9 ms·
Ask HN: Which DNS service do you use for your computer's network settings?
And, do you recommend it?
I saw a comment recommending Mullvad's. I currently use the default DNS (my ISP's default).
- jruohonen 3y agoFull recursive DNS, that is, unbound.
- warrenm 3y agoWhat is "default DNS"? I use Quad9 (9.9.9.9) and Freenom (80.80.80.80)
- tikkun 3y agoAdded to OP: default DNS -> my ISP's default DNS.
- LinuxBender 3y agoUnbound DNS on my firewall in one of two modes. 99% of the time Unbound talks directly to the root servers and has multiple caches for records and infrastructure information. Defcon 4 or 5. I also keep several of my own DoT servers on the internet commented out in my configuration if I need to switch to local defense condition level 3. Those DoT servers then talk directly to the root servers and also cache all the things. Becomes redundant at dc1/2 as Tinc VPN's are used. I also have scripts to build Unbound zone overrides to act as /etc/hosts for some domains.
- herghost 3y agoMy PiHole resolves off to Quad9 and Cloudflare. Never had any problems with either - I have both selected in case one has issues so that I don't need to immediately deal with "Daaaad the internet's not working!"
- radicality 3y agoUnbound locally and forwarding to NextDNS for filtering
- someotherperson 3y agoI use a DNS (over HTTPS) that allows me to spoof my geolocation for specific services.
- samcat116 3y agoNextDNS with either their app to set an DoH profile on devices or DHCP giving out their specific IPs for my config.
- xnx 3y agoGoogle: 8.8.8.8 and 8.8.4.4. Fast. Problem free. Would recommend to anyone.
- distcs 3y agoWhy hand over your browsing data to Google?
- mcpherrinm 3y agoI use Google DNS because it’s fast and reliable, and close to me. I’m not sure what else I’d use that’s more trustworthy. Certainly my ISP isn’t. Their DNS privacy policy seems acceptable to me, as they’re not using it for ad data: https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy Google obviously has many concerns, but they’re trustworthy enough to follow their own privacy policy lest they get smited by governments.
- cpach 3y agoYou give data away, true, but I wouldn’t say DNS lookups == browsing data. Example: They can see that I have visited Wikipedia, but not what articles I’ve read. (Other sites will leak more info due to the nature of their subdomains, but it doesn’t bother me personally.)
- red-iron-pine 3y agoyou're not wrong about the articles, but at the same time just looking at a domain is enough to allow for decent guesses to be made. lots of hits on hackernews and jsoneditoronline.org and I can say with a reasonable degree of certainty that you're in IT or Dev. gonna start sending you ads that reflect that. likewise, hits to missile-gayboy.jp -- a site that used to be hosted by my old employers -- also sends some pretty clear messages. I don't need to know what you're looking at specifically there but it's a japanese site that caters to a specific niche; I can sure make some assumptions. hell, at work we don't even collect a lot of specifics on our endpoints -- domain queries are often enough to catch bad behavior
- 3y ago
- ntw1103 3y agoI use https://www.opennic.org https://www.opennic.org
- justusthane 3y agoDevices -> Pi-Hole -> Unbound (running on Pi). My phone is connected to Pi-Hole via Wireguard, so it gets to take advantage of the ad-blocking as well. Yes, I would recommend it. Running Unbound means you don't have to trust anyone's upstream DNS servers. Disadvantage is maybe slightly slower resolution, as you don't get to take advantage of the upstream server's caching.
- liotier 3y agoWhy don't you add an hosts blacklist to Unbound, thus removing the need for the Pi-Hole - which is mostly dnsmasq with same blacklists ? https://wiki.alpinelinux.org/wiki/Using_Unbound_as_an_Ad-blocker https://wiki.alpinelinux.org/wiki/Using_Unbound_as_an_Ad-blo...
- justusthane 3y agoBecause it has a nice UI, shows me what devices are making what DNS requests and which are being blocked, and is easy to add individual exceptions or disable entirely temporarily if something goes wrong.
- crtasm 3y agoThey still need something to run Unbound+Wireguard on, what's the benefit of removing the PiHole software from the setup?
- vladvasiliu 3y agoOne less hop on the DNS resolution chain.
- drcongo 3y agoNextDNS
- iamdbtoo 3y agoI use PowerDNS's dnsdist[1] which forwards to a blocky[2] server which then resolves from a local PowerDNS recursor. dnsdist is there mainly to provide a fallback if the local server is unavailable so I don't lose complete functionality. I would generally recommend using anything other than your ISP's DNS servers. AdGuard has a pretty good list of available providers: https://adguard-dns.io/kb/general/dns-providers/ https://adguard-dns.io/kb/general/dns-providers/ [1] https://dnsdist.org/ https://dnsdist.org/ [2] https://0xerr0r.github.io/blocky/ https://0xerr0r.github.io/blocky/
- JohnFen 3y agoI proxy my ISP's DNS on my main server and all of my other machines use my proxy.
- betaby 3y agoWhat's the point in doing so? Just use ISP's DNS directly.
- darkclouds 3y ago[dead]
- brightball 3y agoBeen really happy with NextDNS for my family.
- radar1310 3y agoYep, I’ve also used NextDNS for several years.
- vhcr 3y agoThe one the my DHCP gives me, that is my ISP's
- justsomehnguy 3y ago127.0.0.1 Really, installing Unbound is piece of cake both on Windows and Linux.
- 0cf8612b2e1e 3y agoMaybe for a network expert. I briefly tried to setup unbound and immediately got blocked by the installation documentation which assumed too much background info. I quit after I managed to break my internet. In the event of a failure, I would struggle to troubleshoot things. Probably asking too much, but I want to ‘apt install unbound-quickstart’ and know sane defaults are configured. If anything goes wrong, I can delete a single config file or uninstall the package to go back to system defaults.
- justsomehnguy 3y ago> Maybe for a network expert I'm literally just did this: dnf install unbound systemctl enable --now unbound nmtui (because I'm lazy) to point DNS to 127.0.0.1 After reboot (again I'm lazy) I got: $ dig news.ycombinator.com ; <<>> DiG 9.16.23-RH <<>> news.ycombinator.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29106 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ;; QUESTION SECTION: ;news.ycombinator.com. IN A ;; ANSWER SECTION: news.ycombinator.com. 1 IN A 209.216.230.240 ;; Query time: 74 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Tue Oct 24 16:07:11 GMT 2023 ;; MSG SIZE rcvd: 65 I think you... just misunderstood something years ago. You don't need 'quickstart' for this On Windows it's the same - download package, install it, configure 127.0.0.1 as primary DNS
- donkeyd 3y agoI use the one from my ISP, unless they're having issues (hardly ever happens). The reason for this, is that in my country, my ISP is tied to strict regulations on (for example) resale of data. Switching to another DNS provider opens me up to all kinds of shenanigans that my ISP would be held responsible for. This is the same reason I don't use a VPN by default at home.
- jedisct1 3y agoI use dnscrypt-proxy in the default configuration and let it choose what's best for my current network.
- newman314 3y agoOne reason why I choose to use dnscrypt-proxy too. @jedisct1, it would be great if there was an option to default to a ODoH/anonymized DNS setup mostly out the box.
- vsviridov 3y agoRunning my own doh-proxy, so I use it for my android phone, and firefox browser.
- brycewray 3y agoIn this order... - Google 8.8.8.8 - Cloudflare 1.1.1.1
- howeyc 3y agoI use unbound, with a bunch of local IP/hostnames, then forward to mullavad dns for adblock.
- governmentdude 3y agoI use level3, since it seems very fast: 4.2.2.2 4.2.2.3
- red-iron-pine 3y agoLumen Technologies
- betaby 3y agoThey are rate-limited for non-customers.
- coreyh14444 3y ago~Once a year, I run DNS Benchmark by Gibson Research https://www.grc.com/dns/benchmark.htm https://www.grc.com/dns/benchmark.htm and do a local performance benchmark and use the results to pick a top 3 which usually ends up to be a mix of my upstream Internet provider, Cloudflare and/or OpenDNS
- whalesalad 3y agoSame, I keep meaning to run under wine again as I don’t have a windows box for this anymore. For a long time I’ve used cloudflare but my ISP (Detroit) had a persistent routing issue to ORD so my dns queries were always failing. On Level3 now as they are the quickest near me.
- PrimeMcFly 3y agoSurprised to see any links to a site run by a charlatan like Gibson here on HN.
- ForkMeOnTinder 3y agoI've used the linked tool (on Windows) and it worked fine. I guess from your comment there's some drama I'm not aware of. Can you elaborate what's wrong with it and what alternative you'd recommend?
- PrimeMcFly 3y agoNot talking about the tool you referenced specifically, but Steve Gibson of GRC is known to be a charlatan, making claims that are easily disproven (he was the guy screaming the world would end when XP included raw sockets) and sometimes selling software based on false claims, like his SpinRite software.
- warrenm 3y agoSounds like you don't know what SpinRite is for/does Or that you haven't ever actually listened to him
- UI_at_80x24 3y agoRun your own. It's not hard. It uses minimal resources. It can be enhanced with ad-block lists similar to pi-hole so your whole network benefits.
- StillBored 3y agoI use unbound on a local machine to server my entire LAN, but there is one giant thing to understand about it. It will massively speed up cached queries in a way you won't get with any internet accessible resolver. BUT, it will slow down everything else simply because its another layer in the lookup cake. Which doesn't sound bad since everything will end up cached, until you notice all the cool people have decided that DNS forms part of their load/failover scheme and have set the TTL to just a few seconds, which effectively either keeps unbound constantly fetching those addresses to keep them fresh, or you pay the unbound overhead penalty all the time on your local machines. And yes, unbound can be configured to ignore TTL's below a certain value, but that has its own problems. So, yes, run your own resolver, just be aware that it has tradeoffs. One of the big pluses is that you can configure it do to DOH/etc and then serve everything on your network unencrypted DNS that has been previously validated/etc.
- vladvasiliu 3y agoIn the case of short TTLs, shouldn't you just pay the penalty for a single lookup, the apex domain with the short TTL? It should remember who the authoritative nameserver for that is, because the intermediate parts should have a more reasonable TTL.
- kup0 3y agoNextDNS (and Quad9 and Cloudflare often as backups). I run NextDNS on my phone as well.
- samvimes 3y agoDevices -> Pi-Hole -> Unbound -> DnsCrypt Some additional details: - Outbound internet access over port 53 is blocked for everything on the network, other than the Pi-Hole/Unbound server - IpTables rule in place to force all outbound traffic over port 53 to go thru the Pi-Hole. This prevents devices from circumventing the Pi-Hole filtering by hard-coding public DNS servers - Cronjob that polls http://public-dns.info/nameservers-all.txt http://public-dns.info/nameservers-all.txt regularly, and updates an IpTables rule to block all outbound internet traffic over any port/protocol to servers in that list. This is my attempt to block things that try to circumvent DNS filtering by doing DNS over HTTPS - Unbound makes it possible to bypass DnsCrypt for specific zones, as needed. It also is configured to prefetch records before expiration, which generally eliminates the latency introduced by DnsCrypt --- This is overkill, but I tried to address privacy concerns as well as ad-blocking with this setup, and it's also been fun to tinker with
- midasuni 3y agoDo you log what attempts to talk on 53 (that you redirect) with hardcoded dns entries?
- samvimes 3y agoYes, the re-writes are done on a ubiquiti edge router. The re-write rules count the number of hits, as well as basic connection details like src port/addess, dst port/address, protocol. The biggest offender is the roku, which tries to use 8.8.8.8 edit: to be honest though, I don't look at the logs often to see what else gets caught, or why
- atmosx 3y agoThe assumption here is that you “control” the router which runs Linux (iptables) and my guess is dnscrypt and inbound. What kind of HW are you using?
- samvimes 3y ago- ubiquiti edge router x from ~2019.. there's a bash script on the box for updating the blocklist, the rest of the configuration can be done in the GUI - pihole and unbound are running in a VM on an old intel NUC with an i5 and 18GB of RAM. The NUC is running Proxmox, and is connected to the edgerouter over ethernet - Separately, there's a ubiquiti WAP and a standalone modem, but there's nothing special about their configuration
- clwg 3y agoI run an overkill system - a dnsdist instance provides clients on my network with DoH and standard port 53 resolution. Dnsdist forwards to a PowerDNS recursor for resolving internet hosts with root hints. Additionally, the recursor uses a custom Lua script with a Redis backend for firewalling against requests, responses, and nameservers encountered during iteration, and then all traffic is logged through protobuf interfaces with automated analysis that tell's me nothing I don't know since I live alone and baseline everything. All outbound port 53 TCP/UDP is also forwarded at the firewall through this setup.
- KaiserPro 3y agoI think the answer might depend on your ISP and where you are based in the world In the EU/aligned countries, selling your data and injecting shit into DNS is very much a frowned on thing. More over, as there is competition, you can migrate away to some other ISP that isn't shit. I currently use my ISP's DNS as an upstream, as they are reliably, fast and not shit. I'm temtped by adding a pi-hole. But I've not fully tested it yet, and I'm reluctant to migrate away from pfsense's DNS, as I have lots of local hosts that need resolving.
- PrimeMcFly 3y agoI use DNSCrypt which alternates between a list of anonymous DNS servers.
- good8675309 3y agoI'm using NextDNS, it's like having a cloud based PiHole with no hassle, more reliable, plus parental controls, network tracking, etc.
- red-iron-pine 3y agoquad9 -- 9.9.9.9
- m-p-3 3y agoNextDNS on the router, and DNS-over-HTTPS for all the devices that supports it so that the configuration applies to them even outside of the home network.
- zzyzxd 3y agodevices -> AdGuard Home -> NextDNS, And devices -> NextDNS as a fallback. I see a lot of mentions for Pi-Hole, which is more or less the same thing as AdGuard Home. I just like AdGuard Home a little bit more: - single binary go app - easy to run in nonroot container (Pi-Hole only started supporting this last year) - Native support for DoH upstream resolver - YAML as configuration language with good versioning scheme and skew practices.
- open-paren 3y agoAll these people that are using pi-hole + unbound should switch to Adguard because it natively supports DNS-over-HTTPS, DNS-over-TLS, and DNS-over-QUIC
- tmottabr 3y agoBoth static addressed devices and DHCP devices point to my internal AdGuard home server. Both my AdGuard server and the unbound in my Opnsense router use Quad9 over DoT AdGuard Home Server also point to Opnsense unbound to resolve local addresses All port 53 traffic not directed at my AdGuard is redirected to it. All port 53 traffic not to or from my adguard or opnsense is blocked. All DoT and DoH traffic not to or from my AdGuard or Opnsense is blocked. I also have a second AdGuard Home instance hosted in a VPS that i use for my mobile devices when outside my home network. I use a whitelist of ClientIDs so only my devices can use this server, weak authentication but it has worked so far. My home network is configured so that my devices will be redirected to my internal AdGuard server when at my home network and so they will use my public AdGuard server automaticaly when they are anywhere else. My firefox, edge and chrome at my laptops have a similar configuration using their own DoT/DoH resolver. For the OS i let it use whatever the DNS from the local network. In the near future i plan on replacing the Quad9 with my own recursive server hosted in the same VPS.
- hackeraccount 3y agoI run Bind at home.
- voisin 3y agoI use PrivateInternetAccess as an always-on VPN and use their DNS servers. I also use AdGuard which is working great (a lot of people here are commenting on Pi-hole which you don't specifically ask about, so thought I'd share this as well). Anyone have issues with PIA's dns?
- solardev 3y agoCloudflare 1.1.1.1 backed up by Google's 8.8.8.8. This way, if I ever forget my browsing history, I can ask either company to remind me ;) Seriously though, they're both fast (especially Cloudflare) and reliable, and won't do DNS injection attacks like local ISPs do. Not really concerned about the privacy angle since I already use Chrome and Google Searched logged in.
- comprev 3y agoNextDNS on all devices and the router (Draytek) too.
- mannyv 3y agoPihole to 1.1.1.1 and 9.9.9.9. I'm in the process of taking control of my network again, after having a more laissez-faire attitude towards network access. I'll probably install something like opensense on top of my edgerouter.
- iggldiggl 3y agoOne problem I've unfortunately run into with alternative DNS providers is that Akamai apparently also uses DNS to steer you to the right part of their CDN, and that the "default" set of servers returned by alternativ DNS providers apparently has abysmal peering with my ISP (not just slightly slower, but positively unusable during peak hours in the evening). In theory EDNS Client Subnet (ECS) is supposed to work around this problem, but a) according to https://www.cdnplanet.com/blog/which-cdns-support-edns-client-subnet/ https://www.cdnplanet.com/blog/which-cdns-support-edns-clien... Akamai only supports this with Google and OpenDNS and b) alternative DNS providers might not support ECS anyway, whether explicitly for privacy reasons or otherwise… Which means I'd basically have to set up a custom DNS resolver in order to special-case queries for anything hosted on Akamai's CDN…
- bewaretheirs 3y agoComing in a bit late, I'm surprised I haven't seen anyone mention that if you run your own recursive dns server you can now have it download a copy of the DNS root zone (following RFC8806) if you are so inclined. See https://localroot.isi.edu/about/ https://localroot.isi.edu/about/ for one site that will let you register to receive a DNS Notify when the root zone changes.