6 ms·
> For many users, not being able to resolve names using the 1.1.1.1 Resolver meant that basically all Internet services were unavailable. Don't you normally ha
by v5v3 1y ago
> For many users, not being able to resolve names using the 1.1.1.1 Resolver meant that basically all Internet services were unavailable.
Don't you normally have 2 DnS servers listed on any device. So was the second also down, if not why didn't it go to that.
- rat9988 1y agoNot all users have configured two DNS servers?
- quacksilver 1y agoIt is highly recommended to configure two or more DNS servers incase one is down. I would count not configuring at least two as 'user error'. Many systems require you to enter a primary and alternate server in order to save a configuration.
- tgv 1y agoThe default setting on most computers seems to be: use the (wifi) router. I suppose telcos like that because it keeps the number of DNS requests down. So I wouldn't necessarily see it as user error.
- SketchySeaBeast 1y agoThe funny part with that is that sites like cloudflare say "Oh, yeah, just use 1.0.0.1 as your alternate", when, in reality, it should be an entirely different service.
- daneel_w 1y agoOK. But there's no reason or excuse not to, if they already manually configured a primary.
- rom1v 1y agoOn Android, in Settings, Network & internet, Private DNS, you can only provide one in "Private DNS provider hostname" (AFAIK). Btw, I really don't understand why it does not accept an IP (1.1.1.1), so you have to give an address (one.one.one.one). It would be more sensible to configure a DNS server from an IP rather than from an address to be resolved by a DNS server :/
- quacksilver 1y agoPrivate DNS on Android refers to 'DNS over HTTPS' and would normally only accept a hostname. Normal DNS can normally be changed in your connection settings for a given connection on most flavours of Android.
- quaintdev 1y agoIts DNS over TLS. Android does not support DNS over HTTPS except Google's DNS
- rom1v 1y ago> Private DNS on Android refers to 'DNS over HTTPS' Yes, sorry, I did not mention it. So if you want to use DNS over HTTPS on Android, it is not possible to provide a fallback.
- ignoramous 1y ago> So if you want to use DNS over HTTPS on Android, it is not possible to provide a fallback. Not true. If the (DoH) host has multiple A/AAAA records (multiple IPs), any decent DoH client would retry its requests over multiple or all of those IPs.
- zamadatix 1y ago1.1.1.1 is also what they call the resolver service as a whole, the impact section (seems to) be saying both 1.0.0.0/24 and 1.1.1.0/24 were affected (among other ranges).
- Gieron 1y agoI think normally you pair 1.1.1.1 with 1.0.0.1 and, if I understand this correctly, both were down.
- moontear 1y agoJust pair 1.1.1.1 with 9.9.9.9 (Quad9) so you have fault tolerance in terms of provider as well.
- rvnx 1y agoQuad9 is reselling the traffic logs, so it means if you connect to secret hosts (like for your work), they will be leaked
- Demiurge 1y agoIs this true? They claim that they don't keep any logs. Do you have a source?
- jeffbee 1y agoThey don't claim that. Less than a week ago HN discussed their top resolved domains report. Such a report implies they have logs.
- Demiurge 1y agoFrom their homepage: > How Quad9 protects your privacy? > When your devices use Quad9 normally, no data containing your IP address is ever logged in any Quad9 system. Of course they have some kinds of logs. Aggregating resolved domains without logging client IPs is not what the implication of "Quad9 is reselling the traffic logs" seems to be.
- jeffbee 1y agoWe're not discussing IP addresses, we are discussing whether their logs can leak your secret domain name.
- bmicraft 1y agoMy Mikrotik router (and afaict all of them) don't support more than one DoH address.
- deleted 1y ago[deleted]
- ahoka 1y agoOr run your own, if you are able to.
- sschueller 1y agoYes, I would also highly recommend using a DNS closest to you (for those that have ISPs that don't mess around (blocking etc.) with their DNS you usually get much better response times) and multiple from different providers. If your device doesn't support proper failover use a local DNS forwarder on your router or an external one. In Switzerland I would use Init7 (isp that doesn't filter) -> quad9 (unfiltered Version) -> eu dns0 (unfiltered Version)
- dylan604 1y agoHow busy in life are you that we're concerning ourselves with nearest DNS? Are you browsing the internet like a high frequency stock trader? Seriously, in everyone's day to day, other than when these incidents happen, does someone notice a delay from resolving a domain name? I get that in theory blah blah, but we now have choices in who gets to see all of our requests and the ISP will always lose out to the other losers in the list
- jeffbee 1y agoYou know, I recently went through a period of thinking my MacBook was just broken. It had the janks. Everything on the browser was just slower than you're used to. After a week or two of pulling my hair, I figured it out. The newly-configured computer was using the DHCP-assigned DNS instead of Google DNS. Switched it, and it made a massive difference.
- dylan604 1y agobut that's the opposite of the request to move from a googDNS to a local one because of latency. so your ISP's DNS sucked, which is a broad statement, and is part of the why services like 1.1.1.1 or 8.8.8.8 exist. you didn't make the change of DNS because you were picking one based on nearest location.
- jeffbee 1y agoThere is more to latency than distance. Server response time is also important. In my case, the problem was that the DNS forwarder in the local wifi access point/router was very slow, even though the ICMP latency from my laptop to that device is obviously low.
- Macha 1y agoCloudflare's own suggested config is to use their backup server 1.0.0.1 as the secondary DNS, which was also affected by this incident.
- stingraycharles 1y agoTBH at this point the failure modes in which 1.1.1.1 would go down and 1.0.0.1 would not are not that many. At CloudFlare’s scale, it’s hardly believable a single of these DNS servers would go down, and it’s rather a large-scale system failure. But I understand why Cloudflare can’t just say “use 8.8.8.8 as your backup”.
- bombcar 1y agoAt least some machines/routers do NOT have a primary and backup but instead randomly round-robin between them. Which means that you’d be on cloudflare half the time and on google half the time which may not be what you wanted.
- toast0 1y agoIt would depend on how Cloudflare set up their systems. From this and other outages, I think it's pretty clear that they've set up their systems as a single failure domain. But it would be possible for them to have setup for 1.1.1.1 and 1.0.0.1 to have separate failure domains --- separate infrastructure, at least some sites running one but not the other.
- Bluescreenbuddy 1y agoYup. I have Cloudfare and Quad9
- bongodongobob 1y ago3 at every place I've ever worked.
- Polizeiposaune 1y agoCloudflare recommends you configure 1.1.1.1 and 1.0.0.1 as DNS servers. Unfortunately, the configuration mistake that caused this outage disabled Cloudflare's BGP advertisements of both 1.1.1.0/24 and 1.0.0.0/24 prefixes to its peers.
- kingnothing 1y agoA better recommendation is to use Cloudflare for one of your DNS servers and a completely different company for the other.
- butlike 1y agoYeah but on paper they're never going to recommend using a competitor
- itake 1y agoJust wondering, how do y'all manage wifi portals and manually setting DNS services? I used to use cf and google's but it was so annoying to disable and re-enable that every time I use a public wifi network.
- gerdesj 1y agoDNS is just a look up service. You can filter it or not but in the end it is just a "source of truth". What are you trying to do on your wifi?
- itake 1y agoMany wifi networks redirect non-encrypted http traffic to their captive portal. For the redirect to work, your DNS needs to be the default one provided by the router so that http://neverssl.com http://neverssl.com resolves to the wifi's "Please accept our ToS to get online" page. If you aren't using their DNS, then your network requests just get dropped (as you're not approved yet). You need their DNS to learn how to access their captive host so they can whitelist your mac address.
- gerdesj 1y agoIf you think you can pontificate on DNS then I think you should be running your own service. Note how root "." just works and has done for decades - that's proper engineering and actually way more complicated than running 1.1.1.1. What 1.1.1.1 suffers from is anycast and not DNS. Cloudflare (and Google and co) insist on using one or more "vanity" IP addresses - that is very unfair of me but that it what it is, and to make it work, they have to use anycast. The real issue is fixing anycast and not DNS. Anyway, select two+ providers and set them.
- tyingq 1y agoListing two is better than nothing, but it's not great. If one goes down, there's nothing that tracks which one is working, so you usually see long hangs and intermittent issues. Unless you do something fancy with a local caching dns proxy with more than one upstream.