2 ms·

Sending every single query to a centralized third party is hard to square with "high privacy". I prefer to run my own local recursive resolver.

ebb_earl_co 29d ago
Please correct me if I am mistaken, but unless there’s a local resolver for every single one of your clients, aren’t the DNS requests sent in plaintext to the upstream of your local resolver? That might not be an issue for your situation, but I recall the benefit of something like Quad9’s offering is the encryption between client and their endpoint(s), particularly for untrusted ISP or similar.
- staviette 29d ago
  Yes, that's a real benefit in many situations. Everything on your lan can do normal DNS queries to your local forwarder, which talks DNS over TLS or DNS over HTTPS to Quad9. Downside is Quad9 can see all your DNS traffic. But without it if you run your own recursive resolver your ISP sees all your queries, and many others see portions of them, unencrypted.
  - kayson 29d ago
    > But without it if you run your own recursive resolver your ISP sees all your queries, and many others see portions of them, unencrypted. This hopefully shouldn't be an issue for long with stuff like RFC 9539 and OOTS/SVCB.
    - egberts1 29d ago
      Courtesy link for HN readers https://www.rfc-editor.org/info/rfc9539/ https://www.rfc-editor.org/info/rfc9539/
winstonwinston 29d ago
> I prefer to run my own local recursive resolver. Used to be fine. I stopped doing it when average TTL dropped to 300 seconds and it takes far too long for my local recursor to get the answer >100ms, when 3rd party resolver delivers in <10ms.
- pocksuppet 29d ago
  You don't have to obey TTL. You can use Unbound options like: cache-min-ttl: 3600 // seconds cache-min-negative-ttl: 3600 // seconds or serve-expired: yes serve-expired-client-timeout: 20 // milliseconds to wait for resolution before serving the old value to the client
  - clownstrikelol 28d ago
    Can also have unbound preemptively refresh cached values too... prefetch: yes Tada, now your unbound serves records faster than the round trip out to anything off your own network in most cases.
- bigstrat2003 29d ago
  It's still fine. I run my own recursive resolver and have no noticeable issues.
  - tosti 28d ago
    Good for you

ebb_earl_co 29d ago

Please correct me if I am mistaken, but unless there’s a local resolver for every single one of your clients, aren’t the DNS requests sent in plaintext to the upstream of your local resolver? That might not be an issue for your situation, but I recall the benefit of something like Quad9’s offering is the encryption between client and their endpoint(s), particularly for untrusted ISP or similar.

staviette 29d ago
Yes, that's a real benefit in many situations. Everything on your lan can do normal DNS queries to your local forwarder, which talks DNS over TLS or DNS over HTTPS to Quad9. Downside is Quad9 can see all your DNS traffic. But without it if you run your own recursive resolver your ISP sees all your queries, and many others see portions of them, unencrypted.
- kayson 29d ago
  > But without it if you run your own recursive resolver your ISP sees all your queries, and many others see portions of them, unencrypted. This hopefully shouldn't be an issue for long with stuff like RFC 9539 and OOTS/SVCB.
  - egberts1 29d ago
    Courtesy link for HN readers https://www.rfc-editor.org/info/rfc9539/ https://www.rfc-editor.org/info/rfc9539/

winstonwinston 29d ago

> I prefer to run my own local recursive resolver. Used to be fine. I stopped doing it when average TTL dropped to 300 seconds and it takes far too long for my local recursor to get the answer >100ms, when 3rd party resolver delivers in <10ms.

pocksuppet 29d ago
You don't have to obey TTL. You can use Unbound options like: cache-min-ttl: 3600 // seconds cache-min-negative-ttl: 3600 // seconds or serve-expired: yes serve-expired-client-timeout: 20 // milliseconds to wait for resolution before serving the old value to the client
- clownstrikelol 28d ago
  Can also have unbound preemptively refresh cached values too... prefetch: yes Tada, now your unbound serves records faster than the round trip out to anything off your own network in most cases.
bigstrat2003 29d ago
It's still fine. I run my own recursive resolver and have no noticeable issues.
- tosti 28d ago
  Good for you