak all of my DNS queries in cleartext. The longer-term solution is to wait for DoT to become prevalent in authorative servers. But, realistically, won’t you “leak” your IP anyway when you make your actual connection? I mean, why are you looking up things in the DNS if not to connect to them? And if you make a connection, you leak your IP. If you’re not concerned with the other party’s DNS servers, but with the root servers and TLD DNS servers snooping on your queries, I think you’ll have to wait for QNAME minimization to arrive.
    - cubesnooper 5y ago
      Recursive resolution leaks all my DNS queries in plaintext to my ISP, the nameservers, and everyone in between; on top of that, my ISP can monitor what sites I’m viewing through SNI and server IP. If my DNS queries are encrypted and anonymized, my ISP only gets SNI and server IP. And ECH seems to be moving quickly, so within a couple of years I expect the SNI leak to be plugged. > The longer-term solution is to wait for DoT to become prevalent in authorative servers. That has a serious deployment problem, far more so than ECH. It’s going to be years (and years and years) before a person can successfully do recursive resolution via TLS. Is that even on anyone’s roadmap?
tentacleuno 5y ago
AdGuard[0]. Ad-blocking included :) It's on 94.140.14.14, 94.140.15.15 (know them by heart now) if you want to try it. I've never had a problem with them. There's also a comprehensive list and comparison of various DNS providers at PrivacyGuides[1]. [0]: https://adguard-dns.com/ https://adguard-dns.com/ [1]: https://privacyguides.org/providers/dns/ https://privacyguides.org/providers/dns/
errantmind 5y ago
Two general approaches: 1. A pi-hole on my local network for most devices. I configured my router to forcibly capture all (unencrypted) DNS queries and forward them to my pi-hole, which then forwards them upstream to Cloudflare's DNS (over TLS). 2. I wrote a simple DNS forwarder (over TLS) that uses a 'shotgun' approach to ensure timely query responses, among other performance-sensitive features. I use this on all my Linux machines. It runs as a service and never fails, mean latency is much lower than other forwarders I've tried, including systemd-resolved, unbound, etc.
- citizenpaul 5y ago
  Any chance you woukd be willing to share this shotgun dns program with HN or at least some details.sounds interesting.
FireInsight 5y ago
Used to use Pihole but pi disk corrupted and didn't bother to set up again. Nowadays Quad9 9.9.9.9 and local ad/tracker blocking.
ftobin 5y ago
Cloudflare's malware blocking service is my go-to. 1.1.1.2, supporting DoH and DoT. I prefer them over Quad9 because Google blog post listed several malware domains and Quad9 only caught half, while Cloudflare caught them all. https://www.reddit.com/r/Quad9/comments/t9b9v1/quad9_not_catching_domain_google_is_reporting_as/ https://www.reddit.com/r/Quad9/comments/t9b9v1/quad9_not_cat...
- dorianmariefr 5y ago
  I think you meant 1.1.1.1 even though https://1.1.1.2/ https://1.1.1.2/ redirects to 1.1.1.1
  - kingcharles 5y ago
    No, I just checked, 1.1.1.1 resolves everything. 1.1.1.2 & 1.0.0.2 are their malware-blocking servers.
  - iampims 5y ago
    1.1.1.2 is correct, see this blogpost: https://blog.cloudflare.com/introducing-1-1-1-1-for-families/ https://blog.cloudflare.com/introducing-1-1-1-1-for-families...
- benbristow 5y ago
  1.1.1.1 is good but it has a bit of an annoying issue where it won't resolve archive.is/archive.today names. It's been discussed before https://news.ycombinator.com/item?id=19828317 https://news.ycombinator.com/item?id=19828317 I use that site quite often so it makes it a bit of a no-go.
  - charcircuit 5y ago
    Both archive.is and archive.today resolve for me with 1.1.1.1.
  - seanhunter 5y ago
    I am on 1.1.1.1 and it resolves archive.is just fine. I seemingly can't view a number of pages there because of "no cipher overlap" if I turn on https-only but that is not a cloudflare dns problem.
xorcist 5y ago
apt-get install unbound
mdavids 5y ago
At home I have my own (Unbound) resolver, when on the road I use NextDNS.
tipoftheiceberg 5y ago
NextDNS , highly recommended.

Run your own resolver, on your local machine. It’s the only way. Only if you have a local network of machines can you consider making one of these machines the resolver for the local network. A typical example of this might be your router. This machine should then not forward the DNS requests to some centralized resolver, it should resolve DNS queries itself.

1vuio0pswjnm7 5y ago
"Run your own resolver, on your local machine. It's the only way." It is not the only way. I use scan.io as one source of DNS data. No need for resolvers. The needed data can be saved to a zone file for a local authoritative server or a map file for a forward proxy. The later option requires no DNS at all.
- 1vuio0pswjnm7 5y ago
  s/scan/&s/
cubesnooper 5y ago
But that would leak all of my DNS queries in cleartext. I use cloudflared to do DNS lookups via Cloudflare’s Tor onion. It’s weak to vulnerabilities like this one, but it disassociates my DNS lookups from myself, and TLS certificates mitigate the risk of hitting spoofed sites.
- teddyh 5y ago
  > But that would leak all of my DNS queries in cleartext. The longer-term solution is to wait for DoT to become prevalent in authorative servers. But, realistically, won’t you “leak” your IP anyway when you make your actual connection? I mean, why are you looking up things in the DNS if not to connect to them? And if you make a connection, you leak your IP. If you’re not concerned with the other party’s DNS servers, but with the root servers and TLD DNS servers snooping on your queries, I think you’ll have to wait for QNAME minimization to arrive.
  - cubesnooper 5y ago
    Recursive resolution leaks all my DNS queries in plaintext to my ISP, the nameservers, and everyone in between; on top of that, my ISP can monitor what sites I’m viewing through SNI and server IP. If my DNS queries are encrypted and anonymized, my ISP only gets SNI and server IP. And ECH seems to be moving quickly, so within a couple of years I expect the SNI leak to be plugged. > The longer-term solution is to wait for DoT to become prevalent in authorative servers. That has a serious deployment problem, far more so than ECH. It’s going to be years (and years and years) before a person can successfully do recursive resolution via TLS. Is that even on anyone’s roadmap?

tentacleuno 5y ago

AdGuard[0]. Ad-blocking included :) It's on 94.140.14.14, 94.140.15.15 (know them by heart now) if you want to try it. I've never had a problem with them. There's also a comprehensive list and comparison of various DNS providers at PrivacyGuides[1]. [0]: https://adguard-dns.com/ https://adguard-dns.com/ [1]: https://privacyguides.org/providers/dns/ https://privacyguides.org/providers/dns/

errantmind 5y ago

Two general approaches: 1. A pi-hole on my local network for most devices. I configured my router to forcibly capture all (unencrypted) DNS queries and forward them to my pi-hole, which then forwards them upstream to Cloudflare's DNS (over TLS). 2. I wrote a simple DNS forwarder (over TLS) that uses a 'shotgun' approach to ensure timely query responses, among other performance-sensitive features. I use this on all my Linux machines. It runs as a service and never fails, mean latency is much lower than other forwarders I've tried, including systemd-resolved, unbound, etc.

citizenpaul 5y ago
Any chance you woukd be willing to share this shotgun dns program with HN or at least some details.sounds interesting.

FireInsight 5y ago

Used to use Pihole but pi disk corrupted and didn't bother to set up again. Nowadays Quad9 9.9.9.9 and local ad/tracker blocking.

ftobin 5y ago

Cloudflare's malware blocking service is my go-to. 1.1.1.2, supporting DoH and DoT. I prefer them over Quad9 because Google blog post listed several malware domains and Quad9 only caught half, while Cloudflare caught them all. https://www.reddit.com/r/Quad9/comments/t9b9v1/quad9_not_catching_domain_google_is_reporting_as/ https://www.reddit.com/r/Quad9/comments/t9b9v1/quad9_not_cat...

dorianmariefr 5y ago
I think you meant 1.1.1.1 even though https://1.1.1.2/ https://1.1.1.2/ redirects to 1.1.1.1
- kingcharles 5y ago
  No, I just checked, 1.1.1.1 resolves everything. 1.1.1.2 & 1.0.0.2 are their malware-blocking servers.
- iampims 5y ago
  1.1.1.2 is correct, see this blogpost: https://blog.cloudflare.com/introducing-1-1-1-1-for-families/ https://blog.cloudflare.com/introducing-1-1-1-1-for-families...
benbristow 5y ago
1.1.1.1 is good but it has a bit of an annoying issue where it won't resolve archive.is/archive.today names. It's been discussed before https://news.ycombinator.com/item?id=19828317 https://news.ycombinator.com/item?id=19828317 I use that site quite often so it makes it a bit of a no-go.
- charcircuit 5y ago
  Both archive.is and archive.today resolve for me with 1.1.1.1.
- seanhunter 5y ago
  I am on 1.1.1.1 and it resolves archive.is just fine. I seemingly can't view a number of pages there because of "no cipher overlap" if I turn on https-only but that is not a cloudflare dns problem.

xorcist 5y ago

apt-get install unbound

mdavids 5y ago

At home I have my own (Unbound) resolver, when on the road I use NextDNS.

tipoftheiceberg 5y ago

NextDNS , highly recommended.