Hacker News Reader

Comment by pants2 | Hacker News Reader

Don't use your ISP's default DNS because they will mess with stuff. You should probably just set your DNS servers on your device because you probably don't want to use whatever random DNS you get from public WiFis either. I like to use Quad9 for DNS because it's independent and has some privacy/security features.

View on HN

Also lobotomize their equipment into passthrough and use real equipment. I have that same router on AT&T fiber and just pass-through to Ubiquiti gear. For DNS it's all NextDNS. Or for another step, DNSFilter.

This is a great idea. Apparently some people have reverse-engineered the network authentication to allow you to bypass the AT&T modem, but it looks pretty hairy.

You can't configure DNS at the modem for AT&T fiber, which is the annoying thing. The setting is there, you can read it - but you can't modify it. I have no idea who is responsible for configuring it, either during install or at the factory. So if you don't want AT&T's garbage, you need to configure it on every device and/or at the router (and don't use their built in router).

Thing is, with DNS, the ISP can just intercept your DNS requests anyway. Turn on DoH imo

If you really care, run your own DNS locally. Not all devices/applications support DoH.

Running your own doesn't prevent interception for most domains.

You can run a DoH-to-regular-DNS bridging resolver locally.

My router supports that out of the box, but unfortunately it's somewhat unreliable compared to regular UDP resolution and I had to turn it back off.

It more or less does if your local DNS is just presenting DoH as normal DNS to every device on your LAN, since most devices let you configure DNS per network (even smart TVs, which is nice) but may not have any option for DoH. But at some point you have to trust someone.

> It more or less does if your local DNS is just presenting DoH as normal DNS to every device on your LAN

That's more of a proxy than running my own.

> But at some point you have to trust someone.

If I do my own recursive queries from multiple networks, I don't really have to trust anyone. (I mean, that's still trusting authoritative servers, but arguably they're correct by definition.)

Though I could also ask multiple diverse DoH servers to get a similar effect.

For any domains really.

Your best bet is something like Dnscrypt or DoH that exposes a resolver locally on your full network.

using DoH or DoT just shifts who you have to trust, from your ISP to another company, quite possibly one with a greater interest in selling your data or being mass-surveilled.

To use DNS whatsoever you have to at least trust the DNS host, though. There is no such thing as perfect trust on the internet.

It's quite insane that this tampering is allowed in the first place. We'd still be moving towards a more encrypted-by-default future, but there would be fewer meddling middleboxes that threaten less knowledgeable users.

For anyone that needs this (copy pasted from a comment 2 weeks ago)

Your DNS can also do things like block malware, adult content, trackers, social media, or other things. Here's info about cloudflare and mullvad.

  # Cloudflare
  ## Standard
  1.1.1.1
  1.0.0.1
  2606:4700:4700::1111
  2606:4700:4700::1001

  ## Block Malware
  1.1.1.2
  1.0.0.2
  2606:4700:4700::1112
  2606:4700:4700::1002

  ## Block Malware & Adult Content (not useful for this case)
  1.1.1.3
  1.0.0.3
  2606:4700:4700::1113
  2606:4700:4700::1003

You can find cloudflare information here[0], and remember to make sure you setup DNS over DoT (TLS) or DoH (HTTPS). Especially for them they will want to have encrypted DNS.

Mullvad also offers free DNS[1], which also supports encrypted DNS

  # Mullvad
  ## DoH is port 443 and DoT is port 853
  ## Standard
  dns.mullvad.net
  194.242.2.2
  2a07:e340::2

  ## Block Trackers
  adblock.dns.mullvad.net
  194.242.2.3
  2a07:e340::3

  ## Block Trackers + Malware
  base.dns.mullvad.net
  194.242.2.4
  2a07:e340::4

Mullvad also has block for Adult + gambling and social media (so there are 6 total configurations). You don't need the Mullvad VPN to use these.

I should also mention, as this frustrated me a bit, that your browser may implement its own DNS and so just setting these in your router (or pihole) may not completely resolve the issue. In Firefox, go to Settings > Privacy & Security > (scroll all the way down) Enable DNS over HTTPS using > then under either "Increased Protection" or "Max Protection" you can set a DNS resolver (or turn it off). They have defaults for Cloudflare (default!) and NextDNS. While you're there, also check your settings at the top of that page about "Enhanced Tracking Protection"

I am NOT a network/security person and would greatly appreciate replies to this comment with additional information. Especially about setting up things like piholes, TVs, browsers, encrypted DNS (especially this!), host files, and so on.

[0] - https://developers.cloudflare.com/1.1.1.1/ip-addresses/ - https://developers.cloudflare.com/1.1.1.1/setup/#dns-over-ht...

[1] https://mullvad.net/en/help/dns-over-https-and-dns-over-tls

It's probably also worth checking your ping to these servers. For me, Cloudflare and Quad9 are around 10ms, while Mullvad is around 40ms, so I take that into consideration when choosing a DNS provider.

Great point.

FWIW, when I pinged, quad9 was around ~10ms, cloud ~30ms, and mullvad ~150ms. I'm not sure your 40ms would be too meaningful of a difference, but >100ms definitely will.

I wonder if anyone knows a way that I could script up a means for doing this dynamically? Like I can have a preferred order (let's say mullvad, cloud, quad for example since this is reverse my timing) and then ping occasionally and reorder based on that or a threshold (like <50ms)? Could be useful for like a pihole?

Unless you watch movies online. I remember switching away from my Comcast/Xfinity DNS and immediately experience significant degradation of Netflix/Amazon video quality. Apparently they use DNS for traffic optimization when video streaming from popular video sites.

Netflix has hardware on site at ISPs for this to accelerate your streams.

https://openconnect.netflix.com/en/

I really hope that we'll move past DNS load balancing for large media files at some point.

It's definitely better than nothing for small/one-off fetches, but VOD streaming sites usually have to fetch a license file from some API server anyway – so why not direct the viewer/client to the best CDN host based on the client IP address instead?

This used to be a problem but I haven't experienced it in a few years. I think the streaming providers must be using anycast instead of DNS techniques now?

Perhaps using something like a split-horizon DNS setup would alleviate that

Depends on your ISP. I talk to mine on IRC, they are xkcd806 compatible, they don't do anything to my traffic. They do provide DNS, DOT and DOH servers, or I can use whatever server I want. They're happy to have my host my own DNS server too, as long as it's not configured to allow amplification attacks from random IPs.

They actually had a mea-culpa with them a week or so back

> Our DoH/DoT resolvers were intermittently failing DNS lookups. It seemed to start over the Easter weekend. Our DoT/DoH front ends are DNS aware proxies (dnsdist) to back ends running unbound. dnsdist uses TLS to speak DNS to the back ends. Some of the back ends had failed to reload their TLS certificates after renewal, so although the certificates were valid unbound was still serving old certs and they eventually expired. This resulted in broken back ends in the pool, which dnsdist kept trying to bring back into service. The intermittent nature of the failures meant that it wasn't obvious to users, as clients generally retry silently in the background. Of course our monitoring should have caught this! We've fixed the underlying problem which caused unbound not to pick up the renewed certificates, and we've improved monitoring to catch similar problems should they occur in future.

I assume that's https://en.m.wikipedia.org/wiki/Andrews_%26_Arnold

The minute they come to America I'm switching.

I'd be curious about other DNS services which compete with Quad9. I seem to have an inkling of a memory that there used to be some kind of truly "open" DNS (not OpenDNS I don't think), but I can't recall what their name was or what their paradigm was, precisely.

Mullvad has a public DNS service that I'd trust.

You might be thinking of NextDNS?

That's not universally true. The ISP I run doesn't futz with DNS, and using our DNS servers is beneficial as it shaves about 10-20ms RTT off many DNS requests since our DNS servers are local with forwarders in the city that most of our transit providers are in.

Getting downvoted for an on-topic relevant comment is pretty disappointing. The fact of the matter is that there are still small internet providers around that care about the privacy of their customers. Furthermore, anyone who thinks they are enhancing their privacy by using one of the large public DNS servers needs to do a reality check: you pay for your use of "free" public DNS servers by sharing the information about every single website that you visit. All an advertiser has to do to de-anonymize your browsing history in that case is to put a single unique domain name in a web page and trigger the browser to do a lookup. Do folks think that AT&T is the only large company that has a really shitty privacy track record when it comes to DNS?

I also stand by the claim that local DNS servers are beneficial. Not all of us are 1ms away from the major DNS providers. Transport networks are complicated, and those of us that do not have millions of dollars to build our own fibre directly to a data center where peering is available have to pay a latency price for sub-optimal transport routes. It is a fact that having a local DNS server will save you multiple round trips in such cases when the deployment is architect to do so. I did that because it makes browsing a little bit snappier. Saving a few 20ms RTTs might mean nothing to people living in a large city with a local internet exchange, but it does help those of us in rural remote communities that are distant from that infrastructure.

Reply on news.ycombinator.com