Hacker News Reader

Comment by globular-toast | Hacker News Reader

Why forward requests to a DNS server like 1.1.1.1 at all? I used to use stuff like pi-hole/dnsmasq, but now I'm using unbound on my opnsense router which supports using blocklists and custom overrides (as well as automatic for DHCP clients). I found the default blocklists in pi-hole broke a few things but not had any problems with the lists I'm using now.

View on HN

You have to forward requests that aren't in your cache, surely? I don't see how you would resolve public domain names otherwise

Use the root servers to find the dns entries yourself, just like the upstream provider does

that's called a dns-resolver (iterator). essentially starting from the top (.) and asking for authorative nameservers that can answer the next level down until it reaches the hostname you are looking for. this usually takes multiple rtt's and is hence slower than asking some big cache.

Yes but to the root servers, not to someone else's cache.

I don't really see how this scales, on a global basis.

Sure, one or two of us running our own resolvers isn't going to hurt, but an extra hundred million or so resolvers would hurt -> at best just causes all the servers targeted by the resolver to add more layers of caching

It's a good point, I never really thought about it. In my case I'm reluctant to use my ISP servers because my country tries to practise censorship via DNS, but I also didn't really feel like using something like Google. I will do some research and experimentation with upstream caches like Quad-9 and Cloudflare to see what it's like.

DNS is highly distributed.

I doubt the current infra would have any problem handle the load even if all individual devices had a local resolver.

Replying again as I did some research. It turns out there aren't actually only 13 root name servers, there are almost 2000. Also, the vast majority of queries to the root servers are from badly configured systems that aren't caching results properly or aren't even receiving the results. So running your own caching resolver, assuming it's working correctly, would contribute to the small drop in the ocean that is legitimate usage of the root servers. Presumably the same applies to the next levels up too.

That would be a 'recursive resolver'[0], which recursively queries the DNS hierarchy from the top, returns the requested DNS record, and (unless you configure it not to do so) caches the results.

They're easy to set up and unless you're using it to support thousands of DNS requests per second, it's not appreciably (on human scales) slower than forwarding requests to your ISP's servers and/or 8.8.8.8 or 1.1.1.1.

More detail about recursive resolvers and how they work can be found here[1]

[0] https://notes.networklessons.com/dns-recursive-resolver

[1] https://www.akamai.com/glossary/what-is-recursive-dns

Reply on news.ycombinator.com