Hacker News Reader

Comment by philsnow | Hacker News Reader

This has bitten me before; now my pihole has this line in its dnsmasq configuration

      server=/archive.is/archive.ph/8.8.8.8

so that even if I'm using cloudflare dns for everything else, it will query 8.8.8.8 for those two domains

View on HN

Gonna go out on a limb and agree with the archive.is owner -- the reason he blocks it is bc cloudflare intentionally doesn't support edns client subnet. They cite privacy reasons, but it comes at the at the cost of performance -- most cdns use DNS based routing, so using cloudflare DNS means you connect to random server for a lot of websites. CloudFlare on the other hand uses anycast routing for their CDN, so they don't suffer at all.

I hate Google but my pihole is configured to use their DNS resolvers. Lesser of two evils.

It shouldn't be that bad, CloudFlare's anycast should direct you to a nearby resolver, and doing your GeoDNS on that resolver IP instead of ECS is probably not that much worse than doing it on the actual client IP. Both approaches aren't great at picking an ideal CDN node, GeoIP is notoriously unreliable, and it tells you nothing about network topology.

Breaking DNS entirely is much worse behaviour, especially because GeoDNS itself is arguably not in the spirit of DNS which is distributing a consistent database, not making it up on the fly based on the client's info. The archive.is admin is being ridiculous, the least they could do is block anyone not using a resolver supporting ECS to be consistent, but no they have something personal against Cloudflare.

This hack needs to be pinned to the front of HN :)

Seriously. I’ve been hitting this for months.

Reply on news.ycombinator.com