4 ms·

Sure, here are three off the top of my head that have affected me personally (not to mention the million other possible different scenarios that might exist):

Sure, here are three off the top of my head that have affected me personally (not to mention the million other possible different scenarios that might exist): 1. In one case, I have multiple machines on the same network but simply speaking, none of them are turned on 24/7 (except for the router), so none of them can be configured to be a common caching resolver. The router is a proprietary Unifi gateway device, for which it is not possible to configure it to use DNS-over-TLS, neither on the local side nor when forwarding to the public DNS server. 2. The other common case for me are my mobile devices (laptops and smartphones). I simply cannot configure them to use a common local caching DNS server because there isn't one, as these devices frequently connect over multiple networks (such as 5G networks, hotel Wi-Fi, etc) and you cannot just use the network-provided DNS server without being vulnerable to man-in-the-middle attacks, censored and hijacked results, etc. 3. Another issue is public Wi-Fi networks. In large hotels, stadiums, etc, there might be hundreds or even thousands of devices behind the public same IP address(es), and as a user yourself, you have no control over them or the network. And obviously, you cannot just use their provided DNS server on these Wi-Fi networks, for multiple reasons: 1) why would you trust the DNS server of a random Wi-Fi network in the first place?, 2) even if you trusted the provider, it is not possible to authenticate these networks, so you could be talking to a man-in-the-middle attacker without realizing, and 3) even if there isn't a man-in-the-middle attacker and the provider is trustworthy, often these DNS servers are extremely poor, as they often censor and hijack results, pollute the DNS cache, don't support DNSSEC queries, etc. And I'm not even mentioning the privacy issues. To be clear, I always use local caching resolvers. But on these systems, I am forced to configure them to forward queries directly to public DNS servers, which means that they don't have a common caching resolver except for the public DNS server itself, hence the rate limit issue when they are all behind the same IP address.

jeroenhd 3y ago
I don't know, the easiest solution would be "run your own DNS server that you point the weird servers at". A handful of euros per month for a VPS will get you more DNS queries than you'll ever need. No need to even hit Cloudflare when you can turn on the recursive setting on your own server; this protects you against the viable but unlikely scenario that Cloudflare messes with your DNS/gets its DNS cache poisoned/goes down. PowerDNS + DoH + DoT can be configured in an afternoon. Another if you need to read some dnsdist documentation and add a LUA script to prevent DDoS in case you're not able to authenticate clients (https://dnsdist.org/rules-actions.html https://dnsdist.org/rules-actions.html and https://dnsdist.org/advanced/qpslimits.html https://dnsdist.org/advanced/qpslimits.html are a nice start). Nothing wrong with using a public DNS resolver for your own devices, but I think using public services like these for benchmarking/load testing is abusing the generosity of the people running these servers.
- someplaceguy 3y ago
  It's not a money issue, as I have multiple servers already which could easily provide this service, and it's even less of a configuration issue, as I am perfectly capable of configure this if I wanted. But these servers are in different countries, so they would be much slower than Cloudflare DNS due to network latency. And even if I had a server in the same country for my client devices, I frequently travel to other countries anyway. I don't think I am abusing these servers, as I only use them normally as a user, it's not like I am scraping the Internet or anything like that. Unlike the OP, I am not doing any benchmarking or load testing or anything similar.
willcipriano 3y ago
I can't imagine what use case requires dozens of devices, hooked up to potentially untrusted random public wifi networks, making many DNS requests all at the same instant. For your very odd use case I'd suggest hosting your own recursive resolver someplace like AWS and pointing to that, but I suspect if you checked your priors you probably can change something about the first 3 conditions.
- someplaceguy 3y ago
  I just told you three reasons why this would happen, and I'm sure there are many more. It's obvious that these machines can be making DNS queries simultaneously, why wouldn't they? They are completely independent of each other. And don't forget the number of DNS queries are also magnified when the machines are configured to do DNSSEC verification. > For your very odd use case I'd suggest hosting your own recursive resolver someplace like AWS and pointing to that, but I suspect if you checked your priors you probably can change something about the first 3 conditions. First of all, it's not an odd use case. I think everyone has a laptop and a smartphone, and if they are not following my security practices it's either out of ignorance or out of complacency / not caring, it's not because they are doing what they should be doing. And I'm not even talking about DNSSEC here, just the basic "don't trust random Wi-Fi networks / DNS servers". And second, why can't you imagine a hotel Wi-Fi network with hundreds or thousands of devices, all of them hooked to the same public Wi-Fi network (the hotel-provided one), configured to use a public DNS server and making requests at the same instant? What is so hard to imagine about that? Hell, some public Wi-Fi networks don't even have a local DNS server, they directly send the public Google DNS server IP addresses to all clients as part of their DHCP replies!
  - willcipriano 3y ago
    > they directly send the public Google DNS servers to all clients as part of their DHCP replies! Why is that a problem for your use case? > hundreds or thousands of devices, all of them hooked to the same public Wi-Fi network I expect you to run a dns cache/resolver at that scale and not freeload. You have plenty of customers/employees and must be making enough money.

jeroenhd 3y ago

I don't know, the easiest solution would be "run your own DNS server that you point the weird servers at". A handful of euros per month for a VPS will get you more DNS queries than you'll ever need. No need to even hit Cloudflare when you can turn on the recursive setting on your own server; this protects you against the viable but unlikely scenario that Cloudflare messes with your DNS/gets its DNS cache poisoned/goes down. PowerDNS + DoH + DoT can be configured in an afternoon. Another if you need to read some dnsdist documentation and add a LUA script to prevent DDoS in case you're not able to authenticate clients (https://dnsdist.org/rules-actions.html https://dnsdist.org/rules-actions.html and https://dnsdist.org/advanced/qpslimits.html https://dnsdist.org/advanced/qpslimits.html are a nice start). Nothing wrong with using a public DNS resolver for your own devices, but I think using public services like these for benchmarking/load testing is abusing the generosity of the people running these servers.

someplaceguy 3y ago
It's not a money issue, as I have multiple servers already which could easily provide this service, and it's even less of a configuration issue, as I am perfectly capable of configure this if I wanted. But these servers are in different countries, so they would be much slower than Cloudflare DNS due to network latency. And even if I had a server in the same country for my client devices, I frequently travel to other countries anyway. I don't think I am abusing these servers, as I only use them normally as a user, it's not like I am scraping the Internet or anything like that. Unlike the OP, I am not doing any benchmarking or load testing or anything similar.

willcipriano 3y ago

I can't imagine what use case requires dozens of devices, hooked up to potentially untrusted random public wifi networks, making many DNS requests all at the same instant. For your very odd use case I'd suggest hosting your own recursive resolver someplace like AWS and pointing to that, but I suspect if you checked your priors you probably can change something about the first 3 conditions.

someplaceguy 3y ago
I just told you three reasons why this would happen, and I'm sure there are many more. It's obvious that these machines can be making DNS queries simultaneously, why wouldn't they? They are completely independent of each other. And don't forget the number of DNS queries are also magnified when the machines are configured to do DNSSEC verification. > For your very odd use case I'd suggest hosting your own recursive resolver someplace like AWS and pointing to that, but I suspect if you checked your priors you probably can change something about the first 3 conditions. First of all, it's not an odd use case. I think everyone has a laptop and a smartphone, and if they are not following my security practices it's either out of ignorance or out of complacency / not caring, it's not because they are doing what they should be doing. And I'm not even talking about DNSSEC here, just the basic "don't trust random Wi-Fi networks / DNS servers". And second, why can't you imagine a hotel Wi-Fi network with hundreds or thousands of devices, all of them hooked to the same public Wi-Fi network (the hotel-provided one), configured to use a public DNS server and making requests at the same instant? What is so hard to imagine about that? Hell, some public Wi-Fi networks don't even have a local DNS server, they directly send the public Google DNS server IP addresses to all clients as part of their DHCP replies!
- willcipriano 3y ago
  > they directly send the public Google DNS servers to all clients as part of their DHCP replies! Why is that a problem for your use case? > hundreds or thousands of devices, all of them hooked to the same public Wi-Fi network I expect you to run a dns cache/resolver at that scale and not freeload. You have plenty of customers/employees and must be making enough money.