4 ms·

Don't use your ISP's default DNS because they will mess with stuff. You should probably just set your DNS servers on your device because you probably don't want

by pants2 3y ago

Don't use your ISP's default DNS because they will mess with stuff. You should probably just set your DNS servers on your device because you probably don't want to use whatever random DNS you get from public WiFis either. I like to use Quad9 for DNS because it's independent and has some privacy/security features.

reaperman 3y ago
I'd be curious about other DNS services which compete with Quad9. I seem to have an inkling of a memory that there used to be some kind of truly "open" DNS (not OpenDNS I don't think), but I can't recall what their name was or what their paradigm was, precisely.
- Onawa 3y ago
  You might be thinking of NextDNS?
- pants2 3y ago
  Mullvad has a public DNS service that I'd trust.
Avamander 3y ago
It's quite insane that this tampering is allowed in the first place. We'd still be moving towards a more encrypted-by-default future, but there would be fewer meddling middleboxes that threaten less knowledgeable users.
unstatusthequo 3y ago
Also lobotomize their equipment into passthrough and use real equipment. I have that same router on AT&T fiber and just pass-through to Ubiquiti gear. For DNS it's all NextDNS. Or for another step, DNSFilter.
- pants2 3y ago
  This is a great idea. Apparently some people have reverse-engineered the network authentication to allow you to bypass the AT&T modem, but it looks pretty hairy.
vzaliva 3y ago
Unless you watch movies online. I remember switching away from my Comcast/Xfinity DNS and immediately experience significant degradation of Netflix/Amazon video quality. Apparently they use DNS for traffic optimization when video streaming from popular video sites.
- lagniappe 3y ago
  Netflix has hardware on site at ISPs for this to accelerate your streams. https://openconnect.netflix.com/en/ https://openconnect.netflix.com/en/
- js2 3y ago
  This used to be a problem but I haven't experienced it in a few years. I think the streaming providers must be using anycast instead of DNS techniques now?
- lxgr 3y ago
  I really hope that we'll move past DNS load balancing for large media files at some point. It's definitely better than nothing for small/one-off fetches, but VOD streaming sites usually have to fetch a license file from some API server anyway – so why not direct the viewer/client to the best CDN host based on the client IP address instead?
- sharts 3y ago
  Perhaps using something like a split-horizon DNS setup would alleviate that
duped 3y ago
You can't configure DNS at the modem for AT&T fiber, which is the annoying thing. The setting is there, you can read it - but you can't modify it. I have no idea who is responsible for configuring it, either during install or at the factory. So if you don't want AT&T's garbage, you need to configure it on every device and/or at the router (and don't use their built in router).
- aaomidi 3y ago
  Thing is, with DNS, the ISP can just intercept your DNS requests anyway. Turn on DoH imo
  - duped 3y ago
    If you really care, run your own DNS locally. Not all devices/applications support DoH.
    - Dylan16807 3y ago
      Running your own doesn't prevent interception for most domains.
      - aaomidi 3y ago
        For any domains really. Your best bet is something like Dnscrypt or DoH that exposes a resolver locally on your full network.
      - lxgr 3y ago
        You can run a DoH-to-regular-DNS bridging resolver locally. My router supports that out of the box, but unfortunately it's somewhat unreliable compared to regular UDP resolution and I had to turn it back off.
      - duped 3y ago
        It more or less does if your local DNS is just presenting DoH as normal DNS to every device on your LAN, since most devices let you configure DNS per network (even smart TVs, which is nice) but may not have any option for DoH. But at some point you have to trust someone.
ta1243 3y ago
Depends on your ISP. I talk to mine on IRC, they are xkcd806 compatible, they don't do anything to my traffic. They do provide DNS, DOT and DOH servers, or I can use whatever server I want. They're happy to have my host my own DNS server too, as long as it's not configured to allow amplification attacks from random IPs. They actually had a mea-culpa with them a week or so back > Our DoH/DoT resolvers were intermittently failing DNS lookups. It seemed to start over the Easter weekend. Our DoT/DoH front ends are DNS aware proxies (dnsdist) to back ends running unbound. dnsdist uses TLS to speak DNS to the back ends. Some of the back ends had failed to reload their TLS certificates after renewal, so although the certificates were valid unbound was still serving old certs and they eventually expired. This resulted in broken back ends in the pool, which dnsdist kept trying to bring back into service. The intermittent nature of the failures meant that it wasn't obvious to users, as clients generally retry silently in the background. Of course our monitoring should have caught this! We've fixed the underlying problem which caused unbound not to pick up the renewed certificates, and we've improved monitoring to catch similar problems should they occur in future.
- pants2 3y ago
  I assume that's https://en.m.wikipedia.org/wiki/Andrews_%26_Arnold https://en.m.wikipedia.org/wiki/Andrews_%26_Arnold The minute they come to America I'm switching.
bcrl 3y ago
That's not universally true. The ISP I run doesn't futz with DNS, and using our DNS servers is beneficial as it shaves about 10-20ms RTT off many DNS requests since our DNS servers are local with forwarders in the city that most of our transit providers are in.
- bcrl 3y ago
  Getting downvoted for an on-topic relevant comment is pretty disappointing. The fact of the matter is that there are still small internet providers around that care about the privacy of their customers. Furthermore, anyone who thinks they are enhancing their privacy by using one of the large public DNS servers needs to do a reality check: you pay for your use of "free" public DNS servers by sharing the information about every single website that you visit. All an advertiser has to do to de-anonymize your browsing history in that case is to put a single unique domain name in a web page and trigger the browser to do a lookup. Do folks think that AT&T is the only large company that has a really shitty privacy track record when it comes to DNS? I also stand by the claim that local DNS servers are beneficial. Not all of us are 1ms away from the major DNS providers. Transport networks are complicated, and those of us that do not have millions of dollars to build our own fibre directly to a data center where peering is available have to pay a latency price for sub-optimal transport routes. It is a fact that having a local DNS server will save you multiple round trips in such cases when the deployment is architect to do so. I did that because it makes browsing a little bit snappier. Saving a few 20ms RTTs might mean nothing to people living in a large city with a local internet exchange, but it does help those of us in rural remote communities that are distant from that infrastructure.
godelski 3y ago
For anyone that needs this (copy pasted from a comment 2 weeks ago) Your DNS can also do things like block malware, adult content, trackers, social media, or other things. Here's info about cloudflare and mullvad. # Cloudflare ## Standard 1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001 ## Block Malware 1.1.1.2 1.0.0.2 2606:4700:4700::1112 2606:4700:4700::1002 ## Block Malware & Adult Content (not useful for this case) 1.1.1.3 1.0.0.3 2606:4700:4700::1113 2606:4700:4700::1003 You can find cloudflare information here[0], and remember to make sure you setup DNS over DoT (TLS) or DoH (HTTPS). Especially for them they will want to have encrypted DNS. Mullvad also offers free DNS[1], which also supports encrypted DNS # Mullvad ## DoH is port 443 and DoT is port 853 ## Standard dns.mullvad.net 194.242.2.2 2a07:e340::2 ## Block Trackers adblock.dns.mullvad.net 194.242.2.3 2a07:e340::3 ## Block Trackers + Malware base.dns.mullvad.net 194.242.2.4 2a07:e340::4 Mullvad also has block for Adult + gambling and social media (so there are 6 total configurations). You don't need the Mullvad VPN to use these. I should also mention, as this frustrated me a bit, that your browser may implement its own DNS and so just setting these in your router (or pihole) may not completely resolve the issue. In Firefox, go to Settings > Privacy & Security > (scroll all the way down) Enable DNS over HTTPS using > then under either "Increased Protection" or "Max Protection" you can set a DNS resolver (or turn it off). They have defaults for Cloudflare (default!) and NextDNS. While you're there, also check your settings at the top of that page about "Enhanced Tracking Protection" I am NOT a network/security person and would greatly appreciate replies to this comment with additional information. Especially about setting up things like piholes, TVs, browsers, encrypted DNS (especially this!), host files, and so on. [0] - https://developers.cloudflare.com/1.1.1.1/ip-addresses/ https://developers.cloudflare.com/1.1.1.1/ip-addresses/ - https://developers.cloudflare.com/1.1.1.1/setup/#dns-over-ht https://developers.cloudflare.com/1.1.1.1/setup/#dns-over-ht... [1] https://mullvad.net/en/help/dns-over-https-and-dns-over-tls https://mullvad.net/en/help/dns-over-https-and-dns-over-tls
- pants2 3y ago
  It's probably also worth checking your ping to these servers. For me, Cloudflare and Quad9 are around 10ms, while Mullvad is around 40ms, so I take that into consideration when choosing a DNS provider.

by pants2 3y ago

reaperman 3y ago

I'd be curious about other DNS services which compete with Quad9. I seem to have an inkling of a memory that there used to be some kind of truly "open" DNS (not OpenDNS I don't think), but I can't recall what their name was or what their paradigm was, precisely.

Onawa 3y ago
You might be thinking of NextDNS?
pants2 3y ago
Mullvad has a public DNS service that I'd trust.

Avamander 3y ago

It's quite insane that this tampering is allowed in the first place. We'd still be moving towards a more encrypted-by-default future, but there would be fewer meddling middleboxes that threaten less knowledgeable users.

unstatusthequo 3y ago

Also lobotomize their equipment into passthrough and use real equipment. I have that same router on AT&T fiber and just pass-through to Ubiquiti gear. For DNS it's all NextDNS. Or for another step, DNSFilter.

pants2 3y ago
This is a great idea. Apparently some people have reverse-engineered the network authentication to allow you to bypass the AT&T modem, but it looks pretty hairy.

vzaliva 3y ago

Unless you watch movies online. I remember switching away from my Comcast/Xfinity DNS and immediately experience significant degradation of Netflix/Amazon video quality. Apparently they use DNS for traffic optimization when video streaming from popular video sites.

lagniappe 3y ago
Netflix has hardware on site at ISPs for this to accelerate your streams. https://openconnect.netflix.com/en/ https://openconnect.netflix.com/en/
js2 3y ago
This used to be a problem but I haven't experienced it in a few years. I think the streaming providers must be using anycast instead of DNS techniques now?
lxgr 3y ago
I really hope that we'll move past DNS load balancing for large media files at some point. It's definitely better than nothing for small/one-off fetches, but VOD streaming sites usually have to fetch a license file from some API server anyway – so why not direct the viewer/client to the best CDN host based on the client IP address instead?
sharts 3y ago
Perhaps using something like a split-horizon DNS setup would alleviate that

duped 3y ago

You can't configure DNS at the modem for AT&T fiber, which is the annoying thing. The setting is there, you can read it - but you can't modify it. I have no idea who is responsible for configuring it, either during install or at the factory. So if you don't want AT&T's garbage, you need to configure it on every device and/or at the router (and don't use their built in router).

aaomidi 3y ago
Thing is, with DNS, the ISP can just intercept your DNS requests anyway. Turn on DoH imo
- duped 3y ago
  If you really care, run your own DNS locally. Not all devices/applications support DoH.
  - Dylan16807 3y ago
    Running your own doesn't prevent interception for most domains.
    - aaomidi 3y ago
      For any domains really. Your best bet is something like Dnscrypt or DoH that exposes a resolver locally on your full network.
    - lxgr 3y ago
      You can run a DoH-to-regular-DNS bridging resolver locally. My router supports that out of the box, but unfortunately it's somewhat unreliable compared to regular UDP resolution and I had to turn it back off.
    - duped 3y ago
      It more or less does if your local DNS is just presenting DoH as normal DNS to every device on your LAN, since most devices let you configure DNS per network (even smart TVs, which is nice) but may not have any option for DoH. But at some point you have to trust someone.

ta1243 3y ago

Depends on your ISP. I talk to mine on IRC, they are xkcd806 compatible, they don't do anything to my traffic. They do provide DNS, DOT and DOH servers, or I can use whatever server I want. They're happy to have my host my own DNS server too, as long as it's not configured to allow amplification attacks from random IPs. They actually had a mea-culpa with them a week or so back > Our DoH/DoT resolvers were intermittently failing DNS lookups. It seemed to start over the Easter weekend. Our DoT/DoH front ends are DNS aware proxies (dnsdist) to back ends running unbound. dnsdist uses TLS to speak DNS to the back ends. Some of the back ends had failed to reload their TLS certificates after renewal, so although the certificates were valid unbound was still serving old certs and they eventually expired. This resulted in broken back ends in the pool, which dnsdist kept trying to bring back into service. The intermittent nature of the failures meant that it wasn't obvious to users, as clients generally retry silently in the background. Of course our monitoring should have caught this! We've fixed the underlying problem which caused unbound not to pick up the renewed certificates, and we've improved monitoring to catch similar problems should they occur in future.

pants2 3y ago
I assume that's https://en.m.wikipedia.org/wiki/Andrews_%26_Arnold https://en.m.wikipedia.org/wiki/Andrews_%26_Arnold The minute they come to America I'm switching.

bcrl 3y ago

That's not universally true. The ISP I run doesn't futz with DNS, and using our DNS servers is beneficial as it shaves about 10-20ms RTT off many DNS requests since our DNS servers are local with forwarders in the city that most of our transit providers are in.

bcrl 3y ago
Getting downvoted for an on-topic relevant comment is pretty disappointing. The fact of the matter is that there are still small internet providers around that care about the privacy of their customers. Furthermore, anyone who thinks they are enhancing their privacy by using one of the large public DNS servers needs to do a reality check: you pay for your use of "free" public DNS servers by sharing the information about every single website that you visit. All an advertiser has to do to de-anonymize your browsing history in that case is to put a single unique domain name in a web page and trigger the browser to do a lookup. Do folks think that AT&T is the only large company that has a really shitty privacy track record when it comes to DNS? I also stand by the claim that local DNS servers are beneficial. Not all of us are 1ms away from the major DNS providers. Transport networks are complicated, and those of us that do not have millions of dollars to build our own fibre directly to a data center where peering is available have to pay a latency price for sub-optimal transport routes. It is a fact that having a local DNS server will save you multiple round trips in such cases when the deployment is architect to do so. I did that because it makes browsing a little bit snappier. Saving a few 20ms RTTs might mean nothing to people living in a large city with a local internet exchange, but it does help those of us in rural remote communities that are distant from that infrastructure.

godelski 3y ago

For anyone that needs this (copy pasted from a comment 2 weeks ago) Your DNS can also do things like block malware, adult content, trackers, social media, or other things. Here's info about cloudflare and mullvad. # Cloudflare ## Standard 1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001 ## Block Malware 1.1.1.2 1.0.0.2 2606:4700:4700::1112 2606:4700:4700::1002 ## Block Malware & Adult Content (not useful for this case) 1.1.1.3 1.0.0.3 2606:4700:4700::1113 2606:4700:4700::1003 You can find cloudflare information here[0], and remember to make sure you setup DNS over DoT (TLS) or DoH (HTTPS). Especially for them they will want to have encrypted DNS. Mullvad also offers free DNS[1], which also supports encrypted DNS # Mullvad ## DoH is port 443 and DoT is port 853 ## Standard dns.mullvad.net 194.242.2.2 2a07:e340::2 ## Block Trackers adblock.dns.mullvad.net 194.242.2.3 2a07:e340::3 ## Block Trackers + Malware base.dns.mullvad.net 194.242.2.4 2a07:e340::4 Mullvad also has block for Adult + gambling and social media (so there are 6 total configurations). You don't need the Mullvad VPN to use these. I should also mention, as this frustrated me a bit, that your browser may implement its own DNS and so just setting these in your router (or pihole) may not completely resolve the issue. In Firefox, go to Settings > Privacy & Security > (scroll all the way down) Enable DNS over HTTPS using > then under either "Increased Protection" or "Max Protection" you can set a DNS resolver (or turn it off). They have defaults for Cloudflare (default!) and NextDNS. While you're there, also check your settings at the top of that page about "Enhanced Tracking Protection" I am NOT a network/security person and would greatly appreciate replies to this comment with additional information. Especially about setting up things like piholes, TVs, browsers, encrypted DNS (especially this!), host files, and so on. [0] - https://developers.cloudflare.com/1.1.1.1/ip-addresses/ https://developers.cloudflare.com/1.1.1.1/ip-addresses/ - https://developers.cloudflare.com/1.1.1.1/setup/#dns-over-ht https://developers.cloudflare.com/1.1.1.1/setup/#dns-over-ht... [1] https://mullvad.net/en/help/dns-over-https-and-dns-over-tls https://mullvad.net/en/help/dns-over-https-and-dns-over-tls

pants2 3y ago
It's probably also worth checking your ping to these servers. For me, Cloudflare and Quad9 are around 10ms, while Mullvad is around 40ms, so I take that into consideration when choosing a DNS provider.