4 ms·

Quad9 – A public and free DNS service for a better security and privacy

63 points by janandonly 2y ago

bustling-noose 2y ago
The quality of dns always makes or breaks your internet experience. Personally at home unbound on opnsense with some blocking list has always worked really well for me. Openwrt with pihole also works fine. But the moment I have to use some recursive dns like this, I tend to not enjoy the experience.
- eudhxhdhsb32 2y ago
  Are you just referring to ads not being blocked? A regular dns like quad9 + ublock origin on Firefox has been a consistently great experience for me.
  - bayindirh 2y ago
    Probably the responsiveness of things. Firefox is very sensitive to DNS roundtrip time during daily use. A faster response time provides much better experience with it. I guess that ~25% of "Firefox is slow" myth is coming from slow DNS response, if not higher.
    - eudhxhdhsb32 2y ago
      That makes sense. Do you know the reason for Firefox being more sensitive? Is their DNS prefetching not as effective?
      - bayindirh 2y ago
        I honestly have no idea. I observe it all the time, and note repeatedly everywhere when the discussion comes up, but never had the time to dig into the code and see how that all works.
- udev4096 2y ago
  It really depends. Cloudflare, quad9 or whatever upstream DNS probably has huge cache which makes resolving the queries quite fast. Although, local caching, like with unbound, is still going to be a lot better than any upstream resolver
- SparkyMcUnicorn 2y ago
  opnsense + ctrld[0] + unbound works great and automatically upgrades upstream requests to DoH (etc.) Was using NextDNS for a while, but stability and performance was a common issue. I like the idea of something like pihole, but ControlD is good, works anywhere, and is easy to manage. [0] https://github.com/Control-D-Inc/ctrld/wiki/pfSense-and-OPNsense-Operations-Guide https://github.com/Control-D-Inc/ctrld/wiki/pfSense-and-OPNs...
- buyucu 2y ago
  does PiHole cache dns queries and deliver them faster?
  - woleium 2y ago
    yes it caches, but it may not deliver them faster, depending on how good your previous dns service was and how good your hardware is.
    - buyucu 2y ago
      just checked my pihole logs and almost all entries are answered by local cache. this is great.
tomzin0 2y ago
Thanks but no thanks. https://www.quad9.net/news/press/quad9-faces-new-dns-censorship-legal-challenge-in-france-from-canal/ https://www.quad9.net/news/press/quad9-faces-new-dns-censors...
- fuzzy2 2y ago
  So then what do you use or recommend instead?
  - udev4096 2y ago
    Mullvad [1], dns.watch, dnscrypt [2] 1 - https://mullvad.net/en/help/dns-over-https-and-dns-over-tls https://mullvad.net/en/help/dns-over-https-and-dns-over-tls 2 - https://dnscrypt.info/public-servers/ https://dnscrypt.info/public-servers/
  - accrual 2y ago
    I use a combination of 1.1.1.1, 9.9.9.11, and OpenDNS over DNSSEC via Pihole. Not sure if it's a "good" strategy, though.
    - ratorx 2y ago
      I think the France legislation is aimed at most major resolvers. You might get away with more niche ones for now, but the only stable way is to self-host a recursive resolver (like unbound) that walk the DNS tree themselves.
  - prmoustache 2y ago
    Host your own dns resolver. It isn't hard.
    - udev4096 2y ago
      Hosting is never hard. It's about maintainability. How do you handle HA? How will you expose the service? What about backups? How efficiently are you running it? That's just the tip of the iceberg. For an average joe, this is not something they wanna deal with
1in1010 2y ago
I've been trying nextdns.io out on my home router. So far its been pretty good. Just about two weeks in now.
- drcongo 2y ago
  I've been using NextDNS without issue for several years now, I love it.
deleted 2y ago
[deleted]
cess11 2y ago
How censored are Quad9? I find it annoying when DNS providers try to cut me off from foreign news services so if I were to switch I'd like to know that they won't.
- janandonly 2y ago
  There is some references to known threads. But nonspecific list on their website that I can find.
dengolius 2y ago
I have been using 9.9.9.9.9 for more than 5 years and this DNS has never failed me unlike Cloudflare.
- gibibit 2y ago
  Oh yeah, the forgotton IPv5!!
- polski-g 2y ago
  Almost a decade of Cloudflare DNS not working with archive.is They have the technical explanation but nobody cares. Your product doesn't work. It would be like a browser getting released that doesn't render anything except properly formatted xhtml -- your product must function at least as good as others on the market, even if it means making workarounds.

63 points by janandonly 2y ago

The quality of dns always makes or breaks your internet experience. Personally at home unbound on opnsense with some blocking list has always worked really well for me. Openwrt with pihole also works fine. But the moment I have to use some recursive dns like this, I tend to not enjoy the experience.

eudhxhdhsb32 2y ago
Are you just referring to ads not being blocked? A regular dns like quad9 + ublock origin on Firefox has been a consistently great experience for me.
- bayindirh 2y ago
  Probably the responsiveness of things. Firefox is very sensitive to DNS roundtrip time during daily use. A faster response time provides much better experience with it. I guess that ~25% of "Firefox is slow" myth is coming from slow DNS response, if not higher.
  - eudhxhdhsb32 2y ago
    That makes sense. Do you know the reason for Firefox being more sensitive? Is their DNS prefetching not as effective?
    - bayindirh 2y ago
      I honestly have no idea. I observe it all the time, and note repeatedly everywhere when the discussion comes up, but never had the time to dig into the code and see how that all works.
udev4096 2y ago
It really depends. Cloudflare, quad9 or whatever upstream DNS probably has huge cache which makes resolving the queries quite fast. Although, local caching, like with unbound, is still going to be a lot better than any upstream resolver
SparkyMcUnicorn 2y ago
opnsense + ctrld[0] + unbound works great and automatically upgrades upstream requests to DoH (etc.) Was using NextDNS for a while, but stability and performance was a common issue. I like the idea of something like pihole, but ControlD is good, works anywhere, and is easy to manage. [0] https://github.com/Control-D-Inc/ctrld/wiki/pfSense-and-OPNsense-Operations-Guide https://github.com/Control-D-Inc/ctrld/wiki/pfSense-and-OPNs...
buyucu 2y ago
does PiHole cache dns queries and deliver them faster?
- woleium 2y ago
  yes it caches, but it may not deliver them faster, depending on how good your previous dns service was and how good your hardware is.
  - buyucu 2y ago
    just checked my pihole logs and almost all entries are answered by local cache. this is great.

tomzin0 2y ago

Thanks but no thanks. https://www.quad9.net/news/press/quad9-faces-new-dns-censorship-legal-challenge-in-france-from-canal/ https://www.quad9.net/news/press/quad9-faces-new-dns-censors...

fuzzy2 2y ago
So then what do you use or recommend instead?
- udev4096 2y ago
  Mullvad [1], dns.watch, dnscrypt [2] 1 - https://mullvad.net/en/help/dns-over-https-and-dns-over-tls https://mullvad.net/en/help/dns-over-https-and-dns-over-tls 2 - https://dnscrypt.info/public-servers/ https://dnscrypt.info/public-servers/
- accrual 2y ago
  I use a combination of 1.1.1.1, 9.9.9.11, and OpenDNS over DNSSEC via Pihole. Not sure if it's a "good" strategy, though.
  - ratorx 2y ago
    I think the France legislation is aimed at most major resolvers. You might get away with more niche ones for now, but the only stable way is to self-host a recursive resolver (like unbound) that walk the DNS tree themselves.
- prmoustache 2y ago
  Host your own dns resolver. It isn't hard.
  - udev4096 2y ago
    Hosting is never hard. It's about maintainability. How do you handle HA? How will you expose the service? What about backups? How efficiently are you running it? That's just the tip of the iceberg. For an average joe, this is not something they wanna deal with

1in1010 2y ago

I've been trying nextdns.io out on my home router. So far its been pretty good. Just about two weeks in now.

drcongo 2y ago
I've been using NextDNS without issue for several years now, I love it.

deleted 2y ago

[deleted]

cess11 2y ago

How censored are Quad9? I find it annoying when DNS providers try to cut me off from foreign news services so if I were to switch I'd like to know that they won't.

janandonly 2y ago
There is some references to known threads. But nonspecific list on their website that I can find.

dengolius 2y ago

I have been using 9.9.9.9.9 for more than 5 years and this DNS has never failed me unlike Cloudflare.

gibibit 2y ago
Oh yeah, the forgotton IPv5!!
polski-g 2y ago
Almost a decade of Cloudflare DNS not working with archive.is They have the technical explanation but nobody cares. Your product doesn't work. It would be like a browser getting released that doesn't render anything except properly formatted xhtml -- your product must function at least as good as others on the market, even if it means making workarounds.