An open DNS recursive service for free security and high privacy | Hacker News Reader

An open DNS recursive service for free security and high privacy

quad9.net

135 pointsmooreds39 comments

Just a quick note for the unsuspecting: I run two local DNSes, one recursive and one forwarding. The forwarding one uses few services, like 1.1.1.1, 8.8.8.8, 9.9.9.9, etc. One day I noticed inconsistent responses and started investigating. Turns out that by default 9.9.9.9 have "protection" and for your safety will lie and return NXDOMAIN or something else, for some dangerous domains, taking into account their definition of "dangerous". I am not saying that this is bad, probably lots of non-HN people don't want to run their DNS or anything related and just want a tablet that works because they don't even have laptop. It just hit me hard because I did not expected filtering on these servers.

You can use 9.9.9.10, which is unfiltered, or 9.9.9.12, which is unfiltered and passes ECS.

That is the point and business of Quad9. It's not their fault for you not knowing what Quad9 is.

I don't want my family to get malware from sketchy websites. Quad9 offers a simple solution for these usecases. I'll take the false positive anyday over unfiltered DNS.

Not really. Quad9 also provides an unfiltered version of itself, which I'm currently using. Cloudflare I believe has the same option too.

Instead of CloudFlare's 1.1.1.1 I like CloudFlare's 1.1.1.3: it filters known porn and known malware sites.

By now I expect many sites to be filtered out: too much crap out there.

Then I also run my own DNS (unbound) and after seeing a warning from one of my banks about a phishing site where one letter differed in the domain name from the real bank's site, I went ballistic: I did generate hundreds of thousands (maybe millions by now) of variations of the names of banks/brokers domains I use, with every single variation of one character and many variations of up to two characters and I nullroute those too (in addition to known porn and known malware sites).

And I nullroute every single Unicode domain name. I don't care. I don't care if you disagree with this: too many homoglyph attacks. Too risky. And the Web Just Works [TM] without accessing any Unicode domain.

I null route tens if not hundreds of TLDs.

Filtering out every single domain name using any Unicode char is a bit more involved but it's doable (I do it since years, but today you can ask LLMs if you want to do it or patch a DNS software to do it).

I know some go further and by default disallow everything and then only allow domains they want to use but I find that a bit too tricky.

Now... Should there be something I really want, say I want a shady torrent tracker to download some dubious file, I can always use a VM/container with a more lenient DNS.

I'm using such a setup since years. My unbound DNS runs on a Pi 3 that's on 24/7.

Works flawlessly.

P.S: on another subject I also blocklist entire IP blocks, including entire countries. Same thing: the Web still works totally fine.

I ended up getting rid of unbound, stubby, and a technitium instance and just moving to numa.rs everywhere i needed dns. It simplified my life a lot. Now laptops run it with forward*ng that makes sense for their use case (ie home dns to my home dns vms running numa, work dns forwarded to work dns servers, everything else was recursive resolving but i swi5ched it to their odoh and it worked great while probably being more private

>works flawlessly.

Obviously. You’re continually tinkering with it.

The vast majority of people do not share the same hobby of troubleshooting and tweaking home DNS of all things.

To be thorough, you should check your domain names for any characters that can be changed by a single bit flip. It probably will not look right as far as spelling, but the idea is that eventually something like a cosmic ray will pass through a memory chip and flip that single bit for a connection, and they get redirected to another site set up to handle the request. It's a thing. It takes patience, but but does work. People were doing this to fbcdn.com and other large targets years back.

Sending every single query to a centralized third party is hard to square with "high privacy". I prefer to run my own local recursive resolver.

Please correct me if I am mistaken, but unless there’s a local resolver for every single one of your clients, aren’t the DNS requests sent in plaintext to the upstream of your local resolver?

That might not be an issue for your situation, but I recall the benefit of something like Quad9’s offering is the encryption between client and their endpoint(s), particularly for untrusted ISP or similar.

Yes, that's a real benefit in many situations. Everything on your lan can do normal DNS queries to your local forwarder, which talks DNS over TLS or DNS over HTTPS to Quad9.

Downside is Quad9 can see all your DNS traffic. But without it if you run your own recursive resolver your ISP sees all your queries, and many others see portions of them, unencrypted.

> But without it if you run your own recursive resolver your ISP sees all your queries, and many others see portions of them, unencrypted.

This hopefully shouldn't be an issue for long with stuff like RFC 9539 and OOTS/SVCB.

Courtesy link for HN readers

https://www.rfc-editor.org/info/rfc9539/

> I prefer to run my own local recursive resolver.

Used to be fine. I stopped doing it when average TTL dropped to 300 seconds and it takes far too long for my local recursor to get the answer >100ms, when 3rd party resolver delivers in <10ms.

You don't have to obey TTL. You can use Unbound options like:

    cache-min-ttl: 3600 // seconds
    cache-min-negative-ttl: 3600 // seconds

    serve-expired: yes
    serve-expired-client-timeout: 20 // milliseconds to wait for resolution before serving the old value to the client

Can also have unbound preemptively refresh cached values too...

    prefetch: yes

Tada, now your unbound serves records faster than the round trip out to anything off your own network in most cases.

It's still fine. I run my own recursive resolver and have no noticeable issues.

Good for you

quad9 is recommended by Privacy Guides. There's also other recommendations.

https://www.privacyguides.org/en/dns/#recommended-providers

Why not run your own recursive resolver like unbound if you're looking for privacy

Your ISP can snoop on upstream requests. It is likely less private than Quad9 or similar services where you can mix requests with a large crowd.

I tried Quad9 at our business for a while, about a year. I ended up moving to something else due to latency. I'm not sure if it was a routing issue or what but there were a lot of timeouts and slow responses. I have not had these issues with other providers.

I'd used NextDNS for a while but the service kept degrading with more timeouts regardless if you were on free/paid. Haven't had any issues with Quad9

When I run a mix of CF and Quad9 resolvers, Quad9 was consistently slower in response times when measured. But it didn’t make any perceivable difference in real usage.

> But it didn’t make any perceivable difference in real usage.

It can, it depends on the systems and user patterns. Example: if an end user is going to the same site over and over, those DNS responses are probably cached locally on the device, and may also be cached on any upstream resolvers. OTOH if you were somebody without a Facebook account that went to Facebook.com to view a post from a link, you could easily have 120 different DNS lookups for various resources on that domain that haven't been DNS or web resource cached yet.

In California, from Xfinity Cable, Google’s DNS consistently has the lowest latency.

From AT&T fiber, Cloudflare’s 1.1.1.1 is always the fastest, though Quad9 is a very close second.

It’s interesting that it’s different from different ISPs.

Yup, I get 1-3ms to 1.1.1.1 and 18-20ms to Google from a semi-local fiber provider.

Definitely blew my mind coming from the ~20ms DOCSIS adds.

https://en.wikipedia.org/wiki/Anycast#Domain_Name_System

  --- 8.8.8.8 ping statistics ---
  10 packets transmitted, 10 received, 0% packet loss, time 9015ms
  rtt min/avg/max/mdev = 23.666/25.241/27.628/1.022 ms

  --- 9.9.9.9 ping statistics ---
  10 packets transmitted, 10 received, 0% packet loss, time 9015ms
  rtt min/avg/max/mdev = 23.811/25.256/27.003/1.024 ms

  --- 1.1.1.1 ping statistics ---
  10 packets transmitted, 10 received, 0% packet loss, time 9014ms
  rtt min/avg/max/mdev = 13.216/14.553/15.835/0.739 ms

Of course, these ICMP reply times are apples-to-oranges comparisons. With the proper tooling, you should be able to measure DNS reply latencies.

Why even bother posting these stats? Ping is effectively irrelevant to the conversation.

Cloudflare probably has a server on AT&Ts network, but not on Xfinity. Google is probably the opposite.

I've been meaning to switch my in-laws to Quad9 and just not mention it to them. They fall for too many scams, I'd love for those websites to just not work anymore.

Quad9 DNS sometimes returns a CDN node with obviously slower response and higher delay, so I have rarely used it since then.

They have an ECS enabled option that fixes that, at 9.9.9.11

Please note this service is censored by the French and German authorities

https://torrentfreak.com/dns-resolver-quad9-loses-global-pir...

That was overturned

https://quad9.net/news/blog/quad9-turns-the-sony-case-around...

I quite liked the idea behind one of zerodns's services, it wouldn't resolve any domain that hadn't existed for at least 30 days.

It felt like a simple (rather brute force) filter that cut out a lot of potential noise/malicious activity

>"Quad9 blocks lookups of malicious host names from an up-to-the-minute list of threats. This blocking action protects your computer, mobile device, or IoT systems against a wide range of threats such as malware, phishing, spyware, and botnets, and it can improve performance in addition to guaranteeing privacy."

OK, let's understand the following:

Yes, it is absolutely true that there are malicious web sites, malicious API's, malicious endpoints on the Internet, most having hostnames, aka domain names, that can be blocked on lookup...

It is, generally speaking, a good idea to block malicious hostnames, malicious domain names, if they can be identified, if they can be known. And usually they can.

But there is a problem with performing such blocking however, and this is not a problem specific to Quad9 -- it's a problem for any DNS provider.

The problem can be simply stated as follows:

If you have the power to block any hostname, any domain name, any web service or web site whatsoever, then...

...how do you know that you are not accidentally blocking any legitimate, morally upstanding, ethically correct, legal, lawful, web services or websites, inadvertently?

In other words, for every 50,000 or so malicious domain names, how do you know that you didn't drag in at least one legitimate/legal/lawful one into that mix?

You see, it's philosophical question!

It's a variation of "Who guards the guardians?" (Quis custodiet ipsos custodes?https://en.wikipedia.org/wiki/Quis_custodiet_ipsos_custodes%...)

In other words, it raises such questions as "What's the resolution process if a lawful website is inadvertently blocked?" and "What is the criteria for blocking a website?" and "Who determines that criteria?", etc., etc.

Simply put: Who guards the guardians?

Now, this being said, we do appreciate everything that Quad9 and other free/privacy-focused DNS services do and provide.

We can make the counter-argument that privacy-focused DNS providers in general are "the good guys" and that for every 10,000+ domains with malicious intent, maybe only 1 or 2 actually legal, lawful, law-abiding domains are ever actually accidentally blocked -- and that would be a good counter-argument...

It's a great life to browsers to get rid of all of the malicious websites, but it's a horrendous life to individual legal lawful website owners when their ethical website is blocked for no apparent reason via an unaccountable non-transparent black-box service with no formal resolution process or channel!

Heard of "The Great Firewall of China"?

Most of that is implemented via DNS blocking!

Via DNS providers!

So in the future, I'd love to see a more, let's call it "responsibility-focused" DNS provider, one that at least attempts to notify any party that is blocked, notifies users of blocks, and has an open, public and transparent dispute resolution service for any party whose domain is blocked.

Anyway, in the interim, we thank Quad9 and the other privacy-focused DNS providers for their services!

Downvote.*, holy old.

What are the odds that it's a honeypot?

Reply on news.ycombinator.com