5 ms·

This article misses one of the main reasons for people to use OpenDNS/Google DNS, which is to prevent ISP hijacking of domain names or redirection of unresolved

This article misses one of the main reasons for people to use OpenDNS/Google DNS, which is to prevent ISP hijacking of domain names or redirection of unresolved domains. I personally use it because I am extremely uncomfortable with my ISP catching mistyped URLs and redirecting me to a page filled with ads, searches, and other bogus things.

sandstrom 14y ago
This is also the revenue model of OpenDNS (although I agree that they are less aggressive than some ISPs).
- mrcharles 14y ago
  Ah, my bad. I actually use Google DNS because they don't hijack anything, which was my prime reason. I'd assumed Open DNS was similar. That being said, I can still get behind at least choosing to let someone hijack those pages, rather than sticking with a company that does it automatically.
  - sp332 14y ago
    At least you have the option of throwing a few bucks at OpenDNS and they'll stop filtering, or even add custom redirects/shortcuts for you.
    - gioele 14y ago
      So you have to pay to get what installing unbound (Win, OSX, Linux) on your machine will give you for free?
      - sp332 14y ago
        Not sure what you mean by unbound, but your Windows box does not have a DNS server installed by default. Most people depend on the DNS server that their ISP runs. If the ISP is doing unwanted redirects or filtering, or is just unreliable, you can point your DNS to OpenDNS which is fast and reliable. You can either use it for free and it will show you ads when you typo, or you can pay them some money for their service. (edit: expanded)
        mcpherrinm 14y ago
        Unbound is a recursive & caching DNS server. You can use it to query DNS "directly", avoiding your ISP's DNS server. At some point in time I'd have said this would increase your DNS latency, but given the poor level of service that many ISP servers provide, I don't think that's true anymore. Though I have no data to back this up, I suspect many home users visit a fairly small set of websites and so DNS caching would work very well.
        sp332 14y ago
        Oh I see now. OK so yes, you can either admin your own DNS server, or get an ad-supported version, or pay someone a small amount of money to do it for you. I think that about covers the options :)
      - SoftwareMaven 14y ago
        You get more than just "no ads". It also provides domain filtering, which is a nice feature with kids and a million internet connected devices.
    - sgift 14y ago
      You don't have to pay them to stop filtering - just make an account and disable the setting (my information is a few month old, I've since changed to Google DNS - it is faster for me).
      - sp332 14y ago
        Good to know, thanks.
nyellin 14y ago
What country do you live in? I have never seen an Israeli ISP do that. (Although, there were reports a few years ago that Bezeq intercepted .torrent files to add their own trackers to the file.)
- polyfractal 14y ago
  I live in the US and have had Comcast do this to me before. I routinely use GoogleDNS because of that. Also because Comcast DNS sucks horribly and times out with upsetting regularity.
  - ohashi 14y ago
    That is my experience with comcast dns too. Although, I have had some issues with google dns too on a rare occasion where I had to change back to something else (comcast or opendns) for a short while until google dns worked again. They never hijacked anything, but it just stopped working for a brief period.
  - mikeash 14y ago
    Note that you can opt out of Comcast's DNS hijacking, although the fact that it's on by default is still pretty bad. There is, as far as I know, no switch to make their DNS more reliable, though.
    - staplesowns 14y ago
      If you're using Comcast Business, I've yet to find a way to do this. Comcast Support (email, phone, live chat) also have no idea. If anyone knows how to do it, please let me know.
      - mikeash 14y ago
        That's crazy. You'd think the business version would have more customization available, not less. I take it you've logged into your comcast.net account and the box to disable it isn't there for you?
amalcon 14y ago
Verizon allows you to opt out of this, which incidentally I have done. These instructions are for FiOS, but I am proof that they work for DSL as well. (I still gripe that they don't tell people about this...) http://domnit.org/verizon/ http://domnit.org/verizon/
astrodust 14y ago
Those ISPs will soon jack all your DNS traffic. A lot of them already hijack port 80 and inject random junk in there which is why HTTPs is the way forward.
- MiguelHudnandez 14y ago
  > "A lot of them already hijack port 80 and inject random junk in there..." That's a pretty bold claim. Other than free wifi at hotels, I've never seen an ISP use transparent proxying to intercept pages and serve ads. Do you have any examples?
  - astrodust 14y ago
    My provider at home, Rogers Cable (Toronto), will inject things in the pages you see when you're approaching your bandwidth cap. It's extremely irritating and somewhat worrying. Basically they mangle the HTML and slap in their own banner which means they must be doing some kind of stream inspection and processing to manage this. I do not have a proxy configured, and requests don't indicate that this is being done.
    - voltagex_ 14y ago
      I would be VERY interested to see a packet capture of the same page when you're under and near your cap.
danielweber 14y ago
In dealing with clients, I have found that DNS routinely sucks from nearly all ISPs. It seems the most important thing they put the least amount of resources into.
nl 14y ago
OpenDNS does redirection of unresolved domains itself. I don't see that as any better or worse than your ISP doing it. (Google - of course - does the technically correct thing)

sandstrom 14y ago

This is also the revenue model of OpenDNS (although I agree that they are less aggressive than some ISPs).

mrcharles 14y ago
Ah, my bad. I actually use Google DNS because they don't hijack anything, which was my prime reason. I'd assumed Open DNS was similar. That being said, I can still get behind at least choosing to let someone hijack those pages, rather than sticking with a company that does it automatically.
- sp332 14y ago
  At least you have the option of throwing a few bucks at OpenDNS and they'll stop filtering, or even add custom redirects/shortcuts for you.
  - gioele 14y ago
    So you have to pay to get what installing unbound (Win, OSX, Linux) on your machine will give you for free?
    - sp332 14y ago
      Not sure what you mean by unbound, but your Windows box does not have a DNS server installed by default. Most people depend on the DNS server that their ISP runs. If the ISP is doing unwanted redirects or filtering, or is just unreliable, you can point your DNS to OpenDNS which is fast and reliable. You can either use it for free and it will show you ads when you typo, or you can pay them some money for their service. (edit: expanded)
      - mcpherrinm 14y ago
        Unbound is a recursive & caching DNS server. You can use it to query DNS "directly", avoiding your ISP's DNS server. At some point in time I'd have said this would increase your DNS latency, but given the poor level of service that many ISP servers provide, I don't think that's true anymore. Though I have no data to back this up, I suspect many home users visit a fairly small set of websites and so DNS caching would work very well.
        sp332 14y ago
        Oh I see now. OK so yes, you can either admin your own DNS server, or get an ad-supported version, or pay someone a small amount of money to do it for you. I think that about covers the options :)
    - SoftwareMaven 14y ago
      You get more than just "no ads". It also provides domain filtering, which is a nice feature with kids and a million internet connected devices.
  - sgift 14y ago
    You don't have to pay them to stop filtering - just make an account and disable the setting (my information is a few month old, I've since changed to Google DNS - it is faster for me).
    - sp332 14y ago
      Good to know, thanks.

nyellin 14y ago

What country do you live in? I have never seen an Israeli ISP do that. (Although, there were reports a few years ago that Bezeq intercepted .torrent files to add their own trackers to the file.)

polyfractal 14y ago
I live in the US and have had Comcast do this to me before. I routinely use GoogleDNS because of that. Also because Comcast DNS sucks horribly and times out with upsetting regularity.
- ohashi 14y ago
  That is my experience with comcast dns too. Although, I have had some issues with google dns too on a rare occasion where I had to change back to something else (comcast or opendns) for a short while until google dns worked again. They never hijacked anything, but it just stopped working for a brief period.
- mikeash 14y ago
  Note that you can opt out of Comcast's DNS hijacking, although the fact that it's on by default is still pretty bad. There is, as far as I know, no switch to make their DNS more reliable, though.
  - staplesowns 14y ago
    If you're using Comcast Business, I've yet to find a way to do this. Comcast Support (email, phone, live chat) also have no idea. If anyone knows how to do it, please let me know.
    - mikeash 14y ago
      That's crazy. You'd think the business version would have more customization available, not less. I take it you've logged into your comcast.net account and the box to disable it isn't there for you?

amalcon 14y ago

Verizon allows you to opt out of this, which incidentally I have done. These instructions are for FiOS, but I am proof that they work for DSL as well. (I still gripe that they don't tell people about this...) http://domnit.org/verizon/ http://domnit.org/verizon/

astrodust 14y ago

Those ISPs will soon jack all your DNS traffic. A lot of them already hijack port 80 and inject random junk in there which is why HTTPs is the way forward.

MiguelHudnandez 14y ago
> "A lot of them already hijack port 80 and inject random junk in there..." That's a pretty bold claim. Other than free wifi at hotels, I've never seen an ISP use transparent proxying to intercept pages and serve ads. Do you have any examples?
- astrodust 14y ago
  My provider at home, Rogers Cable (Toronto), will inject things in the pages you see when you're approaching your bandwidth cap. It's extremely irritating and somewhat worrying. Basically they mangle the HTML and slap in their own banner which means they must be doing some kind of stream inspection and processing to manage this. I do not have a proxy configured, and requests don't indicate that this is being done.
  - voltagex_ 14y ago
    I would be VERY interested to see a packet capture of the same page when you're under and near your cap.

danielweber 14y ago

In dealing with clients, I have found that DNS routinely sucks from nearly all ISPs. It seems the most important thing they put the least amount of resources into.

nl 14y ago

OpenDNS does redirection of unresolved domains itself. I don't see that as any better or worse than your ISP doing it. (Google - of course - does the technically correct thing)