Hacker News Reader

Comment by nobody9999 | Hacker News Reader

>I traced the issue back to changing my Pi-Hole upstream DNS to Cloudflare few days earlier. Switching to another DNS provider fixed the issue right away.

Since you're already using a pi-hole, why not just roll your own recursive DNS server.

The additional network traffic to do so is insignificant.

That way, you don't have to rely on someone else to resolve your DNS queries -- or deal with spats like that.

I've been meaning to do so for a while, but life has interrupted. As I'm going through an ISP change ATM, I will do so soon.

And I won't ever look back.

Edit: Since your post got me thinking about it, I just now went ahead and set up my recursive resolver and pointed my pi-hole at it. Took about 10 minutes on an existing VM.

View on HN

I use Pi-Hole + Unbound forwarding to Cloudflare/Quad9 over TLS.

It would be nice if all servers supported DoT/DoH + DNSSEC and you could roll your own recursive DNS server and have more trust in traffic not being intercepted.

Post-Snowden revelations I feel pretty confident that DNS requests in the clear are being surveilled. I don't know for sure that requests to Cloudflare or Quad9 are being surveilled.

>It would be nice if all servers supported DoT/DoH + DNSSEC and you could roll your own recursive DNS server and have more trust in traffic not being intercepted.

I love DNSSEC, but am not in favor of DoH/DoT. Mostly because I can't control DoH/DoT requests emanating from my network, as they're already encrypted and can't be differentiated from standard HTTPS traffic.

That's an issue (and will become a much bigger one as time passes) because vendors can use DoH/DoT to bypass local DNS controls like Pi-Hole, and short of blocking TCP/443, there's nothing you can do about it. Which is, IMNSHO, a big reason why DoT/DoH was developed.

>Post-Snowden revelations I feel pretty confident that DNS requests in the clear are being surveilled. I don't know for sure that requests to Cloudflare or Quad9 are being surveilled.

Your ISP can surveil whatever they want and there isn't much you can do about it unless you use a VPN.

I don't think my ISP can easily intercept the content of DoT DNS requests.

They would need a valid certificate for 1.1.1.1#cloudflare-dns.com or 9.9.9.9#dns.quad9.net from a trusted (by me) CA, correct?

Now obviously that's not impossible but is a VPN any better in that scenario?

>I don't think my ISP can easily intercept the content of DoT DNS requests.

No. But they can intercept connections to the IP addresses returned by such DNS queries.

>They would need a valid certificate for 1.1.1.1#cloudflare-dns.com or 9.9.9.9#dns.quad9.net from a trusted (by me) CA, correct?

In order to MiTM such requests, yes.

>Now obviously that's not impossible but is a VPN any better in that scenario?

You're only considering the DNS queries. Once you've received a response to your DoT/DoH query, presumably you'll want to connect to the returned IP address, right?

Your ISP can absolutely capture those packets, and even if the payload is encrypted, the headers are not -- so while they might not be able to access the data, they have full access to the metadata. Unless you use a VPN, which will encapsulate the headers as well.

All that said, my issue is with DoH/DoT, since devices can stealthily bypass my DNS controls (including ad/telemetry blockers like Pi-Hole) and unless I block all TLS/HTTPS traffic (making my internet link mostly useless), I can't stop surreptitious connectivity.

I'm not as concerned with my ISP as I am with not being able to block ads/tracking/telemetry. Apologies if I wasn't clear about that.

You can use eero secure+, which will intercept dns requests at the gateway to prevent devices and apps from bypassing the set dns servers. I won't work for apps which hardcore their own DoH/DoT clients and use their own servers, however.

>You can use eero secure+, which will intercept dns requests at the gateway to prevent devices and apps from bypassing the set dns servers.

I'm not familiar with eero secure+, but why would I want to pay for something like that, when a single firewall egress[0] rule can block outbound DNS requests that come from sources other than the "set dns servers"?

Note that I'm not trying to denigrate eero secure+, I don't know anything about it except that it's some sort of cloud-based (read: someone else's servers) security application.

I'm merely pointing out that limiting outbound DNS requests to specific hosts is trivial.

[0] https://en.wikipedia.org/wiki/Egress_filtering

Post-Snowden, the lesson is the NSA is doing their damnedest to watch American's activities online. I would bet money that they're doinf everything they can to watch Cloudflare, despite no direct evidence, because of course they are.

If you can't control where your device is making DNS requests then it's not your device. It's the manufacturer's surveillance capitalist revenue generator.

We need more devices that actually respect the user.

Eh, not the GP but I had tried that and switched back to 1.1.1.1 with hosts rules for specific sites to fallback to 8.8.8.8.

Running my own DNS just proved to be too much of a troubleshooting headache, since if a site was broken it was one additional step. The pihole itself has been almost no trouble, but the diy DNS would occasionally fail to resolve a site. If I'm at home, the last thing I really want to do in the evening is troubleshoot network issues.

It was a fun project to setup, and I did learn more than I expected I would. I can recommend it as a weekend project, but not as a long-term solution.

>Running my own DNS just proved to be too much of a troubleshooting headache, since if a site was broken it was one additional step. The pihole itself has been almost no trouble, but the diy DNS would occasionally fail to resolve a site. If I'm at home, the last thing I really want to do in the evening is troubleshoot network issues.

A fair point.

That said, note the edit on the comment to which you replied.

I've been running my own authoritative DNS for (personal) domains I own for 15 years or so and have spent very little time managing that. I also run my own internal DNS servers (hybrid BIND/AD DNS) without issue.

As such, I don't expect to have many issues with a simple recursive resolver.

That said, I understand your point of view and know that managing DNS isn't for everyone.

However, I'd rather perform my own DNS lookups rather than relying on my ISP(s), Google or Cloudflare. Yes, my ISP could capture every single recursive query, but I'd rather have them do that than just log every DNS query I make.

No, it doesn't significantly add to my privacy, but (IMHO) it's better than the alternative.

I also run my own DNS servers, both internal caching resolvers and external authoritative, and and have done so since 1996. I run BIND. It takes almost zero maintenance. DNS is one of the easiest services to operate.

Reply on news.ycombinator.com