3 ms·
> People who use their ISP’s resolver might be disappointed if their ISP is slow to patch things, but what else is new? Bear in mind that if you're using a reg
by tentacleuno 3y ago
> People who use their ISP’s resolver might be disappointed if their ISP is slow to patch things, but what else is new?
Bear in mind that if you're using a regular port 53 resolver like Google's, you might be using your ISP's resolver anyway -- a lot of ISP's hijack port 53 and redirect it to their own server(s) to reduce load. That's why DNS over TLS / HTTPS is typically recommended over unencrypted DNS.
- ptk 3y agoDo you have examples of ISPs that do this?
- tptacek 3y agoWorth noting that an ISP that does this --- literally intercepting all port 53 traffic, TCP and UDP --- can just strip DNSSEC, too.
- KevinGlass 3y agoIn the US, Comcast does this on all business copper connections. They call it "Secure Edge". It frequently breaks DNS, VPNs, some voip, torrents (or any P2P connections), and probably other stuff. It's enabled by default on all new accounts and will randomly be at the account level. To disable it you have to call them and ask.
- buro9 3y agoIn the UK most ISPs do this, it's their primary mechanism for enforcing any legal blocks against websites.
- deleted 3y ago[deleted]
- cma 3y agoHow much does that reduce load, isn't it fairly miniscule bandwidth compared with non-colocated video streaming etc.?
- KingOfCoders 3y agoI think it's more about control, the reduce load argument is for plausible deniability.