Hacker News Reader

Comment by lxgr | Hacker News Reader

That's (mostly) great! I personally don't use it, but do appreciate competition in public DNS resolvers and having a high-quality fallback for networks that have a mediocre native resolver.

Maybe this would be a good opportunity to stop truncating EDNS client subnets from requests [1]: It doesn't really help user privacy, but is quite anti-competitive since it can degrade latency needlessly for other (DNS-based) CDNs [2], especially in regions where Cloudflare does not have a POP closer to the user than the other CDN.

[1] https://news.ycombinator.com/item?id=36970702

[2] https://news.ycombinator.com/item?id=36987315

View on HN

What do you use for dns if I may ask?

Generally just my ISPs resolver, since they can eventually see all of my traffic anyway [1] and I don't see the need to have either Google or Cloudflare added in between.

For browsing though, I frequently use iCloud Private Relay, which uses oblivious DNS [2] for name lookups. Cloudflare powers that much of the time too, but at least Apple anonymizes my side of the connection.

[1] At least until ESNI or one of its successors finally become widely supported – then I'll reconsider.

[2] https://www.apple.com/icloud/docs/iCloud_Private_Relay_Overv...

Even after ESNI, they can still see IPs you visit.

Yes, but IPs are more ambiguous than hostnames in many cases.

Also: should I even change my dns? Or let my router/ISP decide?

Some ISPs like to redirect mistyped domains, which may be a reason to avoid using their DNS

Your router will probably let you specify a pair of IPs for DNS (sometimes it's in the DHCP settings)

Generally, no, ISPs provide DNS with generally the best locality of results.

Sometimes it can happen that you get a shit resolution, but it's hard to identify if DNS is the issue in home use since there are so many variables.

However, some ISPs have truly terrible DNS service, for example at my father's house, the first request to any not terribly mainstream website (say outside top 1000 most visited or whatever) always misses the first query while the provider goes look it up on whatever upstream they use. In this case it was really a case of using a different DNS provider that doesn't prune the cache so much or that stalls while querying upstream.

I've had a very poor experience with Comcast/Xfininity's DNS. Anytime I'm managing a network with Comcast as the internet provider, I change the DNS to Google or Cloudflare. Or with pfsense I just use the root DNS servers.

That depends on your ISP. Mine is notoriously bad at maintaining their DNS servers. In the past you'd be online if you had defined your own DNS servers (e.g. using CloudFlares or Googles), but if you used those provided by the ISP you weren't going online that weekend.

Personally I use an experimental DoH service that my employer is working on, and CloudFlare.

My ISP is Verizon, so I changed my DNS settings shortly after my first typo led me to their capture site instead of my browser's page-not-found page.

"It looks like you're trying to find example.com. Here are the advertisers who paid us to talk to you about example.com" grrrr

Wow, yeah, that's a good reason to use something else. Fortunately, no ISP has pulled that on me yet.

I use an adblocking DNS. Slightly better than in browser and works for mobile devices too.

Is there a way to use one of these on iOS on mobile data? I've only seen a DNS override option for Wi-Fi.

Install a configuration profile that configures DNS. This a better way to configure DNS on Apple platforms because it's device-wide, not per-network. These are generally distributed as files named something.mobileconfig. I use one distributed by AdGuard for their public DNS. Just open on an Apple platform and it will offer to install. It's signed, so the OS knows it's from who it says it's from. I have this profile installed on my iPhone, Mac and Apple TV.

https://adguard.com/en/blog/encrypted-dns-ios-14.html

Cool, thank you! Do you know if iOS falls back to the local DNS if necessary, e.g. if a visited Wi-Fi blocks a given DoH?

I don't think there's any automatic fallback, but I'm not sure.

It is possible to quickly toggle on-and-off what the configuration profile sets in Settings. I've occasionally had trouble on captive wi-fi portals, like on planes, but I generally remember it's probably the DoH, so I go toggle it off, get connected, and toggle it back on.

Oh, that’s cool, I assumed I’d have to uninstall the profile in that case so I never gave it a try.

Thanks again!

you can also have a look at nextdns [0][1]. I set it up on both my mac nad iOS. NextDns provides a panel where you can see what got blocked and some other analytics for you. Even though I use Brave on iOS and Arc with uBlock Origin still that wasn't enough and nexDNS blocked some additional ~8% trackers. It's free for first 300k requests per month.

[0] https://nextdns.io/

[1] https://github.com/nextdns

Reply on news.ycombinator.com