WingNews logo WingNews GitHub [2]
top | item 19094283

DNS servers that offer privacy and filtering

125 points| petercooper | 7 years ago |danielmiessler.com | reply

89 comments

order
[+] skrause|7 years ago|reply
The best tip is in the sidebar on that page:

> 1.0.0.1 abbreviates to 1.1, so you can literally test by typing "ping 1.1"

[+] geocar|7 years ago|reply
You can also ping 16843009 and 16777217 -- perhaps less memorable, but if your dot key is broken…
[+] krylon|7 years ago|reply
I know this is not for everyone, but I strongly prefer to run my own recursive resolver at home. Performance is great, plus I get regular DNS for the machines on my home network. Also, it was a fun little project. :)
[+] kingo55|7 years ago|reply
More people should do this.

I recently switched my home network DNS forwarder from Bind to DNS Crypt Proxy (https://github.com/jedisct1/dnscrypt-proxy). You can get ad/content filtering lists along with some little privacy enhancements like DNS Crypt and DNS over HTTPS support for encrypted DNS queries to supported services, like CloudFlare.

[+] sascha_sl|7 years ago|reply
I really like the flexibility of CoreDNS for that. I use Cloudflare with dnscrypt as my resolver and still get to use intranet things at work because I can just forward the zones I need there elsewhere.
[+] skrause|7 years ago|reply
I like to share the cache of the DNS resolver with as many people as possible because that's what gives you the best performance. A local resolver just for me can't really do that.
[+] tracker1|7 years ago|reply
Most home routers already do this for you, it's a bit abstracted but there, just need to specify the network and have it in the list of networks to resolve for DHCP. Or you can DIY it on another box.

I find it's still best to defer to an upstream forward server vs. root resolution. Most of the providers mentioned have multiple points of presence and will likely be closer and resolve MUCH faster for most cases. DNS resolution time can be a huge factor in web responsiveness.

[+] agumonkey|7 years ago|reply
I use pdnsd as a local cache. It used to make browsing lightning fast. Although I might have messed up something since because dns resolution seems laggy. But in theory it is of great benefits.
[+] acranox|7 years ago|reply
That's great and all, but you still need to pick an upstream DNS server. The conventional advice is to use one of these public services, or your ISP's resolvers, to avoid hitting the root servers constantly. A lot of services these days have very short TTLs, so running your own recursive resolver still causes a lot of requests to get forwarded.

Also, as counterintuitive as it might seem, when I use namebench ( https://code.google.com/archive/p/namebench/ ) it still says cloudflare and google are faster than my local resolver. (not by a lot though)

[+] dspillett|7 years ago|reply
That and handy for network level filtering, such as PiHole.
[+] nykolasz|7 years ago|reply
I need to point out that Norton DNS has been retired and is not supported anymore (and never offered any privacy).

"On November 15, 2018, Norton ConnectSafe service is being retired or discontinued meaning the service will no longer be available or supported. You may continue to use ConnectSafe until November 15, 2018. However, we do recommend that you take a moment to review important details related to this announcement below."

Some alternatives: https://medium.com/@nykolas.z/norton-connectsafe-dns-is-shut...

I am actually surprised he didn't mention CleanBrowsing in their list, which I would recommend as good alternative to Norton and OpenDNS.

[+] darrmit|7 years ago|reply
I made the jump to CleanBrowsing a few months ago from OpenDNS because OpenDNS caches records really aggressively and was just generally stagnant in terms of feature set. I've been really happy with performance and privacy.

I configured DNScrypt on Tomato and I also use Tomato to redirect all DNS requests so it can't be bypassed by simply re-pointing DNS. VPN obviously bypasses it.

https://cleanbrowsing.org/how-it-works

[+] auslander|7 years ago|reply
> Logs are kept for 24 hours for debugging purposes, then they are purged

Legalese is very hard to learn language. Do they keep aggregate data, derived from those raw logs? It is not said. Trusting Cloudflare? It is a profit driven company, to start with ...

[+] zackbloom|7 years ago|reply
I work at Cloudflare. We don't sell data of any form, and we don't keep anything which could map queries back to the individual who made them.

When we talk about aggregate data it's things like total number of queries made to 1.1.1.1, number made by AS, and geographic region. Its purpose is only to show us if people are using 1.1.1.1 and how that changes over time.

[+] palijer|7 years ago|reply
DNS servers should not be used as "internet connectivity tests" by pinging them. They are not maintained as ICMP test servers, and that is not their purpose. While many do not block ICMP packets, there are typically rate limiting systems in place, and other reasons why they would not respond to ping requests.

Pinging DNS servers is a shitty inconclusive test for internet connectivity, or SLA measurements etc etc.

[+] prepend|7 years ago|reply
But a great test for “am I getting out to the net” that’s ok to have a low specificity.

So it is not smart to make a lot of decisions based on “ping 1.1” timing out, it is so quick it’s a good first step in trying to debug a network issue.

[+] emilfihlman|7 years ago|reply
>DNS servers should not be used as "internet connectivity tests" by pinging them.

Not true.

>They are not maintained as ICMP test servers, and that is not their purpose.

Irrelevant.

>While many do not block ICMP packets, there are typically rate limiting systems in place, and other reasons why they would not respond to ping requests.

8.8.8.8 and 1.1.1.1 and all the major ones don't care.

Pinging DNS servers is highly productive and easy. There is nothing bad with using them as internet connectivity tests or SLA measurements.

[+] johnchristopher|7 years ago|reply
So, what should we ping for testing Internet connectivity ?
[+] wahern|7 years ago|reply
Please, for the love of all that is holy, stop blocking ICMP! It's needed for things like Path MTU Discovery. With the increasing use of VPNs and tunnels (IPSec, Wireguard, GRE, etc) PMTUD is more important than ever.

At a minimum, any node on the internet routing or serving traffic needs to keep ICMP open. If you're running a DNS server, ICMP should be working.

[+] Pheide1j|7 years ago|reply
you can just set a lower TTL and get a response from a hop somewhere in your ISP's net.
[+] agumonkey|7 years ago|reply
are there known ICMP test servers ?
[+] miyuru|7 years ago|reply
> If you care about privacy and speed and maximum memorability, I recommend CloudFlare

I disagree with the speed part, because cloudflare doesn't support EDNS. This is great for privacy but not for speed.

Here is proof: https://pastebin.com/raw/QnbWXU1a

If he meant speed in the DNS resolution context, I somewhat agree with him.

[+] userbinator|7 years ago|reply
Surprised that 4.2.2.x (Level3) is not on the list --- it's also unfiltered DNS, and run by a company that focuses only on networking.
[+] Nux|7 years ago|reply
At some point a few years back they started to redirect some of the traffic to some dodgy ad sites, that's when I stopped using them.
[+] becauseiam|7 years ago|reply
4.2.2.2 is supposedly for Level3 customers only.
[+] wtmt|7 years ago|reply
I used OpenDNS long ago, even though it wasn't as easy to remember as the ones that came later. Then I shifted to Google DNS and stayed with it, albeit with some discomfort (even if the policies state it doesn't track, it's still a leap of faith for me). Then last year I switched to Cloudflare DNS and also learned about Quad9 DNS.

I haven't done local benchmarking using a tool like namebench for a long time, and it looks like that tool has not been updated for several years. Any alternatives for it that are cross platform?

[+] jlgaddis|7 years ago|reply
> I haven't done local benchmarking using a tool like namebench for a long time, and it looks like that tool has not been updated for several years.

In fairness, the DNS protocol that it's testing hasn't really changed in that time either. namebench is still sufficient for general testing.

[+] 3xblah|7 years ago|reply
His blog post pays no mention of users whose DNS queries are being redirected. Isn't that a privacy concern?

Hotels and ISPs sometimes set up captive portals that intercept and redirect port 53 to their own choice of DNS servers.

As such, users might want memorise the addresses of some resolvers that listen on non-standard ports (not port 53).

A user behind one of these captive portals who pings any of the resolvers in this blog post will not be pinging those servers; she will be pinging the hotel/ISP's chosen DNS servers and she may be none the wiser.

[+] Tor3|7 years ago|reply
In a hotel I always first thing direct everything through a VPN server (work or home, depending on what I want to do). Some hotels block UDP, in that case I switch the VPN to go via TCP port 443. But some hotels (really!) block port 443.. fortunately not that many anymore.
[+] jcims|7 years ago|reply
Anybody remember 128.146.1.7?
[+] tw1010|7 years ago|reply
Do I have to?
[+] JdeBP|7 years ago|reply
(You are referring to the original title.)

Actually, no. Even if one does accept the premise that one should use these third-party non-contracted services, challenged elsewhere in this very discussion, there's no reason that one need have these things memorized. Written in a handy pocketbook, perhaps. But not necessarily memorized.

[+] sangaya|7 years ago|reply
https://pi-hole.net/ is a project to consider for home and small business networks that you're looking to protect via DNS without sending all your requests to a third party.
[+] snazz|7 years ago|reply
Your requests are still forwarded to a third party with a Pi-hole. They are sometimes cached and sites you have blocked do not resolve, but choosing a DNS provider is still required.
[+] flox25|7 years ago|reply
So the author is a security expert who recommends two companies that are notorious for their security flaws (Norton, Cisco), two companies that track your DNS queries for profiling (Google, Cloudflare) and IBM...

Yeah, this sounds totally legit...