5 ms·
DNS4EU for Public Is Available
- teddyh 1y agoThey don’t seem to have reverse DNS set up correctly for the resolvers yet. Nor do the host names have AAAA records pointing to the IPv6 addresses.
- AStonesThrow 1y agoDo you mean for the IPv4 addresses? Because have you ever seen the ip6.arpa ranges? https://en.wikipedia.org/wiki/Reverse_DNS_lookup#IPv6_reverse_resolution https://en.wikipedia.org/wiki/Reverse_DNS_lookup#IPv6_revers... The funny thing is that they’re reusing the IPv4 octets, that look like decimal notation, but in the hexadecimal Interface ID: 2a13:1001::86:54:11:100 So only hilarity can ensue from misunderstanding that; but the reverse DNS may be achievable. Not to mention the unfortunate association with IPv4 in the service name. When will DNS6EU be released? More to the point, “for” is a distinctly English word, so has “4” become an international chatspeak stand-in?
- martin_a 1y ago> Not to mention the unfortunate association with IPv4 in the service name. I read it as "DNS for EU" not as a hint towards IPv4.
- miyuru 1y agomissed opportunity to shorten the IPv6 address.
- teddyh 1y agoNeither the IPv4 addresses nor the IPv6 addresses have reverse lookup set up correctly, as far as I can tell. Both are eminently, and easily, achievable.
- layer8 1y ago"4" as "for" is a decades-old naming convention. Remember log4j?
- xorcist 1y agoYou already know log4j. Now it's time for the sequel: log6j! On select cinemas in 2026. (It's a horror movie, don't bring the kids.)
- deleted 1y ago[deleted]
- throw0101b 1y agoCIRA, who run the .ca ccTLD, has a service available for Canadians: * https://www.cira.ca/en/canadian-shield/ https://www.cira.ca/en/canadian-shield/
- louwrentius 1y agoIf you're willing to setup your own DNS server (on a Pi or any (low-power) device), you don't need any forwarding DNS service. No Google DNS (8.8.8.8, 8.8.4.4) or OpenDNS (1.1.1.1). People sometimes tend to forget how DNS works. If you setup your own DNS server without a forwarder, it just contacts the root servers and resolve domains through the regular DNS process. A reason to use the DNS4EU serivce is if you want additional filtering that you may not be able to / or want to realise with pihole.
- elashri 1y ago1.1.1.1 is cloudflare not opendns. Also you need to use something like unbound as recursive DNS because most of people using pi hole or adguard home they are forwarded DNS and still need upstream. But I agree with you, I run unbound+ Adguard home and don't need anything. I put 9.9.9.9 as fallback however because I don't have replication of the setup yet.
- adrian_b 1y agoIndeed, unbound is a very good choice. In the past, for many decades, dnscache was an excellent recursive resolver and cache. Unfortunately, it has become obsolete because nowadays many DNS queries return replies so big that they must be obtained over TCP, so an UDP-only tool is no longer good enough.
- bananapub 1y agowell, the other reason is to avoid exposing your home IP to the DNS servers of the world. using e.g. 8.8.8.8 means Google and your ISP can log your dns queries and tie them to your IP, running your own recursor means every DNS server you touch knows you personally looked them up. it's important to decide your threat model.
- adrian_b 1y agoThe threat of random DNS servers spread over the world knowing your queries is certainly orders of magnitude less than when using the Google or the ISP name servers. For Google or for the ISP it is trivial to aggregate all your queries in order to have a complete history of your activity. For many DNS servers distributed over the world and belonging to different organizations it is much more difficult to coordinate in order to monitor you. In practice, your ISP is the main threat for monitoring your Internet activity, not by DNS, but by its routers, through which any packet sent or received by you must pass.
- bsenftner 1y agoThe "Download the Threat Intelligence White Paper" 404s.
- HelloUsername 1y ago> The "Download the Threat Intelligence White Paper" 404s. No? https://eu1.hubs.ly/H0kGDRY0 https://eu1.hubs.ly/H0kGDRY0 should resolve to https://app-eu1.hubspotdocuments.com/documents/142290803/view/1228909245?accessId=7037da https://app-eu1.hubspotdocuments.com/documents/142290803/vie...
- falcor84 1y ago> The official EU Public DNS Resolver is basic-level protection that everyone should have. It is important to note, however, that most organisations and individuals likely require enhanced protection. I'm confused - what "enhanced protection" do most individuals require that they aren't providing?
- hannob 1y agoIt's a company selling this "enhanced protection". You need it, because otherwise, they wouldn't make money. The whole thing looks like a PR stunt for an Infosec product. Just that they somehow convinced the EU to fund it.
- sneak 1y agoAny modern public dns needs to support DoH these days, and the setup instructions should be directing users to set it up that way. ISPs can and do sniff and block and rewrite unencrypted dns requests and responses.
- lormayna 1y agoIt does: https://www.joindns4.eu/for-public#resolver-options https://www.joindns4.eu/for-public#resolver-options
- AStonesThrow 1y ago[ad filtering] Accesses are resolved with the IP address 0.0.0.0 I remember the days I was running a Pi-hole at home, and after having no web server running on my desktop machine, I started an Apache web server, and there was a surprise in store for me, as suddenly 0.0.0.0:80 was responding to HTTP GET...!
- olieidel 1y agoSigh. 1. Looks like the cost of this project so far is already ~€1M. Does it really take you a million Euros to set up a DNS server? (Just did a quick research in the EU's financial transparency system [1], I entered "dns4eu" in the subject field. €3m budgeted, €1M used already, most of it going to a company named "Whalebone sro" (?)) 2. Why does every EU-funded software project have such a terrible website? As a visitor, you get the impression that the designers took great care to obfuscate the actual product as much as possible, while throwing in random text blurbs, useless buttons and boxes. Stuff like: > Looking for a fast, secure, and privacy-focused way to browse the internet? You're in the right place. Yeah, sure.. just give me the product? Reading on.. > Learn everything you need to know about DNS4EU Public Service – including where it's located, how to easily set it up on your device, and what configuration options are available to best suit your needs. Yeah, sure.. just give me the product? Compare this with the UI of Cloudflare's 1.1.1.1 [2] which gives visitors exactly what they need. It's awesome. --- It's hard not to be cynical about EU projects, this one included. I've had the questionable pleasure of diving deep into EU software projects and their funding when analyzing and rebuilding [3] the EU medical device database [4], a simple database with ~500k entries (~10GB on disk), which has burned €45M (!) so far and employs a team of ~50 people. Link to website with budget tracker [5]. [1] https://ec.europa.eu/budget/financial-transparency-system/analysis.html https://ec.europa.eu/budget/financial-transparency-system/an... [2] https://one.one.one.one https://one.one.one.one [3] https://openregulatory.com/articles/beudamed-better-eudamed https://openregulatory.com/articles/beudamed-better-eudamed [4] https://ec.europa.eu/tools/eudamed/#/screen/home https://ec.europa.eu/tools/eudamed/#/screen/home [5] https://eudamedburn.com https://eudamedburn.com
- Tijdreiziger 1y agoFrom the page: > The DNS4EU Public Service is operated by the Czech cybersecurity company Whalebone.
- bilekas 1y agoGiven the OP just complained about reading 3 lines it's safe to assume they didn't get that far.
- tigrezno 1y agoOnly problem I see is that it's a difficult to remember IP address. I know cloudfare or google dns because they are extremelly simple.
- mousetree 1y agoWhy would you need to remember it once you’ve set it up?
- 6r17 1y agoso you don't have to look it up every time you need to change the DNS configuration.
- kalleboo 1y agoThe techy people who are the ones who are the target for something like this aren't just setting up their home internet once, they're setting up the internet for their friends and family when they visit, getting roped in to fix the internet for their in-laws when it breaks, etc.
- AStonesThrow 1y agoBecause, 18 months from now, you or your executrix wakes up with a hangover, and your Internet connection is down, and you or your executrix begin troubleshooting, and poking through the DNS configuration, your executrix scratches her head and exclaims “who in the world is 2a13:1001::86:54:11:100 and why did we ever add this in here?!” And then you or your executrix reset it to 8.8.8.8 because that is distinctly memorable and unmistakable.
- dist-epoch 1y agoAlso terrible domain name, hard to remember. The DuckDuckGo mistake basically.
- sph 1y agoYes, it is good to have a state-sponsored and controlled DNS service, because the state is my friend and has my best interests at heart. If you're a criminal, a person with something to hide, or a loathsome anarchist you should go away and use unofficial and unapproved software like a local instance of unbound or https://www.dnscrypt.org/ https://www.dnscrypt.org/
- ahofmann 1y agoI've lost count how often I wrote 8.8.8.8 and 1.1.1.1 somewhere. Cloudflare and Google (and Quad9) understood that you need to remove friction to get more users. I hardly remember 1.1.0.0 (or is it 1.1.1.0 ?), so I've never entered that somewhere. *Don't make me think* According to that rule, DNS4EU is dead in the water. It took me at least 5 clicks to see their fucking IP. And there are multiple, to choose from, oh dear lord, help me! The only thing I want to know is: which IP do I need to enter, so that I can try out their service. Everyone else understood this. Look at Cloudflare: https://www.cloudflare.com/de-de/learning/dns/what-is-1.1.1.1/ https://www.cloudflare.com/de-de/learning/dns/what-is-1.1.1.... the IP is RIGHT IN THE URL! I don't even need to visit their website. But OK, I get it, I'll read their stuff. So the IP could be 84.56.11.11 I think. Could be wrong. I'm pretty sure, it is wrong, because my brain didn't bother to hold that information for 30 seconds. I have multiple working DNS IPs in my brain, the new one needs good reason to get storage space in my small, stupid brain. I know, this is an extreme take to that matter. But when you build a product, you need to understand, that 99.9% of your potential users are apes, that are bored, stressed and angry at the same time. They don't care at all about all the stuff you care about. Give them, what they need to progress. After that, they will maybe care a little bit about your product.
- beng-nl 1y agoMildly unreasonable and I couldn’t agree more, This is like reading my inner monologue
- mvdwoord 1y agoAmen brother.
- em-bee 1y agoi don't know what you tried, but i found it by scrolling down and then a single click. then i went back and found that two clicks without scrolling would have done it. you are right about the problem of hard to remember IP addresses, but i don't think it is that bad. They don't care at all about all the stuff you care about. i don't understand this argument. users who don't care would not even bother to change the DNS. and those that do will change their settings once and be done with it. a memorable IP mainly benefits those that set up devices frequently.
- grigio 1y agotoo much words and no IPs -_-
- curtisblaine 1y agoWhy can't I have "adblock" without "protective"? I want torrents and anna's archive but I don't want advertising!
- pimterry 1y agoThere's nothing here suggesting that 'protective' will block torrent sites or similar - AFAICT it's exclusively for recognized malicious/phishing/etc sites, like Google's safe browsing list. It specifically says below "We do not apply any type of legal filtering".
- deleted 1y ago[deleted]
- mid-kid 1y agoHow does this compare to https://www.dns0.eu/ https://www.dns0.eu/ which I've been using for years?
- ptman 1y agodns4eu has some public eu money backing it, while dns0.eu has nextdns money backing it
- nalekberov 1y agoI am not sure how is moving trust from one centralized service to another will make an individual "protected". That said current initiatives from EU are based on "Look other are evil, we are not" narrative. Checking the website first thing I notice there are trackers embedded in the website already: 1. Google Tag Manager 2. Hubspot Seems legit.
- aaron695 1y ago[dead]
- xorcist 1y ago$ sudo apt-get install unbound (Seriously though, this service is the middle ground no one asked for. The technically literate runs their own resolver, like the example above, or has chosen one they trust. The technically illiterate doesn't know they want this and will never find this service.)
- NoGravitas 1y agoEh, I think there's a reasonable middle ground, especially on mobile devices. It's an easy, one-time thing to set your "secure DNS" on Android, and I'm sure small but non-trivial number of people using CloudFlare or Quad9 or something for DoH.
- downsplat 1y agoMy question is, will they block sites when some e.g Greek or Spanish authority tells them too? One thing I appreciate about Cloudflare or Google's dns-over-https servers, on top of the encryption, is that they don't block sites like Anna's Archive, whereas my local ISP sometimes does.
- sceptic123 1y ago> Legal Filtering > We do not apply any type of legal filtering.
- amai 1y agoI configured my pihole to use Quad9 (filtered, DNSSEC) as upstream DNS Server and it works like a charm. https://quad9.net/news/blog/dns4eu-quad9 https://quad9.net/news/blog/dns4eu-quad9
- FCollini 1y agoIn just one phrase: Whalebone, the main contractor, is neither listed in the world's top fastest and reliable secure DNS server in the world: https://www.dnsperf.com/#!dns-resolvers https://www.dnsperf.com/#!dns-resolvers I said everything... :)
- FCollini 1y agoWow, I believe they are re-writing the "new" DNS RFC standards: https://www.joindns4.eu/for-public#resolver-options https://www.joindns4.eu/for-public#resolver-options Only one DNS server is necessary, the second is optional. Let's go for the spending review eheh :)
- teddyh 1y agoThese are resolvers, not authoritative DNS servers.