Hacker News Reader

Comment by minxomat | Hacker News Reader

The worst side effect of how my ISP implements this is the failure mode for DNS queries. Instead of returning an error code, they actually return a marketing page. That page contains a fake search engine, with results. If you look at the "results", they are all ads for the ISP I'm already on...

View on HN

In a just America, people who do this would be jailed. To add insult, the majority of my DNS lookups are not for hosts I'll contact via port 80 or 443, so even in some twisted universe where I wanted their ads, their lying doesn't help me.

apt-get install unbound && echo nameserver 127.0.0.1 > /etc/resolv.conf

I'm sure you have 500 kB free RAM for a proper resolver that works in the real world, and validates DNSSEC for free. I think most resolving should be done locally nowadays. Latency is mostly a last mile problem.

Wouldn't unbound's requests out to the net get caught by this proxying?

I'd guess not since unbound does its own recursion. DNSSEC doesn't play well with nxdomain trickery so customers gets unhappy and that's something even shady ISPs avoid.

You could switch to using GoogleDNS or OpenDNS.

If you prefer something more privacy oriented, but possibly not as fast:

  https://servers.opennicproject.org/
  84.200.69.80      # dns.watch
  84.200.70.40      # dns.watch
  37.235.1.174      # freedns.zone
  37.235.1.177      # freedns.zone
  213.73.91.35      # dnscache.berlin.ccc.de
  194.150.168.168   # dns.as250.net; Berlin/Frankfurt
  85.214.20.141     # FoeBud (digitalcourage.de)
  77.109.148.136    # privacyfoundation.ch
  77.109.148.137    # privacyfoundation.ch
  91.239.100.100    # anycast.censurfridns.dk
  89.233.43.71      # ns1.censurfridns.dk
  204.152.184.76    # f.6to4-servers.net, ISC, USA

Edit: I know this won't do anything for ISPs using transparent proxies (from the article: "Some ISP's").

This is just for people with shitty, but not as shitty ISPs. Such as ones that hijack NXDOMAIN: https://en.wikipedia.org/wiki/DNS_hijacking#Manipulation_by_...

Edit2: I couldn't get the test from dnsleaktest.com to work on my computer, but starting at step 3 from [0] seems to work fine (I do already use DNSCrypt with Unbound).

[0] https://www.smartydns.com/support/isp-doing-transparent-dns-...

You can't switch your DNS with transparent proxies. That's the whole point of this post. Even if you change your DNS server, your queries to that server are intercepted by your ISP.

You can pay for a VPN service that does not transparently proxy DNS and tunnel either DNS requests or DNS requests + other data through it to the DNS servers you are actually intending to use.

... which doesn't do anything if DNS is transparently intercepted, as discussed in the article.

You should read the article

I used to wonder where those marketing pages came from, I had assumed it was a rogue browser extension. Now that I think about it... it must've been DNS!

Reply on news.ycombinator.com