Use other DNS servers than your ISP's

http://www.chaz6.com/files/resolv.conf

by bigbugbag • 12 years ago

33 40 12 years ago

bigbugbag5• 12 years ago

WARNING: This config file is not to be used as is. Read it attentively and only activate a handful of servers from the list.

sp3322• 12 years ago

Doesn't have the Swiss Privacy Foundation servers. http://www.privacyfoundation.ch/de/service/server.html 77.109.138.45, 77.109.139.29

Rough translation of the reason some of it is crossed-out: Due to a software error, DNSSEC validation is currently disabled. The DNS server with the IP address 87.118.85.241 is (currently) no longer available. In the future, there will certainly be three servers again.

alternize• 12 years ago

can someone explain why using your ISP's DNS server is not recommended as hinted by the submissions' title?

seems to me that it really depends on the service quality of the ISP. if you're lucky and have a good ISP, wouldn't using its servers be faster (less hops)? are there other arguments for using different servers?

dice• 12 years ago

Many ISPs hijack DNS NXDOMAIN results to serve ads to their customers.

https://en.wikipedia.org/wiki/DNS_hijacking#Manipulation_by_...

Gracana2• 12 years ago

What I hate most about DNS hijacking is that it ends up tainting my browser's URL autocompletion list. If I go to "news" instead of "news.ycombinator.com" because I didn't wait for the completion, my ISP will serve up a valid resulting page... and my autocomplete will be happy to take me to "news" again and again after that.

ChikkaChiChi• 12 years ago

OpenDNS will block known adware, spyware, and malware sites at the expense of serving up custom pages when addresses don't resolve. Some ISPs do this at no additional benefit to the customer.

Caching and speed are the other most likely reasons.

sp3322• 12 years ago

Right now, if you make a free account on the OpenDNS website, you can configure it to give you normal NXDOMAIN records instead of ads. And they just announced that they're going to do away with all ads, since they never really liked having them and they're getting enough money from paying customers now. https://news.ycombinator.com/item?id=7819150

bigbugbag5• 12 years ago

« They also keep permanent logs of all queries, which could be subpoenaed by a government entity. Their joke of a privacy policy allows them to sell your logs to "Affiliated Businesses", which pretty much means anybody. Not that it really matters - they could amend their privacy policy tomorrow morning and be selling your info by the afternoon.» -- seizurebattlerobot http://beta.slashdot.org/comments.pl?sid=1297613&cid=2864072...

justizin3• 12 years ago

EDIT: fixed DNS IP.

Technically, there may be an advantage to using a 'closer' DNS server with 'less hops', but many national ISPs don't push DNS servers to all POPs. DNS infrastructure at large ISPs tends to be heavily loaded and is scaled based on demand.

It's common, and many wifi routers do this for you by default, to run a local caching nameserver which uses some other ISP nameservers as 'forwarders'. You create less demand upstream as well as getting faster response if you do this.

Obviously you should also be concerned about creating load on DNS services provided by someone you have no relationship with. Some might even consider it rude.

In addition to OpenDNS, Google runs free DNS servers at 8.8.8.8 and 8.8.4.4, but obviously there are concerns with relying upon Google to provide all of the internet's infrastructure.

What we should really all be talking about is decentralized, peer-to-peer DNS, or a system of forwarders we all provide from places like Linode and DigitalOcean, both of which I've used to provide off-site secondary and tertiary DNS for large networks. We should be looking at NameCoin, not just leeching off some other random ISP.

mclarke• 12 years ago

8.8.4.4 should be the second google ip address.

scott_karana• 12 years ago

Personally, I find it obnoxious that OpenDNS hijacks nonresolving domains and uses them as "search pages", but to each their own.

Nothing is worse than trying to SSH into a server with a domain typo, and thinking it exists...

rakoo2• 12 years ago

We should be looking at NameCoin

Take a look at dnschain [0], which allows you to query Namecoin domains using standard DNS or HTTP:

    $ dig @dns.dnschain.net otokar.bit
    [....]
    ;; ANSWER SECTION:
    otokar.bit.		527	IN	A
    109.190.29.155
    [...]

[0] https://github.com/okTurtles/dnschain

ams6110• 12 years ago

When a suboena is presented to your ISP demanding your DNS logs, there won't be anything for them to disclose.

drdaeman• 12 years ago

Are ISPs obliged to keep such logs in any country out there?

I work for one in Russia (quite unhealthy country for Internet those days), and AFAIK we're only supposed to keep accounting records (i.e. times, assigned IP addresses etc.)

bigbugbag5• 12 years ago

If luck gave you a ISP offering a good DNS service there is still a matter of privacy and escaping surveillance.

Laws ordering ISP to keep logs of their customer activity are becoming increasingly common around the world. By using a different DNS server your ISP DNS server has no logs to show for your DNS activity.

It is good privacy practice to split the data about your internet activities across different providers to make it more difficult to track you. For example if you use google services for web search, then you should not use google for your email (ideally your should host your own email).

But the sad state of reality is that ISP DNS are often poor, whether it is hijacking DNS for profit or blocking domains following judge's orders or local laws.

Spittie2• 12 years ago

Your ISP can already easily track what you browse/requests, it's not like the DNS logs give them more information (and unless you use DNSCrypt or similar, they can just see the DNS traffic anyway).

On the contrary, by using a different DNS server you're giving your data both to your ISP (you have to) and a 3rd party.

mike-cardwell• 12 years ago

"It is good privacy practice to split the data about your internet activities across different providers"

Not really. Now both your ISP and your DNS provider know what sites you're visiting. All you're doing is increasing your attack surface.

belorn• 12 years ago

Using an ISP DNS server is similar to the old telephone system where you talked to an "operator" in order to connect the call to someone. Rather than keeping track of peoples number yourself, this third-party will do it for you.

So, when is it that you do not want to call an operator to patch every call you make? Ask yourself this question, knowing that the operator keeps a list of every incoming and outgoing call. Know that they sometimes also lie and say that the party you are calling is not reachable, while in fact the operator simply refuses to connect you. Some operators will even send you to a telemarketer in order to monetize poorly stated questions.

On the positive side, it is faster. Asking your ISP for every DNS resolving does sometime give an increase speed by shaving a few milliseconds the first time you connect to a website. Depending on what you prioritize, that is either worth it, or not.

chimeracoder• 12 years ago

I see that Level 3 is on the list. Please don't use Level 3 DNS[0].

They have no obligation to provide DNS services except to Level 3 customers[1], they don't like providing those services, and they have been known to hijack DNS requests to inject ads and other services[2] for unauthorized users.

[0] http://www.tummy.com/articles/famous-dns-server/

[2] And if you're a Level 3 customer, you're probably not using this list

[2] http://james.bertelson.me/blog/2014/01/level-3-are-now-hijac...

userbinator• 12 years ago

See this post, where the VP of Level 3 says they're providing open DNS: http://blog.level3.com/level-3-network/a-flawed-study-of-cdn...

The request hijacking briefly appeared earlier this year, but they seem to have stopped doing it.

dfc• 12 years ago

Personally I think that the only reasonable choice for DNS is to use a local caching dns like unbound or dnscache.

bigbugbag5• 12 years ago

I concur, but this raises a quite serious issue due to the suboptimal DNS is designed. If it was a common and global practice and everyone on the the Internet ran his/her own local unbound dns cache, how would the root DNS servers fare with the additional load?

A better solution would be to have a distributed p2p DNS instead of the current one.

justizin3• 12 years ago

DNS is designed to keep the root server load relatively low, and before there were "ISPs", yes, DNS was designed for every "network" to have at least one DNS server. Before that, you see, everyone just exchanged copies of a massive /etc/hosts file.

Anyway, I am totally all for a distributed p2p DNS, at least as a replacement for root servers.

AnthonyMouse• 12 years ago

If it was a common and global practice and everyone on the the Internet ran his/her own local unbound dns cache, how would the root DNS servers fare with the additional load?

Anycast solved this ages ago. Also, the TTL on most TLDs is 172800 seconds, so you'll have NS entries cached for the 'com' 'org' 'gov' etc. GTLD servers almost immediately and then never bother the root servers again for two days.

rakoo2• 12 years ago

What we should use are local DNS resolvers such as dnsmasq [0], and share the answers on the LAN.

[0] https://en.wikipedia.org/wiki/Dnsmasq

therealmarv• 12 years ago

One of the best approaches I know is to use something like dnscrypt with e.g. OpenDNS. It bypasses the DNS more easily by not using a typical DNS port

Pwntastic• 12 years ago

you can use namebench[0] to help decide which dns server to use. it will run speed tests against various servers and give you some insight into them.

[0] https://code.google.com/p/namebench/

Florin_Andrei• 12 years ago

One of the advantages of having a Linux front router on your home network is the ability to run your own caching nameserver for the whole network.

And if you install a VPN server there, and VPN clients on your mobile equipment, then you can also access that nameserver from anywhere.

jedisct1• 12 years ago

And a list of servers supporting DNSCrypt, to authenticate queries and responses sent to the resolvers: https://github.com/jedisct1/dnscrypt-proxy/blob/master/dnscr...

Some of these support DNSSEC and Namecoin.

X-Istence• 12 years ago

Great resource if you want to start a DNS reflection attack ;-)

Sorry, that's a terrible joke, let's hope people filter egress traffic with IP's that don't match their network from their ISP's.

steanne• 12 years ago

for verizon, replace the last octet with 14 to opt out of verizon's landing pages for unresolved domains.

http://www.verizon.com/support/residential/internet/highspee...

Use other DNS servers than your ISP's

Related Stories