4 ms·

Install a DNS resolver on your laptop

49 points by aristus 18y ago

chiffonade 18y ago
Protip: Skip configuring BIND and use UUNet's original name servers (which are blazingly fast and still maintained) because you've been staring at DNS settings for so god damn long they've been burning into your brain for the past 15 years. Protip #2: Also learn to configure your DHCP client so this is possible.
- extantproject 18y ago
  4.2.2.1
  - timf 18y ago
    These are the ones I usually use too, level3, 4.2.2.[1-6]
- aristus 18y ago
  That will work too. But I think it's more polite to do it the hard way. Same reason you used to set up your own time server and package server for your farm.
  - chiffonade 18y ago
    > More polite No, this intuition is incorrect. By using one of UUNet's (or someone else's) public caching name servers, you're increasing the cache diversity in a very widely used public cache and reducing the overall load on the global root name servers AND domain-level authority servers by reducing cache misses and reducing query traffic in a cumulative manner. Think about it in terms of extremes/limits. If everyone on the internet ran their own server, would the root infrastructure slow down or speed up? Personally I think it's somewhat insane and counterproductive to setup a DNS server on your laptop - not only are you wasting your own CPU cycles, you're wasting the CPU cycles of the root name servers and CPU cycles of the domain-level authority servers. Why do that when there are numerous public cache servers setup specifically for this very purpose?! There's a reason those massive cache servers are accessible by the public internet. They help it work.
    - spc476 18y ago
      I have some issues with this. First off, there are 13 root servers across a wide variety of networks, whereas (I checked) there are only two UUNet DNS servers, both of which are on the same network. You've just exchanged the load from 13 servers across the Inernet to two servers on a single network. Also, there do exist DNS attacks to poison DNS resolvers, and if I suspect poisoned results, I can restart my own local DNS resolver, but I can't restart UUNet's. There's also the issue of connectivity. There may be an issue with connectivity between your ISP and UUNet, but otherwise the rest of the Internet is accessible. If I can't get to sites, I now have to take the time to determine if it's a problem locally (ISP is down), or if there's a networking issue between me and UUNet. A locally run DNS server means I can troubleshoot that particular issue quicker.
      - chiffonade 18y ago
        > only two UUNet DNS servers I'm talking about their publicly accessible caching DNS servers, of which are there are far more than two. I'm not talking about the ones they register with the domain registrar to host their authoritative zone files. That's completely different. > both of which are on the same network. You've just exchanged the load from 13 servers across the Inernet to two servers on a single network. That's not how DNS works. Furthermore, that's the entire role of a cache server.
timf 18y ago
The link recommends dnscache. For my laptop, I like dnsmasq instead which is really easy to configure and serves the same purpose, but also serves answers from /etc/hosts and serves as a DHCPd. Having a quick DHCP solution is handy because I often find myself piping my wireless net to another computer via ethernet cable. Also good for virtual machines.
prakash 18y ago
This is really important, alas, you only know it when your ISP has really sucky DNS, and keeps timing out. The other reason which you might or might not be aware of is that many CDN's use dns to map you to one of their servers, and using a resolver instead of open dns directly is the best way to go.
paul_houle 18y ago
My DSL provider is pretty good in some ways, but the DNS service has some drawbacks: (i) It used to be ~slow~, slow enough that my broadband connection felt worse than dialup, (ii) Failed DNS queries get pointed to a server that serves up contextual ads. The second is obnoxious when you're browsing the web, but it's completely unacceptable when you're doing projects where you expect certain DNS queries to fail. djb's dnscache is a sweet answer to the problem.
mikeyur 18y ago
I use OpenDNS and it works well for me most of the time. I may give this a shot though in the future.
nuclear_eclipse 18y ago
Ever since I switched my pfSense router machine to using OpenDNS as it's authority, rather than Time Warner's servers, I've noticed a much faster response time, especially when hitting a domain that the router has in its cache. I've never looked back, and even went as far as to set my laptop to use OpenDNS whenever I'm not at home. Couldn't be happier. :)
jws 18y ago
Another good reason: While traveling recently, several times I got to places with intentionally free wifi that failed to advertise a DNS server. If you use your own DNS server then these access points are usable. You could also remember the IP of a usable DNS server elsewhere on the internet.
- lazyant 18y ago
  4.2.2.1, 4.2.2.2
FlorinAndrei 18y ago
Yup, running your own local DNS cache is almost always better than the ISP-supplied resolvers. Note: I used to run DJB's software a lot, back in the '90s especially, when there was no secure alternative. But nowadays there's no point in doing that. Bind has cleaned up their act, it's secure and usable enough nowadays.
- tptacek 18y ago
  And the evidence you have for this is what? 2008 was not a great year in the history of BIND security.
  - blasdel 18y ago
    The publicity around your 'leak' didn't help much :)
    - tptacek 18y ago
      Something tells me that bug was going to get some publicity regardless of what happened the week before Black Hat.
      - blasdel 18y ago
        Yes, but you started a particularly lulzy ball rolling.
        tptacek 18y ago
        Nice of you to notice.
tlrobinson 18y ago
What's the advantage of running your own resolver over just setting your DNS servers to something like OpenDNS?
- timf 18y ago
  My reasons: - Centralize DNS settings to one place for my mini-itx (that I take to coffeeshops with me and pipe through my laptop) and any VMs running on that machine or my laptop. - Centralize ad-hoc and "rigged" hostname settings for all these things, my local /etc/hosts names are all propagated to anything using the server. - Non multi-machine consideration: caching. There's almost zero overhead to setting up dnsmasq, may as well take advantage of a local dns cache (browser cache is only good for web browsing). I can tell the difference, especially on some networks.
  - timf 18y ago
    I just realized people are hung up on the resolving part of that link and not the "on laptop cache" part. I don't think there's any compelling reason to run an actual resolver (as opposed to a local cache that recurses to a reliable, non-monetizing public cache).
- tptacek 18y ago
  Comparable performance over time, slightly greater reliability, no reliance on a third party or exposure to whatever they do to monetize their service, and slightly less courtesy to the root server maintainers who would otherwise be shielded from your traffic.
- est 18y ago
  Well if you are an Internet user out side US and you are visiting CDN powered sites via OpenDNS, you will be redirected to US servers, which is much more slower if you use your ISP's DNS
- blasdel 18y ago
  You get unpoisoned DNS, that's actually 'Open' and 'faster than your ISP'. OpenDNS is neither. What's so funny about it is that it's the shit that Slashdotters rail against, successfuly marketed back to them.
whughes 18y ago
4.2.2.1 and 4.2.2.2 have always worked great as DNS servers for me.
- timf 18y ago
  There's more, 4.2.2.[1-6], these are level3's I have no idea how they're actually load balanced but everyone always says 1 and 2 so I use the other ones.
  - blasdel 18y ago
    1-3 are always golden for me, but 4-6 are hosted differently and are variable in their decency.
    - timf 18y ago
      Huh, maybe because I have 3 in the list (first) I never notice.
      - blasdel 18y ago
        It probably depends heavily on your routes out to the internet -- it's likely that for someone else the situation is reversed.
- blasdel 18y ago
  I've used this set of servers for years, they're the fastest I know of, period. I'll back that up with some data: DNS Server | Comcast in Seattle | The Planet Colo in Dallas Level3 4.2.2.X | 11ms ± 1.5ms 5hops | 1ms ± 0.2ms OpenDNS 208.67.222.222 | 35ms - 150ms 11hops | 24.9ms ± 0.1ms Comcast 68.87.68.162 | 90ms - 250ms 12hops | 23.4ms ± 0.1ms Hilariously, neither OpenDNS nor Comcast are so variable in ther sluggishness when accessed directly -- The Planet is peered directly with Level3, NTT (OpenDNS's host), and Comcast. On top of that, Comcast is marginally faster than OpenDNS outside their own shitty network! The relative slowness has nothing to do with the servers themselves.
- 18y ago

49 points by aristus 18y ago

Protip: Skip configuring BIND and use UUNet's original name servers (which are blazingly fast and still maintained) because you've been staring at DNS settings for so god damn long they've been burning into your brain for the past 15 years. Protip #2: Also learn to configure your DHCP client so this is possible.

extantproject 18y ago
4.2.2.1
- timf 18y ago
  These are the ones I usually use too, level3, 4.2.2.[1-6]
aristus 18y ago
That will work too. But I think it's more polite to do it the hard way. Same reason you used to set up your own time server and package server for your farm.
- chiffonade 18y ago
  > More polite No, this intuition is incorrect. By using one of UUNet's (or someone else's) public caching name servers, you're increasing the cache diversity in a very widely used public cache and reducing the overall load on the global root name servers AND domain-level authority servers by reducing cache misses and reducing query traffic in a cumulative manner. Think about it in terms of extremes/limits. If everyone on the internet ran their own server, would the root infrastructure slow down or speed up? Personally I think it's somewhat insane and counterproductive to setup a DNS server on your laptop - not only are you wasting your own CPU cycles, you're wasting the CPU cycles of the root name servers and CPU cycles of the domain-level authority servers. Why do that when there are numerous public cache servers setup specifically for this very purpose?! There's a reason those massive cache servers are accessible by the public internet. They help it work.
  - spc476 18y ago
    I have some issues with this. First off, there are 13 root servers across a wide variety of networks, whereas (I checked) there are only two UUNet DNS servers, both of which are on the same network. You've just exchanged the load from 13 servers across the Inernet to two servers on a single network. Also, there do exist DNS attacks to poison DNS resolvers, and if I suspect poisoned results, I can restart my own local DNS resolver, but I can't restart UUNet's. There's also the issue of connectivity. There may be an issue with connectivity between your ISP and UUNet, but otherwise the rest of the Internet is accessible. If I can't get to sites, I now have to take the time to determine if it's a problem locally (ISP is down), or if there's a networking issue between me and UUNet. A locally run DNS server means I can troubleshoot that particular issue quicker.
    - chiffonade 18y ago
      > only two UUNet DNS servers I'm talking about their publicly accessible caching DNS servers, of which are there are far more than two. I'm not talking about the ones they register with the domain registrar to host their authoritative zone files. That's completely different. > both of which are on the same network. You've just exchanged the load from 13 servers across the Inernet to two servers on a single network. That's not how DNS works. Furthermore, that's the entire role of a cache server.

timf 18y ago

The link recommends dnscache. For my laptop, I like dnsmasq instead which is really easy to configure and serves the same purpose, but also serves answers from /etc/hosts and serves as a DHCPd. Having a quick DHCP solution is handy because I often find myself piping my wireless net to another computer via ethernet cable. Also good for virtual machines.

prakash 18y ago

This is really important, alas, you only know it when your ISP has really sucky DNS, and keeps timing out. The other reason which you might or might not be aware of is that many CDN's use dns to map you to one of their servers, and using a resolver instead of open dns directly is the best way to go.

paul_houle 18y ago

My DSL provider is pretty good in some ways, but the DNS service has some drawbacks: (i) It used to be ~slow~, slow enough that my broadband connection felt worse than dialup, (ii) Failed DNS queries get pointed to a server that serves up contextual ads. The second is obnoxious when you're browsing the web, but it's completely unacceptable when you're doing projects where you expect certain DNS queries to fail. djb's dnscache is a sweet answer to the problem.

mikeyur 18y ago

I use OpenDNS and it works well for me most of the time. I may give this a shot though in the future.

nuclear_eclipse 18y ago

Ever since I switched my pfSense router machine to using OpenDNS as it's authority, rather than Time Warner's servers, I've noticed a much faster response time, especially when hitting a domain that the router has in its cache. I've never looked back, and even went as far as to set my laptop to use OpenDNS whenever I'm not at home. Couldn't be happier. :)

jws 18y ago

Another good reason: While traveling recently, several times I got to places with intentionally free wifi that failed to advertise a DNS server. If you use your own DNS server then these access points are usable. You could also remember the IP of a usable DNS server elsewhere on the internet.

lazyant 18y ago
4.2.2.1, 4.2.2.2

FlorinAndrei 18y ago

Yup, running your own local DNS cache is almost always better than the ISP-supplied resolvers. Note: I used to run DJB's software a lot, back in the '90s especially, when there was no secure alternative. But nowadays there's no point in doing that. Bind has cleaned up their act, it's secure and usable enough nowadays.

tptacek 18y ago
And the evidence you have for this is what? 2008 was not a great year in the history of BIND security.
- blasdel 18y ago
  The publicity around your 'leak' didn't help much :)
  - tptacek 18y ago
    Something tells me that bug was going to get some publicity regardless of what happened the week before Black Hat.
    - blasdel 18y ago
      Yes, but you started a particularly lulzy ball rolling.
      - tptacek 18y ago
        Nice of you to notice.

tlrobinson 18y ago

What's the advantage of running your own resolver over just setting your DNS servers to something like OpenDNS?

timf 18y ago
My reasons: - Centralize DNS settings to one place for my mini-itx (that I take to coffeeshops with me and pipe through my laptop) and any VMs running on that machine or my laptop. - Centralize ad-hoc and "rigged" hostname settings for all these things, my local /etc/hosts names are all propagated to anything using the server. - Non multi-machine consideration: caching. There's almost zero overhead to setting up dnsmasq, may as well take advantage of a local dns cache (browser cache is only good for web browsing). I can tell the difference, especially on some networks.
- timf 18y ago
  I just realized people are hung up on the resolving part of that link and not the "on laptop cache" part. I don't think there's any compelling reason to run an actual resolver (as opposed to a local cache that recurses to a reliable, non-monetizing public cache).
tptacek 18y ago
Comparable performance over time, slightly greater reliability, no reliance on a third party or exposure to whatever they do to monetize their service, and slightly less courtesy to the root server maintainers who would otherwise be shielded from your traffic.
est 18y ago
Well if you are an Internet user out side US and you are visiting CDN powered sites via OpenDNS, you will be redirected to US servers, which is much more slower if you use your ISP's DNS
blasdel 18y ago
You get unpoisoned DNS, that's actually 'Open' and 'faster than your ISP'. OpenDNS is neither. What's so funny about it is that it's the shit that Slashdotters rail against, successfuly marketed back to them.

whughes 18y ago

4.2.2.1 and 4.2.2.2 have always worked great as DNS servers for me.

timf 18y ago
There's more, 4.2.2.[1-6], these are level3's I have no idea how they're actually load balanced but everyone always says 1 and 2 so I use the other ones.
- blasdel 18y ago
  1-3 are always golden for me, but 4-6 are hosted differently and are variable in their decency.
  - timf 18y ago
    Huh, maybe because I have 3 in the list (first) I never notice.
    - blasdel 18y ago
      It probably depends heavily on your routes out to the internet -- it's likely that for someone else the situation is reversed.
blasdel 18y ago
I've used this set of servers for years, they're the fastest I know of, period. I'll back that up with some data: DNS Server | Comcast in Seattle | The Planet Colo in Dallas Level3 4.2.2.X | 11ms ± 1.5ms 5hops | 1ms ± 0.2ms OpenDNS 208.67.222.222 | 35ms - 150ms 11hops | 24.9ms ± 0.1ms Comcast 68.87.68.162 | 90ms - 250ms 12hops | 23.4ms ± 0.1ms Hilariously, neither OpenDNS nor Comcast are so variable in ther sluggishness when accessed directly -- The Planet is peered directly with Level3, NTT (OpenDNS's host), and Comcast. On top of that, Comcast is marginally faster than OpenDNS outside their own shitty network! The relative slowness has nothing to do with the servers themselves.
18y ago