Hacker News Reader

Proprietary tools means passive DNS.

How can one avoid their browsing ending up in the passive DNS logs? For example, is using 1.1.1.1, 8.8.8.8, or 9.9.9.9 (CF, Google, and Quad9, respectively) good or bad in this regard?

For example, where does Spamhaus get their passive DNS data? They write [1] that it comes from "trusted third parties, including hosting companies, enterprises, and ISPs." But that's rather vague. Are CF, Google, and Quad9 some of those "hosting companies, enterprises, and ISPs"?

[1]: https://www.spamhaus.com/resource-center/what-is-passive-dns...

> For example, is using 1.1.1.1, 8.8.8.8, or 9.9.9.9 (CF, Google, and Quad9, respectively) good or bad in this regard?

Just run Unbound locally or if you really don't want your ISP to snoop on your DNS traffic - on some VPS in a datacenter.

I am totally fine with my ISP seeing my DNS traffic (it is bound by GDPR & more; I trust it more than CF or Google). I want to ensure the DNS traffic info does not leave my ISP (other than to other DNS resolvers recursively).

And as per Spamhaus, the DNS traffic in a datacenter may still end up in the Spamhaus passive DNS DB.

Better hope that none of the parties involved have a data-sharing agreement like this: <https://www.farsightsecurity.com/community/data-sharing/>

https://passivedns.mnemonic.no/

Reply on news.ycombinator.com