Ask HN: Which DNS service do you use for your computer's network settings? | Hacker News Reader

Ask HN: Which DNS service do you use for your computer's network settings?

53 pointstikkun112 comments

And, do you recommend it?

I saw a comment recommending Mullvad's. I currently use the default DNS (my ISP's default).

Devices -> Pi-Hole -> Unbound -> DnsCrypt

Some additional details:

- Outbound internet access over port 53 is blocked for everything on the network, other than the Pi-Hole/Unbound server

- IpTables rule in place to force all outbound traffic over port 53 to go thru the Pi-Hole. This prevents devices from circumventing the Pi-Hole filtering by hard-coding public DNS servers

- Cronjob that polls http://public-dns.info/nameservers-all.txt regularly, and updates an IpTables rule to block all outbound internet traffic over any port/protocol to servers in that list. This is my attempt to block things that try to circumvent DNS filtering by doing DNS over HTTPS

- Unbound makes it possible to bypass DnsCrypt for specific zones, as needed. It also is configured to prefetch records before expiration, which generally eliminates the latency introduced by DnsCrypt

---

This is overkill, but I tried to address privacy concerns as well as ad-blocking with this setup, and it's also been fun to tinker with

Do you log what attempts to talk on 53 (that you redirect) with hardcoded dns entries?

Yes, the re-writes are done on a ubiquiti edge router. The re-write rules count the number of hits, as well as basic connection details like src port/addess, dst port/address, protocol. The biggest offender is the roku, which tries to use 8.8.8.8

edit: to be honest though, I don't look at the logs often to see what else gets caught, or why

The assumption here is that you “control” the router which runs Linux (iptables) and my guess is dnscrypt and inbound. What kind of HW are you using?

- ubiquiti edge router x from ~2019.. there's a bash script on the box for updating the blocklist, the rest of the configuration can be done in the GUI

- pihole and unbound are running in a VM on an old intel NUC with an i5 and 18GB of RAM. The NUC is running Proxmox, and is connected to the edgerouter over ethernet

- Separately, there's a ubiquiti WAP and a standalone modem, but there's nothing special about their configuration

Sad that in 2023 Ubiquiti's Unifi line does not support IP tables redirect of *:53 to 192.168.x.x for DNS.

Their older stuff did not really supported it as well..

you could do it, but just because the USG software was a fork of Vyatta that had a way for doing it and Ubiquiti never put the effort to block it..

So while there was a way of doing it, it was never really officially supported..

But this is why when it came time to upgrade my USG3 i choose to migrate to Opnsense (pfsense fork) instead of upgrading to the latest Ubiquiti router.

Which device are you running? And how are you doing WiFi?

US-8-150W, US-16-150W and US-FLEX-Mini for switches

UAP-AC-Lite for APs.

Dell PowerEdge R420 with proxmox hosting Opnsense as router, AdGuard Home for DNS, Unifi Controller hosted on Ubuntu and Home Assistant.

I use unbound on a local machine to server my entire LAN, but there is one giant thing to understand about it. It will massively speed up cached queries in a way you won't get with any internet accessible resolver.

BUT, it will slow down everything else simply because its another layer in the lookup cake. Which doesn't sound bad since everything will end up cached, until you notice all the cool people have decided that DNS forms part of their load/failover scheme and have set the TTL to just a few seconds, which effectively either keeps unbound constantly fetching those addresses to keep them fresh, or you pay the unbound overhead penalty all the time on your local machines. And yes, unbound can be configured to ignore TTL's below a certain value, but that has its own problems.

So, yes, run your own resolver, just be aware that it has tradeoffs. One of the big pluses is that you can configure it do to DOH/etc and then serve everything on your network unencrypted DNS that has been previously validated/etc.

In the case of short TTLs, shouldn't you just pay the penalty for a single lookup, the apex domain with the short TTL? It should remember who the authoritative nameserver for that is, because the intermediate parts should have a more reasonable TTL.

~Once a year, I run DNS Benchmark by Gibson Research https://www.grc.com/dns/benchmark.htm and do a local performance benchmark and use the results to pick a top 3 which usually ends up to be a mix of my upstream Internet provider, Cloudflare and/or OpenDNS

Same, I keep meaning to run under wine again as I don’t have a windows box for this anymore. For a long time I’ve used cloudflare but my ISP (Detroit) had a persistent routing issue to ORD so my dns queries were always failing. On Level3 now as they are the quickest near me.

Surprised to see any links to a site run by a charlatan like Gibson here on HN.

I've used the linked tool (on Windows) and it worked fine. I guess from your comment there's some drama I'm not aware of. Can you elaborate what's wrong with it and what alternative you'd recommend?

Not talking about the tool you referenced specifically, but Steve Gibson of GRC is known to be a charlatan, making claims that are easily disproven (he was the guy screaming the world would end when XP included raw sockets) and sometimes selling software based on false claims, like his SpinRite software.

Sounds like you don't know what SpinRite is for/does

Or that you haven't ever actually listened to him

I've been listening to him for far too long, and joining in others to warn people off him.

But hey, you want to cheerlead for him with his track record, go right ahead.

LOL

Ok - I've listened to him off and on for about a decade

If you want to be upset over him ... go ahead

I guess the issue here is you don't have enough knowledge to understand why he's a charlatan.

And that's fine, many don't. Which is why it's important those of us that do continue to speak up.

Take care.

How many mistakes/bad predictions does it take to make someone a charlatan in your opinion?

Gibson didn't just make a few mistakes. He consistently made ignorant and false claims to sell software and boost his own profile, which apparently worked on quite a few gullible people.

You really have it out for this guy, don't you?

Let it go

Buddy you just replied to every single comment I made in this thread to other people.

I don't really have it out for this guy, I'm just pointing out that he is a charlatan.

You seem to be really offended by that and are cheerleading for him even harder. Bizarre. I'm sorry the truth hurts you so.

>You seem to be really offended by that and are cheerleading for him even harder. Bizarre. I'm sorry the truth hurts you so.

Hahahaha

Well, "buddy", you seem to have it out for someone with zero evidence you can provide for why you are upset beyond, "if you know, you know"

That is not a reason, it is a claim to secret knowledge

Which...since you will not share, we have to assume does not exist

You're too lazy to google yourself lol.

You're really one of those 'need to have the last word' types, huh.

Well, it's all yours. I have no more time to debate you than a Taylor Swift fan pissed off at me because I said one of her songs wasn't great.

Guess you can't let people correct their mistakes

That's fine - if you want to hold a grudge irrationally... you do you

Not holding a grudge irrationally, and when people tell you you make mistakes or you're full of BS and you double down on your claims to make money, that's malice, not incompetence.

Honestly, I find it hilarious you are defending this guy. He must have a real comforting voice or something.

> I guess the issue here is you don't have enough knowledge to understand why he's a charlatan.

Enlighten us, then, oh wise one!

What "knowledge" do you think I do not have that you somehow secretly do?

You seem to lack at a minimum decent security knowledge, perhaps even basic IT knowledge outside of using a browser on windows.

Ahh, so instead of providing actual sources and data, you prefer to impugn my decades of experience based on your magic knowledge?

Cool

You are a mind reader!

SO glad you came out to tell me I do not know what I have been doing for years on end!

From your comment history, when you comment on anything technical, you seem to be downvoted and not really know what you're talking about.

There are lots of people in IT. It's a low barrier to entry. Plenty of people are like you and think they know what they are talking about while even managing to get paid for it.

Congratulations!

LOL

Apparently you never read my comment history ... or went through and downvoted me out spite

Keep your secret knowledge to yourself if you want - since you seem so averse to sharing why you think something

>known to be a charlatan, making claims that are easily disproven

Such as ...?

Read the thread buddy. Not repeating claims just so you can keep this argument going on yet another front.

You've yet to source anything

But keep thinking you have

There is a small vocal cult of secbros on HN and Reddit that have some kind of beef with Gibson because he gets things wrong once in a while and make predictions that don't pan out. You know, like literally all of us.

And also he sells ONE product that in 2023 has admittedly dubious value (SpinRite), and I will also admit that the website oversells it quite a bit. But all of the complaints I've seen about it basically boil down to those people not really understanding what it's for or what it does. It's not for "undeleting" data, it's not for fixing your broken filesystem, it can't recover data off a disk with a bullet-hole in it. It only works on spinning rust with _some_ bad physical sectors, if the damage is not severe enough that the data can't be recovered with many, many, repeat readings.

I listened to his podcast Security Now for the better part of a decade while commuting and found that he really enjoys getting to the root of whatever he's talking about and _usually_ (not always) does a pretty good job of explaining complex technical subjects verbally. He has always come across as quite humble to me, and _every_ episode began with a list of corrections from the previous episode. When he does make mistakes, at least he admits them.

lol, it's not a small vocal cult, what a bizarre description. It's simple people in the know who can recognize a charlatan and call him out as such.

Maybe you are not old enough to remember or be aware of how ridiculous he used to be. He's been pretty quiet the last decade, likely due to getting batted down every time he would pop up with some nonsense.

Not sure what you mean by pretty quiet, his podcast is still going strong and is quite popular. I don't know what your personal grudge against him is, but it doesn't sound like it's doing you any good.

His podcast is but a blip in a giant sea of podcasts, and only listened to by people who don't know enough to know how little he knows.

No personal grudge, just the advantage of experience. I'm hardly alone in holding this view. If you did some research, and listened to some actual security podcasts, you might learn a little bit more regarding all this.

>No personal grudge, just the advantage of experience. I'm hardly alone in holding this view. If you did some research, and listened to some actual security podcasts, you might learn a little bit more regarding all this.

Such as... what? Who do you think knows more than he does and/or what has he said that is incorrect?

You don't need to ask the same question 3 different times in reply to my comments to other people. What's wrong with you? Just keep it to one thread. Jesus.

This is the third dubious comment you’ve made so I’ll ask you directly (once again) to explain why you feel that way.

I haven't made a single dubious comment. I'm kind of tired of pointing out the truth with all these, I assume gen z kids, who don't know any better and think he's worth listening to. Just do some googling and read up on his history, see what actual security experts think of him.

But hey, you do you.

And here I was, a random passerby to your argument, hoping for you to finally tell what's wrong with Gibson Research, yet I only heard a lot of moaning with no substance.

From outside, it looks like you have a grudge against them, but brought no actual reason. Thanks for your input I guess.

Before you shut me down as well, I learned of Gibson Research in this very thread. I'm no paid actor.

I actually did point out two examples of the issues, so no, it's not just moaning, I'm just not interested in getting in to a debate with his cheerleaders.

I also suggested people can google if they want to learn more.

Next time you're a random passerby to an argument you see me involved in, please just keep passing by.

I am another passerby, and you just look like a childish prick who for some reason really doesn't like a guy making software. We have learn nothing else from you, so it is hard to give you the benefit of the doubt. From my experience you are probably a narcissist who insist on his opinions being the truth without having the burden of proof. Your tentative order is a pretty good tell.

Thanks for violating the HN guidelines to pass on your emotional insult. Hope you found it satisfying and that it made up for whatever you needed it to.

This guy's definitely got some kind of [apparently] irrational grudge going on against Gibson

Can't elaborate on anything except some kind of claimed secret knowledge that the rest of us plebes must obviously not have

Sad, really

Your obsession with someone calling out one of your favorite podcasters, that you need to be so defensive, is honestly bizarre.

Stop.

LOL

He's not a "favorite podcaster"

But nice try at casting aspersions instead of answering the question

Devices -> Pi-Hole -> Unbound (running on Pi). My phone is connected to Pi-Hole via Wireguard, so it gets to take advantage of the ad-blocking as well.

Yes, I would recommend it. Running Unbound means you don't have to trust anyone's upstream DNS servers. Disadvantage is maybe slightly slower resolution, as you don't get to take advantage of the upstream server's caching.

Why don't you add an hosts blacklist to Unbound, thus removing the need for the Pi-Hole - which is mostly dnsmasq with same blacklists ?

https://wiki.alpinelinux.org/wiki/Using_Unbound_as_an_Ad-blo...

Because it has a nice UI, shows me what devices are making what DNS requests and which are being blocked, and is easy to add individual exceptions or disable entirely temporarily if something goes wrong.

They still need something to run Unbound+Wireguard on, what's the benefit of removing the PiHole software from the setup?

One less hop on the DNS resolution chain.

Unbound DNS on my firewall in one of two modes. 99% of the time Unbound talks directly to the root servers and has multiple caches for records and infrastructure information. Defcon 4 or 5. I also keep several of my own DoT servers on the internet commented out in my configuration if I need to switch to local defense condition level 3. Those DoT servers then talk directly to the root servers and also cache all the things. Becomes redundant at dc1/2 as Tinc VPN's are used. I also have scripts to build Unbound zone overrides to act as /etc/hosts for some domains.

Been really happy with NextDNS for my family.

Yep, I’ve also used NextDNS for several years.

I run an overkill system - a dnsdist instance provides clients on my network with DoH and standard port 53 resolution. Dnsdist forwards to a PowerDNS recursor for resolving internet hosts with root hints. Additionally, the recursor uses a custom Lua script with a Redis backend for firewalling against requests, responses, and nameservers encountered during iteration, and then all traffic is logged through protobuf interfaces with automated analysis that tell's me nothing I don't know since I live alone and baseline everything.

All outbound port 53 TCP/UDP is also forwarded at the firewall through this setup.

My PiHole resolves off to Quad9 and Cloudflare.

Never had any problems with either - I have both selected in case one has issues so that I don't need to immediately deal with "Daaaad the internet's not working!"

Google: 8.8.8.8 and 8.8.4.4. Fast. Problem free. Would recommend to anyone.

Why hand over your browsing data to Google?

I use Google DNS because it’s fast and reliable, and close to me. I’m not sure what else I’d use that’s more trustworthy. Certainly my ISP isn’t.

Their DNS privacy policy seems acceptable to me, as they’re not using it for ad data: https://developers.google.com/speed/public-dns/privacy

Google obviously has many concerns, but they’re trustworthy enough to follow their own privacy policy lest they get smited by governments.

You give data away, true, but I wouldn’t say DNS lookups == browsing data.

Example: They can see that I have visited Wikipedia, but not what articles I’ve read. (Other sites will leak more info due to the nature of their subdomains, but it doesn’t bother me personally.)

you're not wrong about the articles, but at the same time just looking at a domain is enough to allow for decent guesses to be made.

lots of hits on hackernews and jsoneditoronline.org and I can say with a reasonable degree of certainty that you're in IT or Dev. gonna start sending you ads that reflect that.

likewise, hits to missile-gayboy.jp -- a site that used to be hosted by my old employers -- also sends some pretty clear messages. I don't need to know what you're looking at specifically there but it's a japanese site that caters to a specific niche; I can sure make some assumptions.

hell, at work we don't even collect a lot of specifics on our endpoints -- domain queries are often enough to catch bad behavior

I trust Google more than I do my ISP or third-party DNS provider (I also use Chrome and Google's VPN). Google may use my activity data for their own purposes (which I'm OK with because I find their products very useful), but they will not sell my data and have demonstrated themselves to be resistant to government requests.

Quad9, Mullvad. Why not?

One problem I've unfortunately run into with alternative DNS providers is that Akamai apparently also uses DNS to steer you to the right part of their CDN, and that the "default" set of servers returned by alternativ DNS providers apparently has abysmal peering with my ISP (not just slightly slower, but positively unusable during peak hours in the evening).

In theory EDNS Client Subnet (ECS) is supposed to work around this problem, but a) according to https://www.cdnplanet.com/blog/which-cdns-support-edns-clien... Akamai only supports this with Google and OpenDNS and b) alternative DNS providers might not support ECS anyway, whether explicitly for privacy reasons or otherwise…

Which means I'd basically have to set up a custom DNS resolver in order to special-case queries for anything hosted on Akamai's CDN…

Both static addressed devices and DHCP devices point to my internal AdGuard home server.

Both my AdGuard server and the unbound in my Opnsense router use Quad9 over DoT

AdGuard Home Server also point to Opnsense unbound to resolve local addresses

All port 53 traffic not directed at my AdGuard is redirected to it. All port 53 traffic not to or from my adguard or opnsense is blocked.

All DoT and DoH traffic not to or from my AdGuard or Opnsense is blocked.

I also have a second AdGuard Home instance hosted in a VPS that i use for my mobile devices when outside my home network. I use a whitelist of ClientIDs so only my devices can use this server, weak authentication but it has worked so far.

My home network is configured so that my devices will be redirected to my internal AdGuard server when at my home network and so they will use my public AdGuard server automaticaly when they are anywhere else.

My firefox, edge and chrome at my laptops have a similar configuration using their own DoT/DoH resolver. For the OS i let it use whatever the DNS from the local network.

In the near future i plan on replacing the Quad9 with my own recursive server hosted in the same VPS.

Cloudflare 1.1.1.1 backed up by Google's 8.8.8.8.

This way, if I ever forget my browsing history, I can ask either company to remind me ;)

Seriously though, they're both fast (especially Cloudflare) and reliable, and won't do DNS injection attacks like local ISPs do. Not really concerned about the privacy angle since I already use Chrome and Google Searched logged in.

NextDNS with either their app to set an DoH profile on devices or DHCP giving out their specific IPs for my config.

I use PowerDNS's dnsdist[1] which forwards to a blocky[2] server which then resolves from a local PowerDNS recursor. dnsdist is there mainly to provide a fallback if the local server is unavailable so I don't lose complete functionality.

I would generally recommend using anything other than your ISP's DNS servers.

AdGuard has a pretty good list of available providers: https://adguard-dns.io/kb/general/dns-providers/

[1] https://dnsdist.org/ [2] https://0xerr0r.github.io/blocky/

Coming in a bit late, I'm surprised I haven't seen anyone mention that if you run your own recursive dns server you can now have it download a copy of the DNS root zone (following RFC8806) if you are so inclined.

See https://localroot.isi.edu/about/ for one site that will let you register to receive a DNS Notify when the root zone changes.

I think the answer might depend on your ISP and where you are based in the world

In the EU/aligned countries, selling your data and injecting shit into DNS is very much a frowned on thing. More over, as there is competition, you can migrate away to some other ISP that isn't shit.

I currently use my ISP's DNS as an upstream, as they are reliably, fast and not shit. I'm temtped by adding a pi-hole. But I've not fully tested it yet, and I'm reluctant to migrate away from pfsense's DNS, as I have lots of local hosts that need resolving.

I'm using NextDNS, it's like having a cloud based PiHole with no hassle, more reliable, plus parental controls, network tracking, etc.

I use the one from my ISP, unless they're having issues (hardly ever happens). The reason for this, is that in my country, my ISP is tied to strict regulations on (for example) resale of data. Switching to another DNS provider opens me up to all kinds of shenanigans that my ISP would be held responsible for.

This is the same reason I don't use a VPN by default at home.

In this order...

- Google 8.8.8.8

- Cloudflare 1.1.1.1

Why this and in this order?

Better than my ISP’s; and the order isn’t that important to me. I’d be fine switching them.

I use PrivateInternetAccess as an always-on VPN and use their DNS servers. I also use AdGuard which is working great (a lot of people here are commenting on Pi-hole which you don't specifically ask about, so thought I'd share this as well).

Anyone have issues with PIA's dns?

Pihole to 1.1.1.1 and 9.9.9.9.

I'm in the process of taking control of my network again, after having a more laissez-faire attitude towards network access. I'll probably install something like opensense on top of my edgerouter.

What is "default DNS"?

I use Quad9 (9.9.9.9) and Freenom (80.80.80.80)

Added to OP: default DNS -> my ISP's default DNS.

NextDNS on the router, and DNS-over-HTTPS for all the devices that supports it so that the configuration applies to them even outside of the home network.

Unbound locally and forwarding to NextDNS for filtering

NextDNS on all devices and the router (Draytek) too.

I use level3, since it seems very fast:

4.2.2.2

4.2.2.3

Lumen Technologies

They are rate-limited for non-customers.

NextDNS

devices -> AdGuard Home -> NextDNS,

And devices -> NextDNS as a fallback.

I see a lot of mentions for Pi-Hole, which is more or less the same thing as AdGuard Home. I just like AdGuard Home a little bit more:

- single binary go app

- easy to run in nonroot container (Pi-Hole only started supporting this last year)

- Native support for DoH upstream resolver

- YAML as configuration language with good versioning scheme and skew practices.

All these people that are using pi-hole + unbound should switch to Adguard because it natively supports DNS-over-HTTPS, DNS-over-TLS, and DNS-over-QUIC

I use https://www.opennic.org

I use dnscrypt-proxy in the default configuration and let it choose what's best for my current network.

One reason why I choose to use dnscrypt-proxy too.

@jedisct1, it would be great if there was an option to default to a ODoH/anonymized DNS setup mostly out the box.

I use unbound, with a bunch of local IP/hostnames, then forward to mullavad dns for adblock.

NextDNS (and Quad9 and Cloudflare often as backups). I run NextDNS on my phone as well.

I proxy my ISP's DNS on my main server and all of my other machines use my proxy.

What's the point in doing so? Just use ISP's DNS directly.

I use a DNS (over HTTPS) that allows me to spoof my geolocation for specific services.

Running my own doh-proxy, so I use it for my android phone, and firefox browser.

I use DNSCrypt which alternates between a list of anonymous DNS servers.

127.0.0.1

Really, installing Unbound is piece of cake both on Windows and Linux.

Maybe for a network expert. I briefly tried to setup unbound and immediately got blocked by the installation documentation which assumed too much background info. I quit after I managed to break my internet. In the event of a failure, I would struggle to troubleshoot things.

Probably asking too much, but I want to ‘apt install unbound-quickstart’ and know sane defaults are configured. If anything goes wrong, I can delete a single config file or uninstall the package to go back to system defaults.

> Maybe for a network expert

I'm literally just did this:

    dnf install unbound
    systemctl enable --now unbound
    nmtui (because I'm lazy) to point DNS to 127.0.0.1

After reboot (again I'm lazy) I got:

    $ dig news.ycombinator.com

    ; <<>> DiG 9.16.23-RH <<>> news.ycombinator.com
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29106
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 1232
    ;; QUESTION SECTION:
    ;news.ycombinator.com.          IN      A

    ;; ANSWER SECTION:
    news.ycombinator.com.   1       IN      A       209.216.230.240

    ;; Query time: 74 msec
    ;; SERVER: 127.0.0.1#53(127.0.0.1)
    ;; WHEN: Tue Oct 24 16:07:11 GMT 2023
    ;; MSG SIZE  rcvd: 65

I think you... just misunderstood something years ago. You don't need 'quickstart' for this

On Windows it's the same - download package, install it, configure 127.0.0.1 as primary DNS

The one the my DHCP gives me, that is my ISP's

Full recursive DNS, that is, unbound.

Run your own.

It's not hard. It uses minimal resources. It can be enhanced with ad-block lists similar to pi-hole so your whole network benefits.

I run Bind at home.

quad9 -- 9.9.9.9

Reply on news.ycombinator.com