6 ms·
I have configured local Unbound to use four different open DNS provideds, round-robin, the rationale being each one gets 1/4th of requests. On the other hand, I
by lifepillar 5y ago
I have configured local Unbound to use four different open DNS provideds, round-robin, the rationale being each one gets 1/4th of requests. On the other hand, I am sending requests to four providers instead of one, so I have to trust four providers instead of one. What’s better?
- 1MachineElf 5y agoAt least you've removed one single point of failure for DNS lookups.
- dkdk8283 5y agoWhat about remote address correlation? DNS is transmitted in plaintext. Transit providers could evasedrop on your traffic and short circuit your work.
- eikenberry 5y agoThey could sniff but not tamper as long as you are using DNSSEC.
- diegoperini 5y ago> What’s better? 4 providers, at the same time, all times. It is wasteful but you can run the alarms when responses don't match.
- andrey_utkin 5y agoBut responses will not match for legitimate reasons of dynamic configuration at specific domains.
- posix_me_less 5y agoYou can set up recursive resolver to query directly the DNS root servers. https://www.iana.org/domains/root/servers https://www.iana.org/domains/root/servers
- mindslight 5y agoThis isn't a concrete software recommendation, but the DNS would lend itself exceptionally well to a distributed p2p resolver that would prevent most queries from hitting centralized servers in the first place - it's just a simple distributed database. You'd need some sort of multiparty trust metric to avoid tampering (or DNSSEC), but modulo that peers could just freely pass around records. There would be a little more complexity these days with large companies changing answers based on the address of the requester, but that doesn't seem too hard to account for or even just ignore. And to reduce traffic even further, you could take some liberties with TTLs, for records that actually don't change often.