6 ms·

Super shady stuff. I never rely on any ISP provided DNS servers. I'm glad you talked to the the etailers to let them know what was going on. These business prac

Super shady stuff. I never rely on any ISP provided DNS servers. I'm glad you talked to the the etailers to let them know what was going on. These business practices do introduce latency, regardless of what he told you. Not to mention, they are highly unethical and dishonest.

helfire 13y ago
A really shady ISP could intercept and redirect any outgoing port 53 traffic to their servers.
- dmourati 13y ago
  If that were the case, I would immediately terminate any relationship with them and out them in public. While technically possible, you're now talking about a whole other form of dishonest behavior. Some would say criminal.
  - anonymoushn 13y ago
    This has been done. I'm not sure how prevalent it is now. http://comcastisfuckingwithyourport53traffic.wordpress.com/ http://comcastisfuckingwithyourport53traffic.wordpress.com/
- cdjk 13y ago
  That's what my ISP does. What's worse is that sometimes their dns servers fail intermittently (something to do with fragmented packets and retrying DNS queries in TCP mode). It did take a while to figure out what was causing the intermittent DNS failures. "My ISP is hijacking all port 53 traffic" was fairly low on my list of possibilities, I must admit. Fortunately it's not that hard to run a local resolver that forwards queries to an external resolver on a vps on an alternate port. I'd switch ISPs, but I live in a remote area and my only other choices would be satellite or cellular, so I'm stuck with them.
- aendruk 13y ago
  My ISP [1] actually does this. They offer an opt-out of NXDOMAIN hijacking, but silently proxy all port 53 traffic regardless. This experience has taught me simply to distrust the DNS protocol in its current form and use DNSCrypt in all situations. [1]: Shaw Communications, chosen by the landlord. [2]: http://dnscrypt.org/
  - mhurron 13y ago
    Are you using Shaw's DNS servers? I don't remember dealing with NXDOMAIN issues when I had Shaw, but I have run my own DNS servers for a long time now. It's been 7 years or so since I used Shaw.
    - aendruk 13y ago
      It doesn't matter what DNS servers I specify; Shaw intercepts all DNS requests. I can even make up a nonexistent DNS server as long as it's internet-routable, and will get a valid response from Shaw. This works, for example: dig @www.facebook.com news.ycombinator.com
      - gwu78 13y ago
        All that means is that you're using their recursive DNS servers. They can configure these any way they choose. Stop using third party recursive DNS servers and you will not have problems with unwanted advertising and NXDOMAIN hijacking. Run your own recurive DNS server (e.g. dnscache) on 127.0.0.1. Alternatively, query authoritative servers directly. Use a port other than 53 if you really think your ISP is trying to filter your outgoing queries; I sincerely doubt they would bother. 192.5.6.30 is an authoritative .com server. Memorize that number. dig +norecurse -b0.0.0.0#5353 news.ycombinator.com @192.5.6.30 The names on the right of the "NS" rows are the authoritative servers for ycombinator.com. (Cloudflare. No comment.) 192.5.6.30 has the IP addresses for those. You'll find them in the "ADDITIONAL SECTION". Let's say it lists 1.2.3.4 as an IP address. dig +norecurse -b0.0.0.0#5353 news.ycombinator.com @1.2.3.4 And you should receive the IP address for news.ycombinator.com, or at least your next clue where to look (if the DNS admin has chosen to play games with CNAME). This method can be automated. Your ISP is not "intercept[ing] all DNS requests". You are sending your requests to your ISP's recursive DNS servers (why?), and those servers are feeding you whatever information the ISP chooses. Go figure, they are sending you bogus info to inject advertising. Solution: Stop sending your requests to your ISP's recursive DNS servers (or any third party recursive DNS servers). Send your requests to your own recursive DNS server running on 127.0.0.1, or send nonrecursive requests to authoritative DNS servers only.
kaffeinecoma 13y ago
Super shady stuff. I never rely on any ISP provided DNS servers Doesn't that mean that you don't benefit from nearby CDNs? Perhaps worth the tradeoff anyway.
- jrockway 13y ago
  8.8.8.8 and 8.8.4.4 are anycast.
  - efdee 13y ago
    You don't trust your ISP, so you go for the one company whose entire profit model is build around ads and profiling their users, and who is known to cooperate (willingly and/or unwillingly) with the NSA in their logging programs? I'm not sure that's the right response...
    - jrockway 13y ago
      If the NSA is your adversary, you should not be using DNS at all.
  - username223 13y ago
    And GOOG-owned. Spam from a small-scale ISP, or tracking by a big ad firm? You lose either way.
    - jrockway 13y ago
      https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy "We built Google Public DNS to make the web faster and to retain as little information about usage as we could, while still being able to detect and fix problems. Google Public DNS does not permanently store personally identifiable information."
      - lwan 13y ago
        "personally identifiable"

helfire 13y ago

A really shady ISP could intercept and redirect any outgoing port 53 traffic to their servers.

dmourati 13y ago
If that were the case, I would immediately terminate any relationship with them and out them in public. While technically possible, you're now talking about a whole other form of dishonest behavior. Some would say criminal.
- anonymoushn 13y ago
  This has been done. I'm not sure how prevalent it is now. http://comcastisfuckingwithyourport53traffic.wordpress.com/ http://comcastisfuckingwithyourport53traffic.wordpress.com/
cdjk 13y ago
That's what my ISP does. What's worse is that sometimes their dns servers fail intermittently (something to do with fragmented packets and retrying DNS queries in TCP mode). It did take a while to figure out what was causing the intermittent DNS failures. "My ISP is hijacking all port 53 traffic" was fairly low on my list of possibilities, I must admit. Fortunately it's not that hard to run a local resolver that forwards queries to an external resolver on a vps on an alternate port. I'd switch ISPs, but I live in a remote area and my only other choices would be satellite or cellular, so I'm stuck with them.
aendruk 13y ago
My ISP [1] actually does this. They offer an opt-out of NXDOMAIN hijacking, but silently proxy all port 53 traffic regardless. This experience has taught me simply to distrust the DNS protocol in its current form and use DNSCrypt in all situations. [1]: Shaw Communications, chosen by the landlord. [2]: http://dnscrypt.org/
- mhurron 13y ago
  Are you using Shaw's DNS servers? I don't remember dealing with NXDOMAIN issues when I had Shaw, but I have run my own DNS servers for a long time now. It's been 7 years or so since I used Shaw.
  - aendruk 13y ago
    It doesn't matter what DNS servers I specify; Shaw intercepts all DNS requests. I can even make up a nonexistent DNS server as long as it's internet-routable, and will get a valid response from Shaw. This works, for example: dig @www.facebook.com news.ycombinator.com
    - gwu78 13y ago
      All that means is that you're using their recursive DNS servers. They can configure these any way they choose. Stop using third party recursive DNS servers and you will not have problems with unwanted advertising and NXDOMAIN hijacking. Run your own recurive DNS server (e.g. dnscache) on 127.0.0.1. Alternatively, query authoritative servers directly. Use a port other than 53 if you really think your ISP is trying to filter your outgoing queries; I sincerely doubt they would bother. 192.5.6.30 is an authoritative .com server. Memorize that number. dig +norecurse -b0.0.0.0#5353 news.ycombinator.com @192.5.6.30 The names on the right of the "NS" rows are the authoritative servers for ycombinator.com. (Cloudflare. No comment.) 192.5.6.30 has the IP addresses for those. You'll find them in the "ADDITIONAL SECTION". Let's say it lists 1.2.3.4 as an IP address. dig +norecurse -b0.0.0.0#5353 news.ycombinator.com @1.2.3.4 And you should receive the IP address for news.ycombinator.com, or at least your next clue where to look (if the DNS admin has chosen to play games with CNAME). This method can be automated. Your ISP is not "intercept[ing] all DNS requests". You are sending your requests to your ISP's recursive DNS servers (why?), and those servers are feeding you whatever information the ISP chooses. Go figure, they are sending you bogus info to inject advertising. Solution: Stop sending your requests to your ISP's recursive DNS servers (or any third party recursive DNS servers). Send your requests to your own recursive DNS server running on 127.0.0.1, or send nonrecursive requests to authoritative DNS servers only.

kaffeinecoma 13y ago

Super shady stuff. I never rely on any ISP provided DNS servers Doesn't that mean that you don't benefit from nearby CDNs? Perhaps worth the tradeoff anyway.

jrockway 13y ago
8.8.8.8 and 8.8.4.4 are anycast.
- efdee 13y ago
  You don't trust your ISP, so you go for the one company whose entire profit model is build around ads and profiling their users, and who is known to cooperate (willingly and/or unwillingly) with the NSA in their logging programs? I'm not sure that's the right response...
  - jrockway 13y ago
    If the NSA is your adversary, you should not be using DNS at all.
- username223 13y ago
  And GOOG-owned. Spam from a small-scale ISP, or tracking by a big ad firm? You lose either way.
  - jrockway 13y ago
    https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy "We built Google Public DNS to make the web faster and to retain as little information about usage as we could, while still being able to detect and fix problems. Google Public DNS does not permanently store personally identifiable information."
    - lwan 13y ago
      "personally identifiable"