3 ms·

If you're willing to setup your own DNS server (on a Pi or any (low-power) device), you don't need any forwarding DNS service. No Google DNS (8.8.8.8, 8.8.4.4)

If you're willing to setup your own DNS server (on a Pi or any (low-power) device), you don't need any forwarding DNS service. No Google DNS (8.8.8.8, 8.8.4.4) or OpenDNS (1.1.1.1). People sometimes tend to forget how DNS works. If you setup your own DNS server without a forwarder, it just contacts the root servers and resolve domains through the regular DNS process. A reason to use the DNS4EU serivce is if you want additional filtering that you may not be able to / or want to realise with pihole.

elashri 1y ago
1.1.1.1 is cloudflare not opendns. Also you need to use something like unbound as recursive DNS because most of people using pi hole or adguard home they are forwarded DNS and still need upstream. But I agree with you, I run unbound+ Adguard home and don't need anything. I put 9.9.9.9 as fallback however because I don't have replication of the setup yet.
- adrian_b 1y ago
  Indeed, unbound is a very good choice. In the past, for many decades, dnscache was an excellent recursive resolver and cache. Unfortunately, it has become obsolete because nowadays many DNS queries return replies so big that they must be obtained over TCP, so an UDP-only tool is no longer good enough.
bananapub 1y ago
well, the other reason is to avoid exposing your home IP to the DNS servers of the world. using e.g. 8.8.8.8 means Google and your ISP can log your dns queries and tie them to your IP, running your own recursor means every DNS server you touch knows you personally looked them up. it's important to decide your threat model.
- adrian_b 1y ago
  The threat of random DNS servers spread over the world knowing your queries is certainly orders of magnitude less than when using the Google or the ISP name servers. For Google or for the ISP it is trivial to aggregate all your queries in order to have a complete history of your activity. For many DNS servers distributed over the world and belonging to different organizations it is much more difficult to coordinate in order to monitor you. In practice, your ISP is the main threat for monitoring your Internet activity, not by DNS, but by its routers, through which any packet sent or received by you must pass.
jeroenhd 1y ago
In my experience, recursive nameservers tend to be a bit slower than using cloud nameservers. Google and Cloudflare have most domains cached, so their responses are faster, especially for domains with authoritative DNS servers on the other side of the world. Another advantage is that cloud servers can be contacted over ODoH, which encrypts the lookups and protects the privacy of the user (which isn't the case for normal DoH either).
- adrian_b 1y ago
  Your recursive nameserver should also cache any resolved domains, so a small delay could happen only if you try to access for the first time some site that you have never visited in the recent past. In practice, I have used for decades only my own recursive nameservers and I have never perceived any slowness in comparison with computers that were using the ISP or Google or corporate nameservers. More like the opposite, presumably because my own cache always has the content that I access frequently.

elashri 1y ago

1.1.1.1 is cloudflare not opendns. Also you need to use something like unbound as recursive DNS because most of people using pi hole or adguard home they are forwarded DNS and still need upstream. But I agree with you, I run unbound+ Adguard home and don't need anything. I put 9.9.9.9 as fallback however because I don't have replication of the setup yet.

adrian_b 1y ago
Indeed, unbound is a very good choice. In the past, for many decades, dnscache was an excellent recursive resolver and cache. Unfortunately, it has become obsolete because nowadays many DNS queries return replies so big that they must be obtained over TCP, so an UDP-only tool is no longer good enough.

bananapub 1y ago

well, the other reason is to avoid exposing your home IP to the DNS servers of the world. using e.g. 8.8.8.8 means Google and your ISP can log your dns queries and tie them to your IP, running your own recursor means every DNS server you touch knows you personally looked them up. it's important to decide your threat model.

adrian_b 1y ago
The threat of random DNS servers spread over the world knowing your queries is certainly orders of magnitude less than when using the Google or the ISP name servers. For Google or for the ISP it is trivial to aggregate all your queries in order to have a complete history of your activity. For many DNS servers distributed over the world and belonging to different organizations it is much more difficult to coordinate in order to monitor you. In practice, your ISP is the main threat for monitoring your Internet activity, not by DNS, but by its routers, through which any packet sent or received by you must pass.

jeroenhd 1y ago

In my experience, recursive nameservers tend to be a bit slower than using cloud nameservers. Google and Cloudflare have most domains cached, so their responses are faster, especially for domains with authoritative DNS servers on the other side of the world. Another advantage is that cloud servers can be contacted over ODoH, which encrypts the lookups and protects the privacy of the user (which isn't the case for normal DoH either).

adrian_b 1y ago
Your recursive nameserver should also cache any resolved domains, so a small delay could happen only if you try to access for the first time some site that you have never visited in the recent past. In practice, I have used for decades only my own recursive nameservers and I have never perceived any slowness in comparison with computers that were using the ISP or Google or corporate nameservers. More like the opposite, presumably because my own cache always has the content that I access frequently.