7 ms·
How much EU is in DNS4EU?
- johncoltrane 1y agoGreat write-up. Note that the UK is no longer part of the EU so even those .uk domains are a bit of a red flag.
- Mashimo 1y agoThat's part of the writeup. > Last time I checked GB was not part of the EU. And it’s also a member of FIVE eyes.
- jeroenhd 1y ago> And it’s also a member of FIVE eyes. I don't think they need to worry about the FIVE eyes when the "FIVE eyes plus 3", "Nine Eyes", and "Fourteen Eyes" contain several EU countries. The larger groups aren't working together as intensively but it's not like cutting off the UK is going to stop the US from the (industrial) espionage they do in the EU.
- johncoltrane 1y agoI know. It comes up a bit later than the .uk domains, though.
- Eduard 1y ago$ dig ns joindns4.eu +short ns63.cloudns.net. ns64.cloudns.uk. ns61.cloudns.net. Additionally, the authoritative DNS servers include domain names with .net, which is under US-American control.
- mitjam 1y agoCloudNS is a DNS provider in Bulgaria, offering good and cheap DNS as a service . Still, the project at the moment is just arbitraging and don’t provide own infra,
- fside 1y agoI’m with the author. DNS4EU is being sold as “sovereignty,” but it’s just another centralized resolver sitting on the same foreign-owned infrastructure we already depend on. Shuffling everyone’s queries through one EU-branded endpoint doesn’t fix privacy or resilience—it just adds another middleman. If the EU really wants independence, it should invest in making local ISP resolvers secure and trustworthy instead of outsourcing the job yet again.
- bux93 1y agoAnd it should only use the I- and K- root-servers, and fund those.
- letters90 1y agoThat'd be a really good idea https://en.wikipedia.org/wiki/Root_name_server https://en.wikipedia.org/wiki/Root_name_server To be honest, setting up a DNS4EU replica would just be a simple unbound
- fside 1y agoShould be easy enough. But, the problem is the scale. I work at a privacy conscious EU based startup and we used to use quad9 for our infra. Shortly after we started using, we started to hit scalability issues. When the whole eu traffic was hot, our DNS query latency would also go up. To be able to keep up, we had to switch back to CF and Google. Hope there is a really good alternative one day.
- quuxberlin 1y agoRun your own resolver. It's not that hard.
- fside 1y agoSure thing, but essentially it would be another thing that we have to make sure that it is protected and performant. At the time of building a startup, that’s still an item we are leaving someone else to manage.
- _joel 1y agoIs the domain chosen actually served by DNS4EU or is this a case of a design company doing some work for a client (the EU) and using their infra? I've seen that happen before. If not then, yea, the author's bang on.
- _joel 1y agohttps://www.joindns4.eu/learn/dns4eu-public-service-launched https://www.joindns4.eu/learn/dns4eu-public-service-launched IP's listed here are in CZ.
- jedisct1 1y agoAnd no support for modern protocols to hide the client IP (ODoH, Anonymized DNSCrypt). So long for privacy.
- lpcvoid 1y agoI have migrated domains from Cloudflare to deSEC.io the past days, and it's been going very well. It's a German nonprofit which is part of DNS4EU as a consortium member.
- _joel 1y agofor ns in $(dig NS deSEC.io +short); do for ip in $(dig +short $ns); do echo "$ns -> $ip"; whois $ip | grep -i -E "(country|city|netname|orgname)" | head -3; echo; done; done ns1.deSEC.io. -> 45.54.76.1 NetName: NETACTUATE-MDN-01 OrgName: NetActuate, Inc City: Raleigh ns2.desec.org. -> 157.53.224.1 NetName: NETACTUATE-MDN-04 OrgName: NetActuate, Inc City: Raleigh
- notachatbot123 1y agoIt looks like you discovered their global anycast network. Check out their homepage for more information.
- m3adow 1y agoNever heard of them before, but they look interesting, thanks for that. I'll transfer one of my .eu.org domains for testing it out.
- pepa65 1y agodeSEC.io is great, been using them more than 3 years. I wish they offered DDNS (like 1984.hosting does).
- gbil 1y agoThe routing policy is visible in the relevant RIPE entry for their ASN https://apps.db.ripe.net/db-web-ui/lookup?source=ripe&key=AS198121&type=aut-num https://apps.db.ripe.net/db-web-ui/lookup?source=ripe&key=AS... and one can see that they essentially have 2 upstream peers, one from HU and the other from GB, which is the main point of discussion here and open to scrutiny for sure.
- quuxberlin 1y agoThat's the policy. In real life I only found AS60068.
- pandemic_region 1y ago> The goal of DNS4EU is to ensure the digital sovereignty of the EU by providing a private, safe, and independent European DNS resolver. Should we also take into account the owner of the fiber that the dns requests travel on? The manufacturer of any hardware used along the way?
- bibelo 1y agobut about the manufacturers of the components inside the hardware? "If you wish to make an apple pie from scratch you must first invent the universe"
- wkat4242 1y agoIdeally, yes, we should. Because the fibre owner or equipment manufacturer could choose to shut it down at some point. And don't forget, since January this year a lot of those far-fetched ridiculous possibilities have proven to be reality and not so far-fetched at all. Though I'm sure this project has been in the works for much longer, it's certainly well-timed.
- supermatt 1y agojoindns4eu is not dns4eu. Its effectively a marketing website, probably subcontracted to a design agency. It has nothing to do with the actual operation of dns4eu. I'd prefer that they weren't spending funds on using US infrastructure for their marketing (and hopefully this publicity will effect a change), but its a real stretch to make out that it in any way undermines the mission of dns4eu - namely providing a public resolver that isn't slurping up request data for their own purposes.
- graemep 1y agoNonetheless, the fact that a digital sovereignty project ends up using American infrastructure for its website and email is a pretty good demonstration of how deeply embedded reliance on the US is.
- supermatt 1y agoYeah, thats exactly why projects like this are being spearheaded.
- graemep 1y agoIt does not seem to be working though. They could have used EU infrastructure for their for their email and website, and did not bother to. Its not as though there is no alternative. I suspect people pushing to host websites in the EU will default to using American DNS and email providers etc. The real problem is lack of motivation, not lack of options and it is a lot easier for people to keep on using Cloudflare and Gmail and AWS etc.
- input_sh 1y agoI'm sure if they did that someone here would complain about which routers they're using, or where where did the processors for those routers get manufactured, or where did the rare earth metals for those processors come from, or which company owns the mine extracting machines, or... Nothing gets done without some pragmatism.
- ju-st 1y ago> $ dig ns joindns4.eu +short > ns63.cloudns.net. > ns64.cloudns.uk. > ns61.cloudns.net. And US and UK have control over the TLDs of the nameservers.
- rozumbrada 1y agoThe last hop showed in the BGP route is AS60068 (cdn77) which is a Czech company with global physical network. It does not mean the data are going through GB, it's not that easy.
- quuxberlin 1y ago$ whois AS60068 [...] organisation: ORG-DL201-RIPE org-name: Datacamp Limited country: GB org-type: LIR address: 207 Regent Street address: W1B 3HH address: London [...]
- benjojo12 1y agoIn the era of relatively complicated company ownership structures (especially in a capital heavy business such as Datacamp), the company on the whois does have the same level of meaning as you seem to expect it to. 207 Regent Street, it's a relatively well known virtual office type address, I would be shocked to learn that there were any datacamp employees at that address)
- rmoriz 1y agoVirtual office addresses don't help to make it better.
- tazjin 1y agoTheir resolver resolves sites that should be censored in the EU, so it doesn't look like a government-aligned project.
- sunshine-o 1y ago[flagged]
- regularjack 1y agoWhat a load of bullshit. I take offense at Lisbon and Portugal "dying", which it certainly isn't. Yes, poorer EU countries get money, thay is how the EU works. It's not a fault, it's how it's supposed to be.
- simion314 1y agoStop commenting on Eu, Ukraine and Ruzzia if you do not understand the security of the region and the fact that Ruzzians claim the entire Eastern Europe as thei God given right to dominate. Anyone that is not a Ruzzian can use their brain and natural logic and compare the countries that entered in EU and the ones that sucked on Ruzzia and the consequences, a bigger EU means a strogner EU and a safer EU from that expansionist empire in the East.
- nextlevelwizard 1y ago>20 years ago they wanted to nurse Turkey, then Georgia, now Ukraine, they probably want to manage the western part of Russia. Stop watching state propaganda. None of us want anything to do with you. If you would just go back home and get the fuck out of Europe you wouldn't hear from us ever again, but it is literally your colonialization efforts that are biting you in the ass. Russians seem to have this weird way of looking at other countries and complaining how they are influencing/supporting other countries while they never question what their own country is doing all over the globe.
- sunshine-o 1y agoMaybe read my comment again. I am not Russian and I haven't made any pro Russian statement, I was overall positive about the peace achieved, rebuilding eastern bloc countries, said nobody trusted RT so you didn't even need to block it. My point was expansion lead to conflicts, in the physical and cyberspace, and it is valid for every country. This is why I do not see the EU institutions expansion in the cyberspace as a good thing.
- karel-3d 1y agoI think they don't actually block DNS queries, mostly related to football (soccer for Americans) pirating, that are required to be blocked in Italy, France and Portugal; so probably they break Italian, French and Portugese laws. (Don't quote me on that.) See https://flashstart.com/opendns-not-available-in-france-and-portugal-why-not-and-how-to-resolve-this/ https://flashstart.com/opendns-not-available-in-france-and-p... and similar Also they don't seem to block Russia Today, which might be required in other countries? But that might be on a different layer. Not up to date on that.
- pimterry 1y agoHow do those regulations work? Is it that anybody providing DNS in any way must block resolution of these addresses, or is it that anybody acting as an ISP must block resolution on their default DNS service? The latter seems more likely - it's much easier to regulate businesses providing a defined service rather than all servers supporting an arbitrary protocol.
- karel-3d 1y agoI don't know the details. They have ordered Google, Cisco and Cloudflare to block these on their public resolvers (so not just ISPs). I will google "Piracy Shield" to see the details. edit: it seems it's local court orders, ordering those specific companies to poison the DNS; it's not a law. So DNS4EU is fine for now.
- supermatt 1y agoIt is the ISPs operating within the country that have been ordered to censor those. Those aren’t enforceable at EU level.
- cr3cr3 1y agoDNS is inherently a globally distributed system. Recursive resolvers depend on a hierarchy of name servers—root, TLD, and authoritative—many of which are geographically and administratively dispersed. Attempting to localize DNS strictly within national or continental boundaries goes against the core architecture of how name resolution works. This particular initiative, while branded as an EU project, appears to be the product of a consortium of private companies, CERTs, and academic partners. In practice, efforts like these often struggle with cohesion, efficiency, and long-term viability—especially when guided by complex bureaucratic processes. It’s difficult to imagine such a model offering a meaningful alternative to existing resolvers, either in terms of privacy, performance, or sovereignty.
- Andrew_nenakhov 1y agoTotally reads as a reply generated by chatGPT or something similar. If this was written manually, congrats for mastering the style.
- fleischhauf 1y agoI don't know if that's something you should be congratulated for though
- cr3cr3 1y ago
- dncornholio 1y agoI don't think this article was written in good faith.
- mrweasel 1y agoI think it's written to show how insanely difficult it would be to unentangle the EU from US software and services companies. That doesn't mean we can't try, but we should be realistic in our goals.
- _fizz_buzz_ 1y agoOne step at a time? It seems like there is a lot of demand for domestic EU solutions now that wasn't really there a year ago. And if there is actual demand, someone will meet this.
- benjojo12 1y agoClaiming that AS60068 is not a "EU" because of "GB" code on their whois is really quite an ignorant way of determining that claim. With that being said actually depends on what is good enough for you, but it's relatively clear that the DNS resolver IPs that are looking up are based in the czech republic. As I mentioned in another comment "207 Regent Street" (the address in their whois) is a well known virtual office type address in the UK. As someone (who himself is admittedly in the UK) who is desperately trying to move more more to European products, this kind of absolutism it's just really exhausting on should really be a shared goal. I will happily use/buy good services from the UK,EU,Swiss,etc etc if they are comparable (even just for my own feature use case) to the US ones.
- graemep 1y agoAlso British and I agree. We should have shared goals with a number of other countries in Europe and in the rest of the world. There is a lot of scope for things to be done in cooperation - e.g. shared development of systems and deployment to datacentres in each country that uses it.
- ExoticPearTree 1y agoIf you want 100% EU stuff, someone needs to write a DNS resolver from scratch, host it on servers with hardware 100% made in the EU, connected using network devices made 100% in the EU. It looks more like more political fay dreaming and wishful thinking than an actual solution.
- mrweasel 1y agoThere's a lot of "To make an apple pie from scratch, first create the universe" going on here. If it's a 100% EU service, whatever than might mean to you, do you then also need to run it on an EU designed CPU? I don't think there is any CPUs with an architecture designed in the EU, closest one is probably ARM. That being said, I am a little disappointed. There's a lot of small wins here. Like not using CloudFlare or Gsuite.
- ExoticPearTree 1y agoFeels like fear mongering. What is wrong with CloudFlare? The point is that we need EU services for this and that is ridiculous. The only ones who will benefit from this will be EU companies that might not offer the same quality of service as the US companies do. There are for example zero hyperscalers in Europe. Sure, I would like to use something EU made, but for all that's normal, offer me something similar to what AWS/Azure/GCP offer.
- glowiefedposter 1y ago[dead]
- Disposal8433 1y ago> someone needs to write a DNS resolver from scratch Should Americans stop using Linux then?
- ExoticPearTree 1y agoThey don't have a problem with European software, Europeans have a problem with American software ;)
- AndroTux 1y agoA little bit off-topic, but regarding this (sarcastic) quote: > Europeans can’t do web and mail. There is absolutely no provider here who can do such complicated tasks. We really can't, though. Because it's not just web and mail, it's Cloudflare and Google Workspace. There just are no EU alternatives for this. There just aren't. You can do parts of it, of course, but if you're running a business, you can't waste endless resources on building your own internal Cloudflare and Google Workspace alternative. This is a real problem and I wish there were more real alternatives to services like these. Even Proton, which arguably replaces parts of Google Workspace, isn't even EU-based.
- karel-3d 1y agohttps://www.icewarp.com/ https://www.icewarp.com/ is EU-based (mostly Czech Republic)
- AndroTux 1y agoWow, that looks surprisingly interesting. How come I have never heard of them before, given that they apparently are around for more than 20 years? Have you used their services? Are they any good?
- sdoering 1y agoThanks for showing. Will take a closer loo, as this might help me de-Boogle and de-Microsoft my freelance business. Thanks a ton.
- TheChaplain 1y agoIt's not a matter of technical limitations, it's EU regulation and laws that make it so expensive to run that the margins are not enough. Large actors can do it because they have other revenue sources, and they have resources to deal with the legal matters. I am not saying regulations are bad, they are not, but every paragraph takes a small piece of the cake. And the cake is not infinite, so at a certain point people will go away because "I earn more on doing something else".
- 1y ago
- miyuru 1y agoNowadays nameservers are pretty resilient and fast, I am questioning why we need public resolvers in the first place. If someone operates a network, it is really trivial to setup a recursive server for that network.
- wkat4242 1y agoYou don't always want your provider to log all your requests. If you use another one they have to use DPI to see it which is illegal in the EU.
- em-bee 1y agorelated: dns0: https://news.ycombinator.com/item?id=44267091 https://news.ycombinator.com/item?id=44267091