Use other DNS servers than your ISP's | Hacker News Reader

Use other DNS servers than your ISP's

chaz6.com

33 pointsbigbugbag40 comments

I see that Level 3 is on the list. Please don't use Level 3 DNS[0].

They have no obligation to provide DNS services except to Level 3 customers[1], they don't like providing those services, and they have been known to hijack DNS requests to inject ads and other services[2] for unauthorized users.

[0] http://www.tummy.com/articles/famous-dns-server/

[2] And if you're a Level 3 customer, you're probably not using this list

[2] http://james.bertelson.me/blog/2014/01/level-3-are-now-hijac...

See this post, where the VP of Level 3 says they're providing open DNS: http://blog.level3.com/level-3-network/a-flawed-study-of-cdn...

The request hijacking briefly appeared earlier this year, but they seem to have stopped doing it.

WARNING: This config file is not to be used as is. Read it attentively and only activate a handful of servers from the list.

can someone explain why using your ISP's DNS server is not recommended as hinted by the submissions' title?

seems to me that it really depends on the service quality of the ISP. if you're lucky and have a good ISP, wouldn't using its servers be faster (less hops)? are there other arguments for using different servers?

Many ISPs hijack DNS NXDOMAIN results to serve ads to their customers.

https://en.wikipedia.org/wiki/DNS_hijacking#Manipulation_by_...

What I hate most about DNS hijacking is that it ends up tainting my browser's URL autocompletion list. If I go to "news" instead of "news.ycombinator.com" because I didn't wait for the completion, my ISP will serve up a valid resulting page... and my autocomplete will be happy to take me to "news" again and again after that.

It is annoying, but know that you can remove entries from the autocomplete list (in Chrome at least) by selecting it using the arrow keys and using shift+delete.

I recall having trouble with that in chrome. I seem to get inconsistent results removing history items in firefox, too. I dunno. shrug

OpenDNS will block known adware, spyware, and malware sites at the expense of serving up custom pages when addresses don't resolve. Some ISPs do this at no additional benefit to the customer.

Caching and speed are the other most likely reasons.

Right now, if you make a free account on the OpenDNS website, you can configure it to give you normal NXDOMAIN records instead of ads. And they just announced that they're going to do away with all ads, since they never really liked having them and they're getting enough money from paying customers now. https://news.ycombinator.com/item?id=7819150

And once you have an account they can link it with your usage of their DNS and get a better price when they sell the data.

As stated by its cofounder in the "no more ads" post, OpenDNS is a "revenue oriented company" so it seems the logic behind this option existing for registered user sis that they get more money from selling registered user data than from showing ads.

« They also keep permanent logs of all queries, which could be subpoenaed by a government entity. Their joke of a privacy policy allows them to sell your logs to "Affiliated Businesses", which pretty much means anybody. Not that it really matters - they could amend their privacy policy tomorrow morning and be selling your info by the afternoon.» -- seizurebattlerobot http://beta.slashdot.org/comments.pl?sid=1297613&cid=2864072...

EDIT: fixed DNS IP.

Technically, there may be an advantage to using a 'closer' DNS server with 'less hops', but many national ISPs don't push DNS servers to all POPs. DNS infrastructure at large ISPs tends to be heavily loaded and is scaled based on demand.

It's common, and many wifi routers do this for you by default, to run a local caching nameserver which uses some other ISP nameservers as 'forwarders'. You create less demand upstream as well as getting faster response if you do this.

Obviously you should also be concerned about creating load on DNS services provided by someone you have no relationship with. Some might even consider it rude.

In addition to OpenDNS, Google runs free DNS servers at 8.8.8.8 and 8.8.4.4, but obviously there are concerns with relying upon Google to provide all of the internet's infrastructure.

What we should really all be talking about is decentralized, peer-to-peer DNS, or a system of forwarders we all provide from places like Linode and DigitalOcean, both of which I've used to provide off-site secondary and tertiary DNS for large networks. We should be looking at NameCoin, not just leeching off some other random ISP.

8.8.4.4 should be the second google ip address.

thanks, fixed.

Personally, I find it obnoxious that OpenDNS hijacks nonresolving domains and uses them as "search pages", but to each their own.

Nothing is worse than trying to SSH into a server with a domain typo, and thinking it exists...

Didn't they just announce they were going to stop doing that?

yes, starting june 6th.

http://blog.opendns.com/2014/05/29/no-more-ads/

> We should be looking at NameCoin

Take a look at dnschain [0], which allows you to query Namecoin domains using standard DNS or HTTP:

    $ dig @dns.dnschain.net otokar.bit
    [....]
    ;; ANSWER SECTION:
    otokar.bit.		527	IN	A
    109.190.29.155
    [...]

[0] https://github.com/okTurtles/dnschain

When a suboena is presented to your ISP demanding your DNS logs, there won't be anything for them to disclose.

Are ISPs obliged to keep such logs in any country out there?

I work for one in Russia (quite unhealthy country for Internet those days), and AFAIK we're only supposed to keep accounting records (i.e. times, assigned IP addresses etc.)

If luck gave you a ISP offering a good DNS service there is still a matter of privacy and escaping surveillance.

Laws ordering ISP to keep logs of their customer activity are becoming increasingly common around the world. By using a different DNS server your ISP DNS server has no logs to show for your DNS activity.

It is good privacy practice to split the data about your internet activities across different providers to make it more difficult to track you. For example if you use google services for web search, then you should not use google for your email (ideally your should host your own email).

But the sad state of reality is that ISP DNS are often poor, whether it is hijacking DNS for profit or blocking domains following judge's orders or local laws.

Your ISP can already easily track what you browse/requests, it's not like the DNS logs give them more information (and unless you use DNSCrypt or similar, they can just see the DNS traffic anyway).

On the contrary, by using a different DNS server you're giving your data both to your ISP (you have to) and a 3rd party.

That's why VPNs exist. A VPN without an external DNS service is pretty pointless if you're concerned about ISP snooping.

Well, then if all the DNS traffic is proxyed through a VPN your ISP can't know who made that query, making it pretty much useless.

And if you're worrying about DNS leaks, your ISP is still able to read that traffic even when using a different DNS provider (assuming no DNSCrypt or similar).

3rd party DNS servers can be useful, I just don't see any additional value to your privacy when not coupled with DNSCrypt/DNSCurve.

"It is good privacy practice to split the data about your internet activities across different providers"

Not really. Now both your ISP and your DNS provider know what sites you're visiting. All you're doing is increasing your attack surface.

Using an ISP DNS server is similar to the old telephone system where you talked to an "operator" in order to connect the call to someone. Rather than keeping track of peoples number yourself, this third-party will do it for you.

So, when is it that you do not want to call an operator to patch every call you make? Ask yourself this question, knowing that the operator keeps a list of every incoming and outgoing call. Know that they sometimes also lie and say that the party you are calling is not reachable, while in fact the operator simply refuses to connect you. Some operators will even send you to a telemarketer in order to monetize poorly stated questions.

On the positive side, it is faster. Asking your ISP for every DNS resolving does sometime give an increase speed by shaving a few milliseconds the first time you connect to a website. Depending on what you prioritize, that is either worth it, or not.

Personally I think that the only reasonable choice for DNS is to use a local caching dns like unbound or dnscache.

I concur, but this raises a quite serious issue due to the suboptimal DNS is designed. If it was a common and global practice and everyone on the the Internet ran his/her own local unbound dns cache, how would the root DNS servers fare with the additional load?

A better solution would be to have a distributed p2p DNS instead of the current one.

DNS is designed to keep the root server load relatively low, and before there were "ISPs", yes, DNS was designed for every "network" to have at least one DNS server. Before that, you see, everyone just exchanged copies of a massive /etc/hosts file.

Anyway, I am totally all for a distributed p2p DNS, at least as a replacement for root servers.

> Anyway, I am totally all for a distributed p2p DNS

DNS is a distributed, p2p system. The ability to add records that can be globally retrieved is not ad-hoc, but you didn't mention that in your requirement. </obligatory_pedantry>

> If it was a common and global practice and everyone on the the Internet ran his/her own local unbound dns cache, how would the root DNS servers fare with the additional load?

Anycast solved this ages ago. Also, the TTL on most TLDs is 172800 seconds, so you'll have NS entries cached for the 'com' 'org' 'gov' etc. GTLD servers almost immediately and then never bother the root servers again for two days.

What we should use are local DNS resolvers such as dnsmasq [0], and share the answers on the LAN.

[0] https://en.wikipedia.org/wiki/Dnsmasq

Doesn't have the Swiss Privacy Foundation servers. http://www.privacyfoundation.ch/de/service/server.html 77.109.138.45, 77.109.139.29

Rough translation of the reason some of it is crossed-out: Due to a software error, DNSSEC validation is currently disabled. The DNS server with the IP address 87.118.85.241 is (currently) no longer available. In the future, there will certainly be three servers again.

One of the advantages of having a Linux front router on your home network is the ability to run your own caching nameserver for the whole network.

And if you install a VPN server there, and VPN clients on your mobile equipment, then you can also access that nameserver from anywhere.

you can use namebench[0] to help decide which dns server to use. it will run speed tests against various servers and give you some insight into them.

[0] https://code.google.com/p/namebench/

One of the best approaches I know is to use something like dnscrypt with e.g. OpenDNS. It bypasses the DNS more easily by not using a typical DNS port

And a list of servers supporting DNSCrypt, to authenticate queries and responses sent to the resolvers: https://github.com/jedisct1/dnscrypt-proxy/blob/master/dnscr...

Some of these support DNSSEC and Namecoin.

for verizon, replace the last octet with 14 to opt out of verizon's landing pages for unresolved domains.

http://www.verizon.com/support/residential/internet/highspee...

Great resource if you want to start a DNS reflection attack ;-)

Sorry, that's a terrible joke, let's hope people filter egress traffic with IP's that don't match their network from their ISP's.

Reply on news.ycombinator.com