6 ms·

This was quite annoying for me, having only switched my DNS server to 1.1.1.1 approximately 3 weeks ago to get around my ISP having a DNS outage. Is reasonably

This was quite annoying for me, having only switched my DNS server to 1.1.1.1 approximately 3 weeks ago to get around my ISP having a DNS outage. Is reasonably stable DNS really so much to ask for these days?

bauruine 1y ago
Why not use multiple? You can use 1.1.1.1, your ISPs and google at the same time. Or just run a resolver yourself.
- ripdog 1y ago
  >Or just run a resolver yourself. I did this for a while, but ~300ms hangs on every DNS resolution sure do get old fast.
  - xpe 1y ago
    Ouch. What resolver? What hardware? With something like a N100- or N150-based single board computer (perhaps around $200) running any number of open source DNS resolvers, I would expect you can average around 30 ms for cold lookups and <1 ms for cache hits.
    - ripdog 1y ago
      Not a hardware issue, but a physics problem. I live in NZ. I guess the root servers are all in the US, so that's 130ms per trip minimum.
      - johnklos 1y ago
        They are not all in the US.
        ripdog 1y ago
        Well that's the experience I had. Obviously caching was enabled (unbound), but most DNS keepalive times are so short as to be fairly useless for a single user. Even if a root server wasn't in the US, it will still be pretty slow for me. Europe is far worse. Most of Asia has bad paths to me, except for Japan and Singapore which are marginally better than the US. Maybe Aus has one...?
        janfoeh 1y ago
        According to [0], there is at least one in Auckland. No idea about the veracity of that site, though. [0] https://dnswatch.com/dns-docs/root-server-locations https://dnswatch.com/dns-docs/root-server-locations
        encom 1y ago
        >DNS keepalive times are so short as to be fairly useless Incompetent admins. dnsmasq at least has an option to override it (--min-cache-ttl=<time>)
        astrange 1y ago
        Cloudflare actually runs one of the root servers (https://blog.cloudflare.com/f-root/ https://blog.cloudflare.com/f-root/).
        passivegains 1y ago
        I was going to reply about how New Zealand is as far from almost everywhere else as the US, but I found out something way more interesting: Other than servers in Australia and New Zealand itself, the closest ones actually are in the US, just 3,000km north in American Samoa. Basically right next door. (I need to go back to work before my boss walks by and sees me screwing around on Google Maps, but I'm pretty sure the next closest are in French Polynesia.)
      - bauruine 1y ago
        The root servers aren't the problem. They are heavily anycasted and i'm sure there are many in .nz. If that was the issue you could simply serve the root zone yourself, at least some of them allow axfr. [0] This info is also easy cacheable, they have big TTLs and you only have to do it once for each tld. The authoritative name server of the domain you want to access on the other hand are often just in the US or Europe and are the main issue. Edit: How to serve the root zone locally with unbound. https://old.reddit.com/r/pihole/comments/s43o8j/where_does_unbound_create_or_try_to_create_its/ https://old.reddit.com/r/pihole/comments/s43o8j/where_does_u... [0] dig axfr . @k.root-servers.net
        ripdog 1y ago
        Thank you for the correction, I did get that wrong. To be clear, there was no easy solution to get reliable, low latency DNS responses from my own resolver without breaking keepalive by forcibly caching entries longer?
        bauruine 1y ago
        Not that I know of except from having a big cache and many users that keeps it warm. As I said you could run a local root zone but that only saves you the one time lookup every week+ of the tld name servers and the root servers are generally very close to you. There is a map of all root servers. There are 12 in .nz alone. A few cc tlds are providing their zone via axfr [1] so you could add that to your resolver to save some roundtrips but I don't think having .ch or .se locally will make a big difference and they are 1.2GB each and you would need to download them daily. [0]: https://root-servers.org/ https://root-servers.org/ [1]: https://github.com/jschauma/tld-zoneinfo https://github.com/jschauma/tld-zoneinfo
bjoli 1y ago
Run your own forwarder locally. Technitium dns makes it easy.
codingminds 1y ago
If you consume a service that's free of charge, it's at least not reasonable to complain if there's an outage. Like mentioned by other comments, do it on your own if you are not happy with the stability. Or just pay someone to provide it - like your ISP.. And TBH I trust my local ISP more than Google or CF. Not in availability, but it's covered by my local legislature. That's a huge difference - in a positive way.
- komali2 1y ago
  > it's at least not reasonable to complain if there's an outage. I don't think this is fair when discussing infrastructure. It's reasonable to complain about potholes, undrinkable tap water, long lines at the DMV, cracked (or nonexistent) sidewalks, etc. The internet is infrastructure and DNS resolution is a critical part of it. That it hasn't been nationalized doesn't change the fact that it's infrastructure (and access absolutely should be free) and therefore everyone should feel free to complain about it not working correctly. "But you pay taxes for drinkable tap water," yes, and we paid taxes to make the internet work too. For some reason, some governments like the USA feel it to be a good idea to add a middle man to spend that tax money on, but, fine, we'll complain about the middle man then as well.
  - gkbrk 1y ago
    But you can just run a recursive resolver. Plenty of packages to install. The root DNS servers were not affected, so you would have been just fine. DNS is infrastructure. But "Cloudflare Public Free DNS Resolver" is not, it's just a convenience and a product to collect data.
    - JdeBP 1y ago
      One can even run a private root content DNS server, and not be affected by root problems either. (This isn't a major concern, of course; and I mention it just to extend your argument yet further. The major gain of a private root content DNS server is the fraction of really stupid nonsense DNS traffic that comes about because of various things gets filtered out either on-machine or at least without crossing a border router. The gains are in security and privacy more than uptime.)
pparanoidd 1y ago
A single incident means 1.1.1.1 is no longer reasonably stable? You are the unreasonable one
- yjftsjthsd-h 1y ago
  Although I agree 1.1.1.1 is fine: To this particular commenter they've had one major outage in 3 total weeks of use, which isn't exactly a good record. (And it's understandable to weigh personal experience above other people claiming this isn't representative.)
- cryptonym 1y ago
  I have been online for 30y and can't remember being affected by downtime from my ISP DNS. When DNS resolver is down, it affects everything, 100% uptime is a fair expectation, hence redundancy. Looks like both 1.0.0.1 and 1.1.1.1 were down for more than 1h, pretty bad TBH, especially when you advise global usage. RCA is not detailed and feels like a marketing stunt we are now getting every other week.
  - sophacles 1y ago
    I too have been online for 30 years, and frequently had ISP caused dns issues, even when I wasn't using their resolvers... because of the dns interception fuckery they like to engage in. Before I started running my own resolver I saw downtime from my ISP's DNS resolver. This is across a few ISPs in that time. Anecdata is great isn't it?
    - cryptonym 1y ago
      I think we agree. Your own "anecdata" shows how catastrophic DNS failures are and why it's justified to expect 100% uptime with proper redundancy. Too bad you had providers not architecturing properly this key part of their infrastructure to the point you had to build your own solution.
- geoffpado 1y ago
  Two incidents from two completely different providers in three weeks means that my personal experience with DNS is remarkably less stable recently than the last 20-ish years I've been using the Internet.

bauruine 1y ago

Why not use multiple? You can use 1.1.1.1, your ISPs and google at the same time. Or just run a resolver yourself.

ripdog 1y ago
>Or just run a resolver yourself. I did this for a while, but ~300ms hangs on every DNS resolution sure do get old fast.
- xpe 1y ago
  Ouch. What resolver? What hardware? With something like a N100- or N150-based single board computer (perhaps around $200) running any number of open source DNS resolvers, I would expect you can average around 30 ms for cold lookups and <1 ms for cache hits.
  - ripdog 1y ago
    Not a hardware issue, but a physics problem. I live in NZ. I guess the root servers are all in the US, so that's 130ms per trip minimum.
    - johnklos 1y ago
      They are not all in the US.
      - ripdog 1y ago
        Well that's the experience I had. Obviously caching was enabled (unbound), but most DNS keepalive times are so short as to be fairly useless for a single user. Even if a root server wasn't in the US, it will still be pretty slow for me. Europe is far worse. Most of Asia has bad paths to me, except for Japan and Singapore which are marginally better than the US. Maybe Aus has one...?
        janfoeh 1y ago
        According to [0], there is at least one in Auckland. No idea about the veracity of that site, though. [0] https://dnswatch.com/dns-docs/root-server-locations https://dnswatch.com/dns-docs/root-server-locations
        encom 1y ago
        >DNS keepalive times are so short as to be fairly useless Incompetent admins. dnsmasq at least has an option to override it (--min-cache-ttl=<time>)
        astrange 1y ago
        Cloudflare actually runs one of the root servers (https://blog.cloudflare.com/f-root/ https://blog.cloudflare.com/f-root/).
      - passivegains 1y ago
        I was going to reply about how New Zealand is as far from almost everywhere else as the US, but I found out something way more interesting: Other than servers in Australia and New Zealand itself, the closest ones actually are in the US, just 3,000km north in American Samoa. Basically right next door. (I need to go back to work before my boss walks by and sees me screwing around on Google Maps, but I'm pretty sure the next closest are in French Polynesia.)
    - bauruine 1y ago
      The root servers aren't the problem. They are heavily anycasted and i'm sure there are many in .nz. If that was the issue you could simply serve the root zone yourself, at least some of them allow axfr. [0] This info is also easy cacheable, they have big TTLs and you only have to do it once for each tld. The authoritative name server of the domain you want to access on the other hand are often just in the US or Europe and are the main issue. Edit: How to serve the root zone locally with unbound. https://old.reddit.com/r/pihole/comments/s43o8j/where_does_unbound_create_or_try_to_create_its/ https://old.reddit.com/r/pihole/comments/s43o8j/where_does_u... [0] dig axfr . @k.root-servers.net
      - ripdog 1y ago
        Thank you for the correction, I did get that wrong. To be clear, there was no easy solution to get reliable, low latency DNS responses from my own resolver without breaking keepalive by forcibly caching entries longer?
        bauruine 1y ago
        Not that I know of except from having a big cache and many users that keeps it warm. As I said you could run a local root zone but that only saves you the one time lookup every week+ of the tld name servers and the root servers are generally very close to you. There is a map of all root servers. There are 12 in .nz alone. A few cc tlds are providing their zone via axfr [1] so you could add that to your resolver to save some roundtrips but I don't think having .ch or .se locally will make a big difference and they are 1.2GB each and you would need to download them daily. [0]: https://root-servers.org/ https://root-servers.org/ [1]: https://github.com/jschauma/tld-zoneinfo https://github.com/jschauma/tld-zoneinfo

bjoli 1y ago

Run your own forwarder locally. Technitium dns makes it easy.

codingminds 1y ago

If you consume a service that's free of charge, it's at least not reasonable to complain if there's an outage. Like mentioned by other comments, do it on your own if you are not happy with the stability. Or just pay someone to provide it - like your ISP.. And TBH I trust my local ISP more than Google or CF. Not in availability, but it's covered by my local legislature. That's a huge difference - in a positive way.

komali2 1y ago
> it's at least not reasonable to complain if there's an outage. I don't think this is fair when discussing infrastructure. It's reasonable to complain about potholes, undrinkable tap water, long lines at the DMV, cracked (or nonexistent) sidewalks, etc. The internet is infrastructure and DNS resolution is a critical part of it. That it hasn't been nationalized doesn't change the fact that it's infrastructure (and access absolutely should be free) and therefore everyone should feel free to complain about it not working correctly. "But you pay taxes for drinkable tap water," yes, and we paid taxes to make the internet work too. For some reason, some governments like the USA feel it to be a good idea to add a middle man to spend that tax money on, but, fine, we'll complain about the middle man then as well.
- gkbrk 1y ago
  But you can just run a recursive resolver. Plenty of packages to install. The root DNS servers were not affected, so you would have been just fine. DNS is infrastructure. But "Cloudflare Public Free DNS Resolver" is not, it's just a convenience and a product to collect data.
  - JdeBP 1y ago
    One can even run a private root content DNS server, and not be affected by root problems either. (This isn't a major concern, of course; and I mention it just to extend your argument yet further. The major gain of a private root content DNS server is the fraction of really stupid nonsense DNS traffic that comes about because of various things gets filtered out either on-machine or at least without crossing a border router. The gains are in security and privacy more than uptime.)

pparanoidd 1y ago

A single incident means 1.1.1.1 is no longer reasonably stable? You are the unreasonable one

yjftsjthsd-h 1y ago
Although I agree 1.1.1.1 is fine: To this particular commenter they've had one major outage in 3 total weeks of use, which isn't exactly a good record. (And it's understandable to weigh personal experience above other people claiming this isn't representative.)
cryptonym 1y ago
I have been online for 30y and can't remember being affected by downtime from my ISP DNS. When DNS resolver is down, it affects everything, 100% uptime is a fair expectation, hence redundancy. Looks like both 1.0.0.1 and 1.1.1.1 were down for more than 1h, pretty bad TBH, especially when you advise global usage. RCA is not detailed and feels like a marketing stunt we are now getting every other week.
- sophacles 1y ago
  I too have been online for 30 years, and frequently had ISP caused dns issues, even when I wasn't using their resolvers... because of the dns interception fuckery they like to engage in. Before I started running my own resolver I saw downtime from my ISP's DNS resolver. This is across a few ISPs in that time. Anecdata is great isn't it?
  - cryptonym 1y ago
    I think we agree. Your own "anecdata" shows how catastrophic DNS failures are and why it's justified to expect 100% uptime with proper redundancy. Too bad you had providers not architecturing properly this key part of their infrastructure to the point you had to build your own solution.
geoffpado 1y ago
Two incidents from two completely different providers in three weeks means that my personal experience with DNS is remarkably less stable recently than the last 20-ish years I've been using the Internet.