3 ms·

I just told you three reasons why this would happen, and I'm sure there are many more. It's obvious that these machines can be making DNS queries simultaneousl

I just told you three reasons why this would happen, and I'm sure there are many more. It's obvious that these machines can be making DNS queries simultaneously, why wouldn't they? They are completely independent of each other. And don't forget the number of DNS queries are also magnified when the machines are configured to do DNSSEC verification. > For your very odd use case I'd suggest hosting your own recursive resolver someplace like AWS and pointing to that, but I suspect if you checked your priors you probably can change something about the first 3 conditions. First of all, it's not an odd use case. I think everyone has a laptop and a smartphone, and if they are not following my security practices it's either out of ignorance or out of complacency / not caring, it's not because they are doing what they should be doing. And I'm not even talking about DNSSEC here, just the basic "don't trust random Wi-Fi networks / DNS servers". And second, why can't you imagine a hotel Wi-Fi network with hundreds or thousands of devices, all of them hooked to the same public Wi-Fi network (the hotel-provided one), configured to use a public DNS server and making requests at the same instant? What is so hard to imagine about that? Hell, some public Wi-Fi networks don't even have a local DNS server, they directly send the public Google DNS server IP addresses to all clients as part of their DHCP replies!

willcipriano 3y ago
> they directly send the public Google DNS servers to all clients as part of their DHCP replies! Why is that a problem for your use case? > hundreds or thousands of devices, all of them hooked to the same public Wi-Fi network I expect you to run a dns cache/resolver at that scale and not freeload. You have plenty of customers/employees and must be making enough money.
- someplaceguy 3y ago
  > Why is that a problem for your use case? Because if the Google DNS servers were configured with a low rate limit, the DNS requests of the other clients of the hotel would cause my DNS requests to fail, as they would all appear to be coming from the same IP address from Google's perspective. Fortunately, Google has a high DNS rate limit so this is not usually a problem. But the whole point of this thread is that Cloudflare DNS limits requests to only 10 queries per second, which is way too low for this scenario. > I expect you to run a dns cache/resolver at that scale and not freeload. You have plenty of customers/employees and must be making enough money. Yeah, me too. But as a customer, I also expect DNS servers not to censor results, not to hijack results, to properly resolve DNSSEC queries, to be available over DNS-over-TLS, to resolve queries reliably and to not be down frequently. Unfortunately these expectations are almost always broken and as a user, there's nothing I can do to change that, except to complain to the provider (which almost always does nothing useful, especially when I'm traveling) or to just use Cloudflare DNS or Google DNS myself.
  - willcipriano 3y ago
    I feel like I'm missing something. Aren't these requests for your servers? Why are they getting censored and hijacked? Why not use HSTS, or if impossible sign the response with public-private key pair/encrpyt requests with same on device, if you are in such hostile territory?
    - someplaceguy 3y ago
      > I feel like I'm missing something. Aren't these requests for your servers? Why are they getting censored and hijacked? I didn't mention I was running any servers in this conversation. Perhaps you are confusing me with the great-great...-grandparent? The scenarios I mentioned are all from the perspective of a user. They are getting censored because of laws in the countries I frequently visit and they are hijacked for multiple reasons (Wi-Fi portals and NXDOMAIN hijacking, mostly). Apart from that, I also do have servers (in different countries), but that's besides the point. But note that even these individual personal servers (a couple of which are forced to use a public DNS service due to network issues) hit the Cloudflare DNS rate limit during normal operation. As I mentioned in another thread, I don't do any benchmarking / load testing, web scraping nor anything of the sort, this is just normal operation for servers that are idle most of the time. It's especially noticeable for reverse-IP queries, for some reason (perhaps because these requests are bursty, therefore not cached, and cause several other queries to be performed? I'm not sure). As I mentioned before, even though I use caching resolvers, I have all of my machines configured to do DNSSEC verification, which contributes to the problem.
      - willcipriano 3y ago
        My mistake if I mistook you. > hit the Cloudflare DNS rate limit during normal operation. What I find implausible is that happening to a residential user, or even a apartment building full of them, frequently enough to matter unless some bit of software somewhere is doing something profoundly silly. I believe essentially all mainstream DNS lookup functions retry multiple times with exponential backoff, so its not just ten in a second, its ten in a second over a series of sliding windows that evaporate when they are satisfied for a time. That's a lot of requests.

willcipriano 3y ago

> they directly send the public Google DNS servers to all clients as part of their DHCP replies! Why is that a problem for your use case? > hundreds or thousands of devices, all of them hooked to the same public Wi-Fi network I expect you to run a dns cache/resolver at that scale and not freeload. You have plenty of customers/employees and must be making enough money.

someplaceguy 3y ago
> Why is that a problem for your use case? Because if the Google DNS servers were configured with a low rate limit, the DNS requests of the other clients of the hotel would cause my DNS requests to fail, as they would all appear to be coming from the same IP address from Google's perspective. Fortunately, Google has a high DNS rate limit so this is not usually a problem. But the whole point of this thread is that Cloudflare DNS limits requests to only 10 queries per second, which is way too low for this scenario. > I expect you to run a dns cache/resolver at that scale and not freeload. You have plenty of customers/employees and must be making enough money. Yeah, me too. But as a customer, I also expect DNS servers not to censor results, not to hijack results, to properly resolve DNSSEC queries, to be available over DNS-over-TLS, to resolve queries reliably and to not be down frequently. Unfortunately these expectations are almost always broken and as a user, there's nothing I can do to change that, except to complain to the provider (which almost always does nothing useful, especially when I'm traveling) or to just use Cloudflare DNS or Google DNS myself.
- willcipriano 3y ago
  I feel like I'm missing something. Aren't these requests for your servers? Why are they getting censored and hijacked? Why not use HSTS, or if impossible sign the response with public-private key pair/encrpyt requests with same on device, if you are in such hostile territory?
  - someplaceguy 3y ago
    > I feel like I'm missing something. Aren't these requests for your servers? Why are they getting censored and hijacked? I didn't mention I was running any servers in this conversation. Perhaps you are confusing me with the great-great...-grandparent? The scenarios I mentioned are all from the perspective of a user. They are getting censored because of laws in the countries I frequently visit and they are hijacked for multiple reasons (Wi-Fi portals and NXDOMAIN hijacking, mostly). Apart from that, I also do have servers (in different countries), but that's besides the point. But note that even these individual personal servers (a couple of which are forced to use a public DNS service due to network issues) hit the Cloudflare DNS rate limit during normal operation. As I mentioned in another thread, I don't do any benchmarking / load testing, web scraping nor anything of the sort, this is just normal operation for servers that are idle most of the time. It's especially noticeable for reverse-IP queries, for some reason (perhaps because these requests are bursty, therefore not cached, and cause several other queries to be performed? I'm not sure). As I mentioned before, even though I use caching resolvers, I have all of my machines configured to do DNSSEC verification, which contributes to the problem.
    - willcipriano 3y ago
      My mistake if I mistook you. > hit the Cloudflare DNS rate limit during normal operation. What I find implausible is that happening to a residential user, or even a apartment building full of them, frequently enough to matter unless some bit of software somewhere is doing something profoundly silly. I believe essentially all mainstream DNS lookup functions retry multiple times with exponential backoff, so its not just ten in a second, its ten in a second over a series of sliding windows that evaporate when they are satisfied for a time. That's a lot of requests.