10 ms·
Note that if you use 1.1.1.1, you apparently can't visit archive.is links. I'm not sure why, but around a dozen people on HN have confirmed this. (At least as o
by sillysaurusx 3y ago
Note that if you use 1.1.1.1, you apparently can't visit archive.is links. I'm not sure why, but around a dozen people on HN have confirmed this. (At least as of a couple months ago.)
I think the world could use more alternatives to 8.8.8.8. Hopefully 1.1.1.1 will become more reliable as the years tick by.
(Do you use something besides 8.8.8.8 or 1.1.1.1? If so, post it here! Collecting reliable DNS servers might be a niche hobby, but it's a fun one. I was going to suggest 9.9.9.9 aka Quad9, but apparently it comes with strings attached. https://news.ycombinator.com/item?id=16728214 https://news.ycombinator.com/item?id=16728214)
- frankjr 3y ago> Note that if you use 1.1.1.1, you apparently can't visit archive.is links. I'm not sure why, but around a dozen people on HN have confirmed this. (At least as of a couple months ago.) https://news.ycombinator.com/item?id=19828702 https://news.ycombinator.com/item?id=19828702
- lxgr 3y agoThe operators of archive.* have a peculiar problem with eDNS, or rather Cloudflare’s lack of support thereof. Some details here: https://community.cloudflare.com/t/archive-today-works-again-on-1-1-1-1-and-archive-ph-is-li-vn-fo-md/387566 https://community.cloudflare.com/t/archive-today-works-again...
- 542458 3y agoCloudflare supports EDNS, they just don't support the optional EDNS Client Subnet extension.
- iamdbtoo 3y agoThe reason has been known for a while now. https://news.ycombinator.com/item?id=19828317 https://news.ycombinator.com/item?id=19828317
- depr 3y agoand https://news.ycombinator.com/item?id=36971650 https://news.ycombinator.com/item?id=36971650
- sillysaurusx 3y agoThank you (both)!
- re5i5tor 3y agoSwitched off 1.1.1.1 for that reason a while back. Currently using OpenDNS which is now unfortunately owned by Cisco. Definitely a lack of actually open alternatives.
- johnklos 3y agoQuad9 seems decent. They're certainly not as shitty as Cloudflare or Cisco.
- dano 3y agoRunning your own resolver that points directly to root servers is also an option. https://nlnetlabs.nl/projects/unbound/about/ https://nlnetlabs.nl/projects/unbound/about/ It isn't too complicated to set up and provides faster responses than external DNS servers, especially after the cache gets built up a bit.
- mtsr 3y agoIndeed, this is my preferred solution too. Unfortunately this doesn’t protect one from snooping by network intermediaries, although that’s much less of an issue in the EU due to privacy regulations. At least in principle, but it’s hard to be sure.
- midasuni 3y agoRun your own resolver on a vpc (perhaps in a different country, pay with bitcoin, adjust on your level of concern) and WireGuard to it (perhaps WireGuard over a service like mullvad)
- ComputerGuru 3y agoDNS latency sucks.
- xorcist 3y agoNot too complicated is an understatement. It's literally zero configuration unless you want to do something special.
- cmeacham98 3y agoAs neutrally as possible: Cloudflare doesn't support the DNS Extension that sends part of clients' IPs to the upstream resolver (https://en.m.wikipedia.org/wiki/EDNS_Client_Subnet https://en.m.wikipedia.org/wiki/EDNS_Client_Subnet). Cloudflare believes this is better for privacy. Archive.is doesn't like this (because it prevents DNS-based CDN routing), and thus has a hardcoded exception to intentionally return bogus results to Cloudflare's resolvers.
- tomrod 3y ago> thus has a hardcoded exception to intentionally return bogus results to Cloudflare's resolvers. This is a bad practice.
- giancarlostoro 3y agowhy in the world are they doing that I wonder.
- kljsdflkjsaf 3y ago[flagged]
- 542458 3y agoI think it's also worth noting that Cloudflare's implementation is EDNS compliant. The EDNS extension for sending the client subnet is explicitly optional in the standard.
- eli 3y ago
- lgeorget 3y agoI use OpenDNS. 208.67.222.222 doesn't roll off the tongue (or fingers) as easily as 1.1.1.1 but if you use it frequently enough, you'll remember it.
- shasts 3y agoThere is https://www.dns0.eu https://www.dns0.eu and https://nextdns.io https://nextdns.io. I like the 300K requests per month free tier that nextdns.io has. Comes with plenty of filters.
- sambazi 3y agolike i ever wanted to care about the number of dns-requests originating from my systems.
- bharathyes 3y agoeven beyond that the DNS works fine but the filtering would be turned off.
- sambazi 3y agothank you for this correction to my snarky comment
- ornornor 3y ago300k is a lot to be fair. And if that’s not enough it’s something like 20$ a year. It’s the only way I found to block ads (except in YouTube) on the iPhone.
- peddling-brink 3y agoI’m a big fan of NextDNS, ad filters, logs (or not), block list, allow list, multiple profiles, parental-ish controls. They have binaries to add support for DoH to my router. I literally couldn’t be happier with a DNS provider.
- basch 3y agoMy one gripe is with the block / parental controls interface. Let’s say you want to block Peacock, and there’s a bunch of urls you want to block, each is it’s own individual rule. If you accidentally delete one instead of disable it, it’s gone. If you can remember the url you accidentally deleted, now it’s placed at the top of the list, out of order. There appears to be no log of changes you make. It would be nice to be able to add custom parental controls with sets/bundles of urls. Also you can’t toggle or package ad blocking rules, only delete and add. Sort of the same interface complaint as above. I have to go in and delete four ad blocking packages every time I want to watch Paramount+. Then go find them again when I am done.
- mhitza 3y agoI use https://www.dns0.eu/ https://www.dns0.eu/ but that doesn't have a fancy IP address
- NicoJuicy 3y agoWell. I used archive.is a lot. But Cloudflare has a point by not making a specific adjustment to fix the archive.is issue ( since it's on archive.is their end). So, I don't go to archive.is anymore.
- Jnr 3y agoHow come archive.is works for me? I have set up Cloudflare DoH in my router, I block other popular DoH servers on my network and I also redirect any other DNS queries (UDP 53) to my router's DNS (which in turn uses Cloudflare). And at least in my region (EU) I did not notice any issues with 1.1.1.1.
- yakubin 3y agoMaybe your computer ignores the DNS resolver address suggested by your router? You can check with dig what resolver you’re using, if you’re on a Unix-like system.
- Jnr 3y agoNo, I mean - it uses Cloudflare and it works. I did try with dig. :) Also tried it from other countries in EU, works fine.
- LinuxBender 3y agoDo you use something besides 8.8.8.8 or 1.1.1.1? 99% of the time I just talk directly to the root servers from my home network and pre-cache the most popular places I visit. Unbound also supports DoH but most distributions of Linux do not enable that compile time flag in their Unbound package build and I have long since stopped compiling things as most distributions finally started using the right security options in their builds. I also have DoT running at home which the cell phone figured out on it's own. I keep DoT Unbound DNS running on several VPS providers that also talk directly to the root servers just in case. Useful for cell phones. My ISP is a tiny community ISP and would never filter any results and DNS privacy is just one tiny piece of browsing habits. Until encrypted SNI is fully adopted by all SSL libraries and applications they can still see where I browse unless I am using my own Tinc VPNs or SSH tunneling.
- hk1337 3y agoPihole is preconfigured to use multiple DNS. I use cloudflare and OpenDNS and exclude Google.
- giancarlostoro 3y ago> exclude Google. Their DNS? or all of their services?
- hk1337 3y agoThe DNS in this case but as a general rule, I avoid Google services.
- lxgr 3y ago> I just talk directly to the root servers from my home network and pre-cache the most popular places I visit. Out of curiosity: Why, if you generally trust your ISP? Do you get worse performance using their DNS servers?
- LinuxBender 3y ago
- beowa 3y ago> Do you use something besides 8.8.8.8 or 1.1.1.1? NextDNS
- jacooper 3y agoYou can use quad9 without filters, and i use it because unlike CF it supports EDNS(9.9.9.11)
- RamblingCTO 3y agoDuuuuuude, thank you so much! I was using 9.9.9.9 and it didn't work for me at all. Got stuck in a loop with the captcha for months now. Archive.is is essential for me. Using 9.9.9.11 fixed it for me.
- Unfrozen0688 3y agoControlD From the makers of Windscribe VPN (Canadian) I use the filter that blocks ads and malware 76.76.2.2 76.76.10.2 https://controld.com/free-dns https://controld.com/free-dns https://docs.controld.com/docs https://docs.controld.com/docs
- ChrisArchitect 3y agocoincidentally archive.ph links started working for me today, so not sure this is true anymore
- 1vuio0pswjnm7 3y agoAs a "collector of reliable DNS servers"^1 I can report there are DoH servers that will actually take a traditional DNS query that does not support EDNS0 and, perhaps using the client IP from the TCP connection, return a response that includes EDNS0 Client Subnet (ECS). Whether the DoH provider is sending the ECS to authoritative servers I do not know, but to me it is quite sad to see this being returned in the response given I did not request it. Anyway, ECS is supposedly the reason 1.1.1.1 does not include DNS data for archive.is The site once used a tracking pixel as a poor mans ECS. The client IP address was inserted into the image name. Apparently the operator of the site explained this was used to achieve CDN-like functionality: https://news.ycombinator.com/item?id=27501867 https://news.ycombinator.com/item?id=27501867 1. Perhaps we should be clear that "servers" here means open resolvers. These servers are of course not authoritative for any name, and generally recursion is slower than iteration, i.e., use of authoritative servers only (fee free to challenge me on this and I will share a citation, although I know this is true from own experiments). Thus "reliable" is perhaps ambiguous. Not all of them always return the same results. Some will return different answers, and not always for "load balancing" reasons. Some may be missing data entirely. Some will return wrong answers, e.g., pretending to be authoritative. Much DNS funny business on the internet today. I gather results from a variety of resolvers, from authoritative servers as well as other sources of DNS data, e.g., public zone files, scans and crawls, and I compare notes; I personally would not feel comfortable using one open resolver (third party DNS) as the source for all DNS data; I could not rely on it. As such, "reliable" is IMHO a loaded term if used to describe open resolvers.
- anuraaga 3y agoI was using Cloudflare DNS for a while until learning it was the cause of archive brokenness, switched to Google DNS, and recently have started trying out Adguard DNS just out of curiosity of trying out DNS-over-QUIC (requires a VPN app that supports that). Can't say whether it's better or worse but always fun to try out a new tech.
- fragmede 3y agoCloudflare is in the wrong here. Archive.is had to develop a unique CDN system to protect against illegal content being uploaded and immediately reported, which led to server seizures and downtime. Cloudflare's DNS disrupts this system, putting archive.is at risk. Archive.is even offered to proxy Cloudflare DNS users via their CDN, but Cloudflare rejected the proposal. This leaves archive.is in a vulnerable position, and it's unreasonable to expect them to register their own autonomous system just to fix this issue.