Rendered at 09:17:17 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
Habgdnv 11 hours ago [-]
Just a quick note for the unsuspecting:
I run two local DNSes, one recursive and one forwarding.
The forwarding one uses few services, like 1.1.1.1, 8.8.8.8, 9.9.9.9, etc.
One day I noticed inconsistent responses and started investigating. Turns out that by default 9.9.9.9 have "protection" and for your safety will lie and return NXDOMAIN or something else, for some dangerous domains, taking into account their definition of "dangerous". I am not saying that this is bad, probably lots of non-HN people don't want to run their DNS or anything related and just want a tablet that works because they don't even have laptop. It just hit me hard because I did not expected filtering on these servers.
LeoPanthera 8 hours ago [-]
You can use 9.9.9.10, which is unfiltered, or 9.9.9.12, which is unfiltered and passes ECS.
drewfax 6 hours ago [-]
That is the point and business of Quad9. It's not their fault for you not knowing what Quad9 is.
I don't want my family to get malware from sketchy websites. Quad9 offers a simple solution for these usecases. I'll take the false positive anyday over unfiltered DNS.
rdevilla 7 hours ago [-]
[dead]
greyface- 12 hours ago [-]
Sending every single query to a centralized third party is hard to square with "high privacy". I prefer to run my own local recursive resolver.
ebb_earl_co 12 hours ago [-]
Please correct me if I am mistaken, but unless there’s a local resolver for every single one of your clients, aren’t the DNS requests sent in plaintext to the upstream of your local resolver?
That might not be an issue for your situation, but I recall the benefit of something like Quad9’s offering is the encryption between client and their endpoint(s), particularly for untrusted ISP or similar.
staviette 6 hours ago [-]
Yes, that's a real benefit in many situations. Everything on your lan can do normal DNS queries to your local forwarder, which talks DNS over TLS or DNS over HTTPS to Quad9.
Downside is Quad9 can see all your DNS traffic. But without it if you run your own recursive resolver your ISP sees all your queries, and many others see portions of them, unencrypted.
kayson 6 hours ago [-]
> But without it if you run your own recursive resolver your ISP sees all your queries, and many others see portions of them, unencrypted.
This hopefully shouldn't be an issue for long with stuff like RFC 9539 and OOTS/SVCB.
winstonwinston 11 hours ago [-]
> I prefer to run my own local recursive resolver.
Used to be fine. I stopped doing it when average TTL dropped to 300 seconds and it takes far too long for my local recursor to get the answer >100ms, when 3rd party resolver delivers in <10ms.
pocksuppet 6 hours ago [-]
You don't have to obey TTL. You can use Unbound options like:
Why not run your own recursive resolver like unbound if you're looking for privacy
jedberg 3 hours ago [-]
I've been meaning to switch my in-laws to Quad9 and just not mention it to them. They fall for too many scams, I'd love for those websites to just not work anymore.
Linserin 9 hours ago [-]
Quad9 DNS sometimes returns a CDN node with obviously slower response and higher delay, so I have rarely used it since then.
abdulocracy 8 hours ago [-]
They have an ECS enabled option that fixes that, at 9.9.9.11
annoyingnoob 13 hours ago [-]
I tried Quad9 at our business for a while, about a year. I ended up moving to something else due to latency. I'm not sure if it was a routing issue or what but there were a lot of timeouts and slow responses. I have not had these issues with other providers.
winstonwinston 12 hours ago [-]
When I run a mix of CF and Quad9 resolvers, Quad9 was consistently slower in response times when measured. But it didn’t make any perceivable difference in real usage.
esseph 10 hours ago [-]
> But it didn’t make any perceivable difference in real usage.
It can, it depends on the systems and user patterns. Example: if an end user is going to the same site over and over, those DNS responses are probably cached locally on the device, and may also be cached on any upstream resolvers.
OTOH if you were somebody without a Facebook account that went to Facebook.com to view a post from a link, you could easily have 120 different DNS lookups for various resources on that domain that haven't been DNS or web resource cached yet.
jordand 12 hours ago [-]
I'd used NextDNS for a while but the service kept degrading with more timeouts regardless if you were on free/paid. Haven't had any issues with Quad9
I don't want my family to get malware from sketchy websites. Quad9 offers a simple solution for these usecases. I'll take the false positive anyday over unfiltered DNS.
That might not be an issue for your situation, but I recall the benefit of something like Quad9’s offering is the encryption between client and their endpoint(s), particularly for untrusted ISP or similar.
Downside is Quad9 can see all your DNS traffic. But without it if you run your own recursive resolver your ISP sees all your queries, and many others see portions of them, unencrypted.
This hopefully shouldn't be an issue for long with stuff like RFC 9539 and OOTS/SVCB.
Used to be fine. I stopped doing it when average TTL dropped to 300 seconds and it takes far too long for my local recursor to get the answer >100ms, when 3rd party resolver delivers in <10ms.
From AT&T fiber, Cloudflare’s 1.1.1.1 is always the fastest, though Quad9 is a very close second.
It’s interesting that it’s different from different ISPs.
Definitely blew my mind coming from the ~20ms DOCSIS adds.
https://www.privacyguides.org/en/dns/#recommended-providers
It can, it depends on the systems and user patterns. Example: if an end user is going to the same site over and over, those DNS responses are probably cached locally on the device, and may also be cached on any upstream resolvers. OTOH if you were somebody without a Facebook account that went to Facebook.com to view a post from a link, you could easily have 120 different DNS lookups for various resources on that domain that haven't been DNS or web resource cached yet.