4 ms·

Do you use something besides 8.8.8.8 or 1.1.1.1? 99% of the time I just talk directly to the root servers from my home network and pre-cache the most popular p

Do you use something besides 8.8.8.8 or 1.1.1.1? 99% of the time I just talk directly to the root servers from my home network and pre-cache the most popular places I visit. Unbound also supports DoH but most distributions of Linux do not enable that compile time flag in their Unbound package build and I have long since stopped compiling things as most distributions finally started using the right security options in their builds. I also have DoT running at home which the cell phone figured out on it's own. I keep DoT Unbound DNS running on several VPS providers that also talk directly to the root servers just in case. Useful for cell phones. My ISP is a tiny community ISP and would never filter any results and DNS privacy is just one tiny piece of browsing habits. Until encrypted SNI is fully adopted by all SSL libraries and applications they can still see where I browse unless I am using my own Tinc VPNs or SSH tunneling.

hk1337 3y ago
Pihole is preconfigured to use multiple DNS. I use cloudflare and OpenDNS and exclude Google.
- giancarlostoro 3y ago
  > exclude Google. Their DNS? or all of their services?
  - hk1337 3y ago
    The DNS in this case but as a general rule, I avoid Google services.
lxgr 3y ago
> I just talk directly to the root servers from my home network and pre-cache the most popular places I visit. Out of curiosity: Why, if you generally trust your ISP? Do you get worse performance using their DNS servers?
- LinuxBender 3y ago
  I prefer to use my own server as I can optimize cache hit ratios for the things I request. This makes the internet perceptibly faster for me and others on my network. I can also pull statistics from my server whereas I would have to beg someone at the ISP for that data as a one-off request. This also gives me the option to block domain names used for dark patterns or outright malevolent behavior. I also have control over the upper and lower limits of cache and I can flush to cache if a website is still relying upon DNS failover vs BGP Anycast but I have not run into that for about a decade. Speaking of stats, I can also see what IoT/Cell devices are requesting to keep an eye on their behavior and look for interesting patterns of DNS requests. I have honestly never used the ISP DNS servers so I don't know what their performance is like. It's just muscle memory for me to set up my own home Linux router to be a DNS server. I highly doubt they could top the performance of Unbound and cron-jobs that request commonly used records on an hourly basis. I do know that my performance is better than talking to the DoH/DoT servers on the internet. The cached record response time is in microseconds vs 23ms for CF and non cached response time is generally between 50ms and 70ms vs 80ms to 160ms for CF not-cached. Another nifty option in Unbound is to cache the "Infrastructure" records and to "Keep Probing" multiple nodes. This combines into a nice balance of speed and resilience especially if someones name server is having a moment but their status page is green. unbound-control dump_infra|wc -l 1235 These numbers are thrown off a bit by my cron jobs that are requesting things that I am not visiting all the time and when the authoritative record is sub 3600 seconds. They are requested hourly. Some of the government domains in my cron job seem to be throwing off the curve, I will reach out to them. total.num.cachehits=20949 total.num.cachemiss=8010 total.num.prefetch=753 total.recursion.time.median=0.0698958
  - lxgr 3y ago
    Interesting, thank you! Yeah, local caching is a good point if your operating system(s) doesn't already do it in the DNS client. > This also gives me the option to block domain names used for dark patterns or outright malevolent behavior. I wonder how long this will actually remain possible, given that with DoH it now seems entirely feasible for websites to provide their own application-level DNS resolver?

hk1337 3y ago

Pihole is preconfigured to use multiple DNS. I use cloudflare and OpenDNS and exclude Google.

giancarlostoro 3y ago
> exclude Google. Their DNS? or all of their services?
- hk1337 3y ago
  The DNS in this case but as a general rule, I avoid Google services.

lxgr 3y ago

> I just talk directly to the root servers from my home network and pre-cache the most popular places I visit. Out of curiosity: Why, if you generally trust your ISP? Do you get worse performance using their DNS servers?

LinuxBender 3y ago
I prefer to use my own server as I can optimize cache hit ratios for the things I request. This makes the internet perceptibly faster for me and others on my network. I can also pull statistics from my server whereas I would have to beg someone at the ISP for that data as a one-off request. This also gives me the option to block domain names used for dark patterns or outright malevolent behavior. I also have control over the upper and lower limits of cache and I can flush to cache if a website is still relying upon DNS failover vs BGP Anycast but I have not run into that for about a decade. Speaking of stats, I can also see what IoT/Cell devices are requesting to keep an eye on their behavior and look for interesting patterns of DNS requests. I have honestly never used the ISP DNS servers so I don't know what their performance is like. It's just muscle memory for me to set up my own home Linux router to be a DNS server. I highly doubt they could top the performance of Unbound and cron-jobs that request commonly used records on an hourly basis. I do know that my performance is better than talking to the DoH/DoT servers on the internet. The cached record response time is in microseconds vs 23ms for CF and non cached response time is generally between 50ms and 70ms vs 80ms to 160ms for CF not-cached. Another nifty option in Unbound is to cache the "Infrastructure" records and to "Keep Probing" multiple nodes. This combines into a nice balance of speed and resilience especially if someones name server is having a moment but their status page is green. unbound-control dump_infra|wc -l 1235 These numbers are thrown off a bit by my cron jobs that are requesting things that I am not visiting all the time and when the authoritative record is sub 3600 seconds. They are requested hourly. Some of the government domains in my cron job seem to be throwing off the curve, I will reach out to them. total.num.cachehits=20949 total.num.cachemiss=8010 total.num.prefetch=753 total.recursion.time.median=0.0698958
- lxgr 3y ago
  Interesting, thank you! Yeah, local caching is a good point if your operating system(s) doesn't already do it in the DNS client. > This also gives me the option to block domain names used for dark patterns or outright malevolent behavior. I wonder how long this will actually remain possible, given that with DoH it now seems entirely feasible for websites to provide their own application-level DNS resolver?