6 ms·

Isn’t self-hosting a dns server kind off pointless if you are the only user? Like doesn’t that make you unique to tracking?

Santosh83 3y ago
It can forward queries over TLS or HTTPS to another public DNS server and act as a caching server for all programs on your internal network.
poisonborz 3y ago
You want to reach your self-hosted services within your network easier.
- cookiengineer 3y ago
  How about using the etc hosts file? (Had to remove the slash to pass through cloudflare block)
  - russelg 3y ago
    This is only a viable option for a device running a desktop OS. How am I going to do that on an iPhone, or for my TV?
    - cookiengineer 3y ago
      I get your point, but this is already solved in a much easier manner with an OprnWRT router (and GUI etc) and kind of a strawman's argument using DNS for that. OpenWRT comes out of the box even with social website toggles that require no configuration. Granted, you still have to install OpenWRT, but I still think that running a root DNS isn't necessary for home setups.
      - poisonborz 3y ago
        Where the DNS server lives is a detail. What is a "root DNS"?
        neuromanser 3y ago
        A Root domain, or a name server authoritative for such. I don't think OP meant either.
        cookiengineer 3y ago
        Technitium advertises itself with being able to serve as a root DNS, in both its documentation and on their blog [1]. So I think my argument is still valid, as it's way too over engineered to be a simple, self-hosted, home lab solution for the problem at hand. [1] https://blog.technitium.com/2021/07/running-root-server-locally-on-your-dns.html https://blog.technitium.com/2021/07/running-root-server-loca...
  - skottenborg 3y ago
    You can also add internal DNS records with Pi-Hole if you happen to be self hosting that as well.
  - poisonborz 3y ago
    Only for desktop OS, also do you update each hosts file on every client whenever something changes?
  - ErneX 3y ago
    Not possible on some devices.
  - koolba 3y ago
    > Had to remove the slash to pass through cloudflare block I was going to write: You can’t write a comment with the text / etc / hosts?! But I tried it and got the CloudFlare block page. That’s pretty incredible that a tech focused forum blocks you for simply referencing a common file on all Unix file systems. What state a sad future we live in.
    - zikduruqe 3y ago
      Trust me, I just found this out the other day. https://news.ycombinator.com/item?id=38986187 https://news.ycombinator.com/item?id=38986187
  - rad_gruchalski 3y ago
    > How about using the etc hosts file Works for one computer, doesn’t scale.
- RockRobotRock 3y ago
  is it bad that i use rfc 1918 addresses on cloudflare dns
  - petronio 3y ago
    I find that preferable to trying to get split horizon working reliably enough that data isn't going out to the gateway half the time.
  - gsich 3y ago
    No. DNS is used for that.
n_plus_1_acc 3y ago
Are there any uostream DNS Servers that would allow you to just download the while database and then everything immediately after its TTL runs out? I can image it would be a lot of traffic.
- zokier 3y ago
  That would be zone transfer and its generally not allowed by DNS servers. And there couldn't be a single DNS server to query from, instead you would need to recursively query all the DNS servers which also is not exactly practical. https://en.wikipedia.org/wiki/DNS_zone_transfer https://en.wikipedia.org/wiki/DNS_zone_transfer
- balou23 3y ago
  You can download the root zone: https://www.internic.net/domain/root.zone https://www.internic.net/domain/root.zone
- petee 3y ago
  The resolver Unbound has a handy feature 'prefetch' [1] which refreshes a cached record before it expires. I'm unfamiliar with Technitium though Edit: another option allows for serving expired TTLs, which is permitted by rfc. There is a great explanation on their site [2] [1] https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#unbound-conf-prefetch https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound... [2] https://unbound.docs.nlnetlabs.nl/en/latest/topics/core/serve-stale.html https://unbound.docs.nlnetlabs.nl/en/latest/topics/core/serv...
privacyking 3y ago
No. I use adguardhome to act as a private DNS for my android devices. It's the best way to get both DNS for self hosted services AND DNS filtering to remove tracking and ads in all android apps.
- somat 3y ago
  Until the apps figure out dns over http. sigh
  - gh02t 3y ago
    You can at least partially mitigate this by simply blocking the major DNS-over-https endpoints. There aren't that many. However, in my experience this really pisses off some devices e.g. Google/Nest Home speakers even if you have regular DNS working fine. You also of course won't catch the really nefarious devices phoning home over a custom non-public endpoint. It can be interesting just for logging purposes as well, that's what I do. https://jpgpi250.github.io/piholemanual/doc/Block%20DOH%20with%20pfsense.pdf https://jpgpi250.github.io/piholemanual/doc/Block%20DOH%20wi... really digs into the nitty gritty of how to do it to a crazy extent.
    - kube-system 3y ago
      I imagine that eventually we'll see content and DoH served from the same endpoint. Or ads proxied from the same location as the content.
      - gh02t 3y ago
        Yep, playing whack-a-mole trying to block it is a losing battle long term, but for now it kinda works. Serving content from the same endpoints is indeed the whole point because it makes it hard to block without collateral damage. Probably the only way to really block it is some kind of SSL unwrapping and deep packet inspection at the firewall but that's a HUGE hassle to deal with and is itself a potential privacy issue.
    - Mister_Snuggles 3y ago
ErneX 3y ago
Not at all, I have multiple sites I need to reach locally that each have their own domain on my local network, DNS is the perfect solution for that.
- bluejekyll 3y ago
  Have you registered these domains? I’ve seen a lot of companies use “internal” domains that they don’t register and then are surprised when names they didn’t register end up resolving unintentionally to something external.
shreyasonline 3y ago
Its actually much more beneficial to use a local DNS server even for a single user. A single user will keep querying for DNS requests since OS/apps cache DNS only for a minute or so. Local DNS will keep cache for the full TTL of the record and thus reduce the number of DNS requests that go out of your network. Plus there is Serve Stale feature which improves resiliency. For privacy, depending on your scenario, you can either run recursive resolver or use encrypted DNS protocols to hide DNS from your ISP. There is also support for configuring SOCKS5 or HTTP proxy to route requests via another server or via Tor network.
- tw04 3y ago
  You should consider disclosing your affiliation to the project in your posts on this thread.
  - UI_at_80x24 3y ago
    With their specific post, no I don't think so. They are advocating "general good ideas" vs subtly promoting the product. I run my own DNS, I would have said all the same things they did.
zzyzxd 3y ago
- You can have multiple upstream DNS servers. Don't have to always query one single vendor. - Local caching reduces upstream queries significantly, making it much harder for upstream to profile you. - Encrypt DNS traffic for incompatible devices.
m3047 3y ago
Self-hosting allows you to block trackers at the DNS level. =) Depending on your level of hands-on you can block rentable infrastructure that trackers use and whitelist the apps which coincidentally also rent compute in that space. You can also use resolution telemetry to synthesize PTR records so that reverse DNS works for assets in the the cloud. In order to accomplish those things I rely on Response Policy Zones and Dnstap, features which I don't see listed for this server. Nonetheless it does have filtering capability and decent coverage of features important to the average internet user, based on their listed features. [I give away the RPZ / Dnstap stuff on GitHub, and I use BIND.]

Santosh83 3y ago

It can forward queries over TLS or HTTPS to another public DNS server and act as a caching server for all programs on your internal network.

poisonborz 3y ago

You want to reach your self-hosted services within your network easier.

cookiengineer 3y ago
How about using the etc hosts file? (Had to remove the slash to pass through cloudflare block)
- russelg 3y ago
  This is only a viable option for a device running a desktop OS. How am I going to do that on an iPhone, or for my TV?
  - cookiengineer 3y ago
    I get your point, but this is already solved in a much easier manner with an OprnWRT router (and GUI etc) and kind of a strawman's argument using DNS for that. OpenWRT comes out of the box even with social website toggles that require no configuration. Granted, you still have to install OpenWRT, but I still think that running a root DNS isn't necessary for home setups.
    - poisonborz 3y ago
      Where the DNS server lives is a detail. What is a "root DNS"?
      - neuromanser 3y ago
        A Root domain, or a name server authoritative for such. I don't think OP meant either.
        cookiengineer 3y ago
        Technitium advertises itself with being able to serve as a root DNS, in both its documentation and on their blog [1]. So I think my argument is still valid, as it's way too over engineered to be a simple, self-hosted, home lab solution for the problem at hand. [1] https://blog.technitium.com/2021/07/running-root-server-locally-on-your-dns.html https://blog.technitium.com/2021/07/running-root-server-loca...
- skottenborg 3y ago
  You can also add internal DNS records with Pi-Hole if you happen to be self hosting that as well.
- poisonborz 3y ago
  Only for desktop OS, also do you update each hosts file on every client whenever something changes?
- ErneX 3y ago
  Not possible on some devices.
- koolba 3y ago
  > Had to remove the slash to pass through cloudflare block I was going to write: You can’t write a comment with the text / etc / hosts?! But I tried it and got the CloudFlare block page. That’s pretty incredible that a tech focused forum blocks you for simply referencing a common file on all Unix file systems. What state a sad future we live in.
  - zikduruqe 3y ago
    Trust me, I just found this out the other day. https://news.ycombinator.com/item?id=38986187 https://news.ycombinator.com/item?id=38986187
- rad_gruchalski 3y ago
  > How about using the etc hosts file Works for one computer, doesn’t scale.
RockRobotRock 3y ago
is it bad that i use rfc 1918 addresses on cloudflare dns
- petronio 3y ago
  I find that preferable to trying to get split horizon working reliably enough that data isn't going out to the gateway half the time.
- gsich 3y ago
  No. DNS is used for that.

n_plus_1_acc 3y ago

Are there any uostream DNS Servers that would allow you to just download the while database and then everything immediately after its TTL runs out? I can image it would be a lot of traffic.

zokier 3y ago
That would be zone transfer and its generally not allowed by DNS servers. And there couldn't be a single DNS server to query from, instead you would need to recursively query all the DNS servers which also is not exactly practical. https://en.wikipedia.org/wiki/DNS_zone_transfer https://en.wikipedia.org/wiki/DNS_zone_transfer
balou23 3y ago
You can download the root zone: https://www.internic.net/domain/root.zone https://www.internic.net/domain/root.zone
petee 3y ago
The resolver Unbound has a handy feature 'prefetch' [1] which refreshes a cached record before it expires. I'm unfamiliar with Technitium though Edit: another option allows for serving expired TTLs, which is permitted by rfc. There is a great explanation on their site [2] [1] https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#unbound-conf-prefetch https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound... [2] https://unbound.docs.nlnetlabs.nl/en/latest/topics/core/serve-stale.html https://unbound.docs.nlnetlabs.nl/en/latest/topics/core/serv...

privacyking 3y ago

No. I use adguardhome to act as a private DNS for my android devices. It's the best way to get both DNS for self hosted services AND DNS filtering to remove tracking and ads in all android apps.

somat 3y ago
Until the apps figure out dns over http. sigh
- gh02t 3y ago
  You can at least partially mitigate this by simply blocking the major DNS-over-https endpoints. There aren't that many. However, in my experience this really pisses off some devices e.g. Google/Nest Home speakers even if you have regular DNS working fine. You also of course won't catch the really nefarious devices phoning home over a custom non-public endpoint. It can be interesting just for logging purposes as well, that's what I do. https://jpgpi250.github.io/piholemanual/doc/Block%20DOH%20with%20pfsense.pdf https://jpgpi250.github.io/piholemanual/doc/Block%20DOH%20wi... really digs into the nitty gritty of how to do it to a crazy extent.
  - kube-system 3y ago
    I imagine that eventually we'll see content and DoH served from the same endpoint. Or ads proxied from the same location as the content.
    - gh02t 3y ago
      Yep, playing whack-a-mole trying to block it is a losing battle long term, but for now it kinda works. Serving content from the same endpoints is indeed the whole point because it makes it hard to block without collateral damage. Probably the only way to really block it is some kind of SSL unwrapping and deep packet inspection at the firewall but that's a HUGE hassle to deal with and is itself a potential privacy issue.
  - Mister_Snuggles 3y ago

ErneX 3y ago

Not at all, I have multiple sites I need to reach locally that each have their own domain on my local network, DNS is the perfect solution for that.

bluejekyll 3y ago
Have you registered these domains? I’ve seen a lot of companies use “internal” domains that they don’t register and then are surprised when names they didn’t register end up resolving unintentionally to something external.

shreyasonline 3y ago

Its actually much more beneficial to use a local DNS server even for a single user. A single user will keep querying for DNS requests since OS/apps cache DNS only for a minute or so. Local DNS will keep cache for the full TTL of the record and thus reduce the number of DNS requests that go out of your network. Plus there is Serve Stale feature which improves resiliency. For privacy, depending on your scenario, you can either run recursive resolver or use encrypted DNS protocols to hide DNS from your ISP. There is also support for configuring SOCKS5 or HTTP proxy to route requests via another server or via Tor network.

tw04 3y ago
You should consider disclosing your affiliation to the project in your posts on this thread.
- UI_at_80x24 3y ago
  With their specific post, no I don't think so. They are advocating "general good ideas" vs subtly promoting the product. I run my own DNS, I would have said all the same things they did.

zzyzxd 3y ago

- You can have multiple upstream DNS servers. Don't have to always query one single vendor. - Local caching reduces upstream queries significantly, making it much harder for upstream to profile you. - Encrypt DNS traffic for incompatible devices.

m3047 3y ago

Self-hosting allows you to block trackers at the DNS level. =) Depending on your level of hands-on you can block rentable infrastructure that trackers use and whitelist the apps which coincidentally also rent compute in that space. You can also use resolution telemetry to synthesize PTR records so that reverse DNS works for assets in the the cloud. In order to accomplish those things I rely on Response Policy Zones and Dnstap, features which I don't see listed for this server. Nonetheless it does have filtering capability and decent coverage of features important to the average internet user, based on their listed features. [I give away the RPZ / Dnstap stuff on GitHub, and I use BIND.]