8 ms·

Choosing a Public DNS Resolver

285 points by pawal 3mo ago

Obsessive5300 3mo ago
[dead]
denkmoon 3mo ago
9.9.9.9 is all you need
_def 3mo ago
quad9 seems fine. Glad there are a bunch of alternatives though. We should never stop practicing decentralization in the net.
- mzajc 3mo ago
  Be cautious with Quad9; their main address (9.9.9.9) has a "malware" blacklist that has misfired several times already: twice for a private torrent tracker, once for gist.github.com, issue was resolved within minutes to hours. They have a non-filtered address (9.9.9.10), but it doesn't do DNSSEC verification. IMO they're too unreliable to be worth the hassle.
  - deleted 3mo ago
    [deleted]
  - johnhtodd 3mo ago
    Quad9 employs DNSSEC on all endpoints now. https://quad9.net/news/blog/quad9-enables-dnssec-on-all-service-endpoints/ https://quad9.net/news/blog/quad9-enables-dnssec-on-all-serv...
    - mzajc 3mo ago
      This is great, thanks for the correction! I tried resolving dnssec-failed.org and it does indeed fail with EDE 6 (DNSSEC Bogus). I'm not sure why this hasn't been updated on the info page[0] yet, given that the change is about three months old. [0]: https://quad9.net/service/service-addresses-and-features/ https://quad9.net/service/service-addresses-and-features/
  - Scroll_Swe 3mo ago
    Was about to comment this. I actually don't like advert or malware blocking on my public DNS resolvers. It sounds cool but annoying when it misfires. Once Quad9 blocked Halo MCC XBOX Live -> Steam achievements, several fileshare services (probably used for malware somewhere but not my usage) etc... 1.1.1.1 blocked archive.is or got blocked by them or something... Gone back to Google DNS (gasp) for now, yes as a European... no blocking, fast, never goes down.
    - ethanhawksley 3mo ago
      I believe cloudflare only blocked archive.is on their "Families" filtered dns. I've been using their normal 1.1.1.1 and haven't encountered any blocks.
      - jaychandra68 3mo ago
        Yesterday 1.1.1.1 failed to resolved "theinformation.com" (hosted on CF itself!) for many hours, answering NXDOMAIN.
      - vitus 3mo ago
        IIRC the block was on archive.today's side as a protest against 1.1.1.1 intentionally not supporting ECS. https://news.ycombinator.com/item?id=36971650 https://news.ycombinator.com/item?id=36971650 https://news.ycombinator.com/item?id=19828702 https://news.ycombinator.com/item?id=19828702
        Scroll_Swe 3mo ago
        This is what I am referring to. But from an end-user side, one option does not work, and one does work. Then I will use the working DNS.
    - microgpt 3mo ago
      It's fine when it's a non default option. Like use x.x.x.x for DNS, x.x.x.y for DNS+adblocking, x.x.x.z for totalitarian corporate blocklist that doesn't let you do anything fun
Bender 3mo ago
I use Unbound locally as a DoH server. The Alpine Linux Unbound package is compiled with libnghttp2, required for the built in DoH listener. That's more than enough to enable ECH [1]. I pre-cache all the domains I use hourly via cron. My ISP is not going to dork with my DNS requests and their employees are bigger deviants than I. If I ever started browsing the web from a phone I would just set up my own public DoH server. It only takes a few minutes and gives me my own query logs for debugging weird issues. [1] - https://tls-ech.dev/ https://tls-ech.dev/
- harshreality 3mo ago
  Why pre-cache? For speed... what is it, 30-50ms at most? If the authoritative server's TTL is <60minutes, do you force it to 3600? Do you audit all the connections that occur for every website you visit, collect all the domains hosting assets, and pre-cache those as well, or is the main site's domain the only critical one because that affects perceived latency the most?
  - Bender 3mo ago
    I pre-cache for speed, verifying records that have expired since I retain the expired records for sites that have intermittent DNS issues and also to throw in domains that I do not use in the off chance someone is logging where I go and when. They will see the Cloudflare top 20K domains hourly. Myself and family members have been able to access sites when others around the internet can not due to infrastructure related DNS problems. In other words, when others will say "It's always DNS" for myself and family members that is rarely the case as DNS records do not change as often as people seem to think they do.
    - abcdefg12 3mo ago
      Or you could use dnscrypt so ISP doesn’t see your lookups at all
      - Bender 3mo ago
        When all the authoritative servers support TLS I can enable TLS outbound but very few of them do at the moment. At some point someone is decrypting, turtles all the way down. I could of course just do DoT to another instance of Unbound somewhere else but I do not need to do that as my ISP does not care about my queries. I used to keep standby DoT Unbound servers around but I have never once seen a US ISP tinker with my traffic. If they did I would put up billboards saying they what they are doing.
degenerate 3mo ago
9.9.9.9 with 1.1.1.1 as secondary
- chopin 3mo ago
  I use 9.9.9.9 but it failed me a couple of times in the past two months. Cloudflare is very robust but I just don't like them. Falling back on them silently is not what I want. I am rather using them directly when quad9 fails.
kingo55 3mo ago
It would be nice if a site like this could offer a basic speed comparison test to your local network. Imagine seeing response times at P90 for a series of random lookups and comparing the median response times.
- snailmailman 3mo ago
  I run an instance of smokeping locally for this purpose. It pings a variety of DNS servers (including my ISPs DNS) and several of the top websites. I periodically update my local DNS server’s upstream accordingly. All the big DNS servers are in the 5-6ms range for me, but that hasn’t always been the case. My ISPs DNS is about the same but with crazy variance and spikes of up to 50ms, even though they should be able to be the fastest.
- Bender 3mo ago
  Clone this repo [1] and then edit the domain names and resolvers to your liking. It will be something close to what you might be looking for. [1] - https://github.com/cleanbrowsing/dnsperftest https://github.com/cleanbrowsing/dnsperftest
- pawal 3mo ago
  Author here, I added this now: https://evilbit.de/dns-resolver-guide2.html#speedtest https://evilbit.de/dns-resolver-guide2.html#speedtest Only works for DoH though.
JdeBP 3mo ago
Every time that this comes up, be it a general list like this or someone announcing a new service, my reaction, and that that I see of surprisingly many other people on Hacker News, is fairly unmoved. I've run my own proxy DNS service for about a quarter of a century at this point, using three different sets of softwares on six different operating systems, and every single point on the filter tab is something that I can (and do) just do for myself. The list is not so much interesting for the options that it presents, as far as I am concerned, but for the things that it reveals. Every single entry that is explicitly marked 'China' also has 'operates under Chinese regulations'; which is, in 2026, something that is of concern for more than just the Chinese entries on the list, to people on my continent for starters. 'Run by one individual in Denmark.' is an interesting statement of bus factor, but I don't think that all of the other entries should be assumed to be better just because they are mute on the point. There's far less information about who is behind DNS.Watch than there is about Thomas Steen Rasmussen. And it appears that DNS.Watch went off the air at least once in recent years, so it is a legitimate concern. Then there are all sorts of things not on this list that might matter to people, such as Quad101 looking like it has geographic restrictions on whom it is available to and Gcore being an AI company.
- duskwuff 3mo ago
  > 'Run by one individual in Denmark.' is an interesting statement of bus factor I find it more interesting as a statement about organizational oversight. If there are multiple people involved in operations, they can keep an eye on each other and speak up if they see anything weird going on (e.g. a DNS resolver implementing selective logging or interfering with results). If there's only one person running the show, there's no one to call them out. (And if you're thinking, "but so-and-so is a principled person, they would never do anything like that" - pressure from law enforcement can be a powerful thing.)
  - JdeBP 3mo ago
    It isn't really primarily about organization oversight, though. The weird goings on are in practice usually at the behest of the people paying the salaries of all of the people involved (which includes law enforcement, which goes through corporate channels). There's no real independent oversight for that common case. Everyone is on the payroll. (-: As a concrete thought experiment, consider if (say) a WWW/DNS hosting company providing such free proxy DNS service decided to covertly record the domain name lookups from the general public that fail in order to compile a list of domain names for the company to prospectively squat on. Having multiple employees handling the public service doesn't stop this if it is the company's actual business decision to sneakily do this. It really is a statement of bus factor, not about oversight. To make a statement about oversight one has to take into account something else not covered by this list: which of the list entries has attempted to show some level of independent auditing or oversight of its data protection. * https://blog.cloudflare.com/announcing-the-results-of-the-1-1-1-1-public-dns-resolver-privacy-examination/ https://blog.cloudflare.com/announcing-the-results-of-the-1-... CloudFlare has had some independent auditing done, by an accountancy firm. DNS4EU holds itself subject to GDPR rules on Personal Data with respect to query data, and so is auditable by the Czech ÚOOÚ. AdGuard likewise, except that it holds Personal Data in Frankfurt. CZ.NIC likewise, except that it hasn't actually updated its legal doco since 2018 and it's only by implication that the Czech ÚOOÚ can audit the Personal Data handling under the GDPR. DNS.SB simply disclaims the existence of any Personal Data whatsoever, which as with AdGuard is overseen by the German BfDI and relevant Land authorities (HBDI for Frankfurt). * https://legal-documents-dns4eu.s3.fr-par.scw.cloud/DNS4EU-Public-DNS-Resolver-policy-2025.pdf https://legal-documents-dns4eu.s3.fr-par.scw.cloud/DNS4EU-Pu... * https://uoou.gov.cz https://uoou.gov.cz * https://adguard-dns.io/en/privacy.html https://adguard-dns.io/en/privacy.html * https://nic.cz/files/documents/20180525_Zasady_zpracovani_osobnich_udaju_AJ.pdf https://nic.cz/files/documents/20180525_Zasady_zpracovani_os... * https://dns.sb/privacy/ https://dns.sb/privacy/ * https://bfdi.bund.de/EN/Home/home_node.html https://bfdi.bund.de/EN/Home/home_node.html * https://datenschutz.hessen.de https://datenschutz.hessen.de Even Thomas Steen Rasmussen, who also claims zero Personal Data, would be subject to oversight by the Datatilsynet. * https://datatilsynet.dk https://datatilsynet.dk
deleted 3mo ago
[deleted]
adithyassekhar 3mo ago
Should add one more filter: EDNS client subnets. Some like cloudflare doesn’t support that in the name of privacy. EDNS lets the dns server of the site you are visiting know from where you are connecting and can give you the closest server. 1.1.1.1 does not do that. This breaks all sorts of ISP cache and peering arrangements. Here’s an example: My ISP’s google global cache is broken every time I use cloudflare. With google dns, opendns, isp’s own dns I get my ISP’s own ip address for the domain “googlevideo.com” which is where youtube videos load from. With cloudflare dns I get an ip address of an actual google server which may or may not be in my country. Result: my downloads from google drive/youtube/play store all are faster with a dns server with proper EDNS support. Now imagine this on a global scale for smaller websites, your request might go to a different continent. I understand the product decision for cloudflare and I don’t want them to change but this is something people should know about. There are numerous reports on their forums which are always locked with no activity. I am not saying it’s a conspiracy but this doesn’t affect sites on cloudflare btw due to their global anycast routing/infra setup which I don’t know enough to explain.
- js2 3mo ago
  CTRL-F "ECS: Yes"
- microgpt 3mo ago
  There's some anti-competition going on there too - Cloudflare's own CDN uses anycast, which doesn't need geo-DNS, but some of their competitors use geo-DNS, so Cloudflare actually prefers that geo-DNS is broken.
vzaliva 3mo ago
unfortunately many DNS resolvers are integrated with CDNs. I do want privacy of an independent non-tracking DNS but I also want my video streaming work fast. :(
- progval 3mo ago
  What does it mean for a DNS resolver to be "integrated with CDNs"? And why does that affect streaming speed negatively?
  - zinekeller 3mo ago
    Some CDNs (like Cloudflare) use solely BGP anycast steering for routing to the "nearest" server. Other CDNs (like Akamai, Fastly, Netflix, and YouTube) use a hybrid BGP-DNS steering because some ISPs have extremely questionable routing practices. Unfortunately, if the CDN only rely on BGP steering (or conversely if you are a user who is stuck on an ISP monopoly), there are cases where this is not necessarily the nearest network-wise (or performant network-wise) if there are peering disputes. If the said ISP is a virtual monopoly or (worse) state-sanctioned to collect network "toll fees" (like in South Korea), non-preferred and international routes are (intentionally) congested.* If you use a third-party DNS, you basically lose this DNS optimization, and ECS does not fully solve this (because sometimes the DNS override are placed only on the ISP's recursive DNS servers). You're basically in a lose-lose position: either use third-party servers and the IP addresses served to you on popular CDNs are in the congested path, or use the often-unreliable and heavily-logged ISP-provided DNS. * Usually. There are exceptions, but this comment is just a simplification of the complexities of real-life networking (where RFCs and mutual cooperation die out without fanfare). Edit for further reading: DNS is the new BGP by Geoff Huston of APNIC (https://ispcol.potaroo.net/2023-09/service-routing.html https://ispcol.potaroo.net/2023-09/service-routing.html), How LinkedIn used PoPs and RUM to make dynamic content download 25% faster from the old LinkedIn engineering team (Archived at https://web.archive.org/web/20160310065302/https://engineering.linkedin.com/performance/how-linkedin-used-pops-and-rum-make-dynamic-content-download-25-faster https://web.archive.org/web/20160310065302/https://engineeri...), Wikimedia's mapping of their CDNs (https://gerrit.wikimedia.org/r/plugins/gitiles/operations/dns/+/refs/heads/master/geo-maps https://gerrit.wikimedia.org/r/plugins/gitiles/operations/dn...)
kev009 3mo ago
I always just set up root recursors at my home and other locations. I've never noticed any downside.
- icedchai 3mo ago
  Same. I’ve been running my own caching DNS servers since my earliest home network, dating back almost 30 years.
- colinsane 3mo ago
  the _one_ downside i've seen is on an airplane serviced by Starlink: UDP was extremely lossy to the point that whatever recursive resolver i was using at the time would mark half of all nameservers it saw as "unhealthy" and start returning NXDOMAINs to the clients before even trying to hit the authoritative NS.
- themacguffinman 3mo ago
  The downside is obviously that uncached queries take much longer (adding >100ms) and more queries are uncached since you can't share the cache with a large user-base. Unless you just visit the same websites over and over again, this results in worse overall performance.
  - kev009 3mo ago
    I've never felt this. Most large services run or delegate to anycast DNS services. If you have knowledge of TCP, you know you will occasionally get stalls much greater than that beyond control.
- abcdefg12 3mo ago
  Downside is privacy
  - kev009 3mo ago
    Versus letting a singular entity snoop everything? If you actually open a connection to the result what is the difference? The only way to fully deal with all that is an overlay or mixnets.
exiguus 3mo ago
Most important and super privacy/security related topic: DNS. Instead of choosing a public one. Host your own infrastructure. You don't need public instances. Just run ADGUARD or unbound/dnsmasq/dnsdist in recursive mode on your router or machine. And you can set limits and block-lists to your needs.
- abcdefg12 3mo ago
  And your isp can record all your queries
  - exiguus 3mo ago
    Do you mean when communicating directly with a root DNS server over unencrypted UDP or TCP? You're right. There's currently no universal way to encrypt direct queries to root DNS servers. To work around this, the best approach is to host your own public DNS server outside your untrusted ISPs network and connect to it securely using DoH, DoQ, or DoT. Alternatively, you can rely on a trusted third-party public DNS provider that supports encrypted connections. In the end, there's no perfect solution. You have to choose who to trust. Personally, I trust my ISP more than external DNS providers. For anonymity you could route your DNS root queries throe tor or a VPN for the cost of performance. I also used third-party public resolvers before. Mainly FFM (its not on the list) but non-profit, EU and encrypted. If you boil down the list (from the website) to this categories, you have 4 providers. You can trust, in my opinion. But the problem with all this provider is, that you ran quick into rate limits or some query type restrictions. Especially if you run your own mail server or other DNS expensive task. Fun fact about hosting your own DNS infrastructure and offering it to friends and family: They might actually trust other providers more than they trust you. Even if they know and trust you personally. Because they know you can theoretically read their queries, it’s more convenient for them to have a stranger do it instead.
    - microgpt 3mo ago
      Your friends and family probably don't know what DNS privacy is. If they do know, they'll already be hosting their own. They will care if it works better. When my ISP fucked up DNS once I had my family use mine instead.
Shitty-kitty 3mo ago
DNScryptProxy maintains a extensive list of public DNS servers. It also lists if if they do Dnssec, filetering, logging. https://download.dnscrypt.info/dnscrypt-resolvers/v3/public-resolvers.md https://download.dnscrypt.info/dnscrypt-resolvers/v3/public-...
sevg 3mo ago
Happy NextDNS user. Lots of configurability, including which filterlists to enable, configurable logging etc. Plus it’s reliable and fast from basically anywhere (which is harder to achieve if I ran my own resolvers in the cloud, and anyway I don’t want to have to maintain that).
- flyingzucchini 3mo ago
  Yeah it’s been pretty good for me too.
- HelloUsername 3mo ago
  > Happy NextDNS user Yup, same here, especially after hears of messing around with a pihole and got tired of maintaining it. Also, NextDNS works easily with Mullvad VPN, when needed.
itake 3mo ago
Does anyone have advice on how to use public wifi alongside DNS resolver? Many public wifi network works need you to use their DNS, so they can redirect you to a gated "accept ToS" screen (and may even require re-approval every 30-60 minutes). To resolve the issue is so frustrating: 1. realize the internet stopped working 2. ping google.com, wait for timeouts to show up. 3. try to guess if its a ISP issue, but then realize the wifi probably timed out. 4. Switch the dns. Flush DNS. 5. try to access a non-TLS domain 6. approve the gate 7. switch the DNS back There has to be something that manages this
- charcircuit 3mo ago
  This is something your OS should handle as part of the OS's support for captive portals. I'd recommend contacting your OS's creator about this and filing a bug.
- boramalper 3mo ago
  For macOS and iOS, you can create a profile to configure which DNS server you want to use at all times (including across different Wi-Fi networks and mobile data). See: https://doh.lvv.me/ https://doh.lvv.me/ That’s what I’ve been using for years and never had any issues with public hotspots.
  - itake 3mo ago
    I want the DNS to resolve the captive portal when it needs too. I think if I force the dns this way, the public dns won’t resolve the captive portal. When the internet is cut, it needs to use the network’s dns to resolve the captive portal domain (whatever that is)
- jer0me 3mo ago
  On macOS, you might be able to use /etc/resolver to fix this: sudo sh -c 'echo "nameserver 192.168.1.1" > /etc/resolver/captive.apple.com' I did this for an internal website at my university that could only be resolved using the network name server. It just occurred to me that it might also work for the URL macOS uses to detect captive portals. We'll have to see if it works the next time I'm at a café.
flyingzucchini 3mo ago
Interesting puzzle on the top level url… what’s that all about ?
- gblargg 3mo ago
  Google's AI Mode was pretty effective at solving it. I'm impressed. I just copied and pasted the two lines.
ValentineC 3mo ago
Random, but I don't understand why anyone would choose a "block ads and trackers" DNS server as a default. Even if it's configuring something for boomer family, that sounds like a recipe for "why is this website not working"?
- Scroll_Swe 3mo ago
  Because to me even as an IT person it sounds like a good idea on the surface. To have no connections to/form ads, malware, c2. But yes, then you happen upon your first false positive. And you switch back to a non filtered DNS OR one that you can whitelist or control, still annoying.
- vachina 3mo ago
  Because it is very useful on mobile. App typically use an advertising SDK for their monetisation, which means we can BLOCK THEM ALLLLLLL
- TacticalCoder 3mo ago
  > Random, but I don't understand why anyone would choose a "block ads and trackers" DNS server as a default. I use a "block known malware and known porn sites" and then, on top of that, I use gigantic blocklists blocking known ads and trackers. But then I've got a whitelist of allowed domains, which I updated on-the-go if that one site wife really needed wasn't working due to overzealous filtering. The reason is simple: browsing with ads and trackers blocked at the DNS level feels not just a bit but much snappier (and there's not need to play cat and mouse with browsers' extensions). And privacy. I've got a pretty advanced unbound DNS server, blocking ads, trackers, known porn, known malware and shitloads of homoglyph attacks. Took some time to set up but after that it's smooth sailing. My old Pi 3 running unbound stays always on. The only time I turn it off is when I leave for vacation. It's just that stable. Gen Xer here, not a boomer.
  - ValentineC 3mo ago
    > But then I've got a whitelist of allowed domains, which I updated on-the-go if that one site wife really needed wasn't working due to overzealous filtering. That's fine. I'm just puzzled why people would want to use a "block ads and tracking" DNS server without a whitelist feature.
EbNar 3mo ago
ControlD is pretty cool.
- nticompass 3mo ago
  +1 for ControlD. I've been using for a while, and whilst it does have false positives sometimes and I need to manually add a site to the allow list, it works great for me. Also, their support has been very helpful whenever I needed something.
amaccuish 3mo ago
Shame there is no client subnet filter. I've had issues in the past with various websites when using resolvers that don't add that hint.
w4yai 3mo ago
jabberwocky !
rswail 3mo ago
What would be the additional load if everyone ran a local caching recursive resolver like unbound? It would need to be built into iOS/Android/Linux/Windows/MacOS but what would be the disadvantages? I can see greater load on root servers but caching is specifically designed to reduce that. I can see potential problems for CDNs and equivalent geo-based resolvers. But are they really that bad?
- microgpt 3mo ago
  Id expect better geo performance because the geo domain is queried from the actual customer and not from some proxy that is hopefully nearby them
- hardaker 3mo ago
  To avoid hitting the root, don't send your queries there! Problem solved! localroot.isi.edu Bias: I created it, and am a author of one potential set of future specifications (rewrite).
  - rswail 3mo ago
    Thanks, interesting, I like making my systems as stand-alone capable as possible :) What is the primary difference between using an Unbound auth-zone (as described in the RFC) compared to localroot?
    - hardaker 3mo ago
      They're both good. The localroot service offered at B-Root does authenticated transfers (TSIG protected) and gives you update notifications to ensure you're notified as soon as the root changes. Otherwise you may be an hour behind or so (at worst). Both methods are fine. It would be best if unbound does ZONEMD checking to ensure the file you receive is properly protected from modification from any network in the middle, and I don't remember without looking what version (and if) Unbound does this. If they don't yet, it's coming soon. With the LocalRoot service at ISI, the TSIG protection gives you this (and is older than the ZONEMD record that is now available in the root zone).
import 3mo ago
Why cloudflare is listed under maximum privacy?
- pawal 3mo ago
  Author here: Because of their continuing work on privacy, https://blog.cloudflare.com/1111-privacy-examination-2026/ https://blog.cloudflare.com/1111-privacy-examination-2026/ However, as a EU citizen, I would not trust them anyway because of FISA 702.
whalesalad 3mo ago
ok now add benchmarking a-la https://www.grc.com/dns/benchmark.htm https://www.grc.com/dns/benchmark.htm to rank them on performance for your specific region etc. note on privacy: if you are using port 53 you are cooked so make sure you are using dns-over-tls or dns-over-https.
- pawal 3mo ago
  Done, enjoy: https://evilbit.de/dns-resolver-guide.html#speedtest https://evilbit.de/dns-resolver-guide.html#speedtest (DoH only)
aetherspawn 3mo ago
Use your ISPs official DNS so that you get the shortest path possible from the ISPs handoff location to the CDN (and overseas trunks), not a generic DNS that doesn’t know about your ISPs layout. ISP: 1ms to Cloudflare Cloudflare: 10ms to Cloudflare Thank you for your attention to this matter. Edit: will clarify, this advice applies to countries with good privacy laws and no national surveillance i.e. not the USA
- layer8 3mo ago
  That’s no good if you want uncensored DNS.
  - 1970-01-01 3mo ago
    Absolutely this. Parent advice is terrible for the reality of the problem. Shortest path does not equal fastest web page load, especially when you're filtering 99% of the crap from even resolving on your network. 0.0.0.0 is always faster than your ISP fetching extra garbage.
    - aetherspawn 3mo ago
      More detailed response below, but I believe the best way is to use a router that can filter DNS requests (ie Unifi), and set the upstream of that to your ISP. You can set the DNS server of your entire LAN using Network options without setting it on the individual devices. It’s up to the end-device whether it uses it or not, but 99%-ish do.
- deleted 3mo ago
  [deleted]
- marginalia_nu 3mo ago
  Changing your DNS does basically bupkis for privacy, since they can still read your DNS queries and SNIs.
  - deleted 3mo ago
    [deleted]
nativeforks 3mo ago
I've been using 1.1.1.1 for performance rather than privacy. Maybe I should revisit that decision after reading this.
- daneel_w 3mo ago
  Quad9.
xorcist 3mo ago
Without a purpose for why you should use a public resolver it is an impossible choice to make. If it is this hard to choose a resolver, imagine how hard it is to choose a web browser, which is a choice that actually matters. The nearest resolver is $ sudo apt-get install unbound and now your own host is your resolver. The complexity of this is roughly a millionth of a percent of that of your web browser.
opengears 3mo ago
take a look at adguard home, dnsmask or unbound. the best is to run your own infra
asploder 3mo ago
For my fellow Canadians, CIRA operates public resolvers over IPv4/IPv6/DoH/DoT. https://www.cira.ca/en/canadian-shield/configure/summary-cira-canadian-shield-dns-resolver-addresses/ https://www.cira.ca/en/canadian-shield/configure/summary-cir...
- soupbowl 3mo ago
  Why should Canadians trust CIRA over anything else? I guess it is probably better than using your stock ISP DNS.
1vuio0pswjnm7 3mo ago
Why only 29 Is the author suggesting this represents the actual number of open resolvers on today's internet How can any consideration of "privacy" or "security" of DNS not also consider SNI SNI allows third parties to see when the user tries to connect to an address published for a domain name. It can allow third parties to interfere with such connections DNS only allows third parties to see when a user looks up an address published for a domain name. To associate non-DNS traffic with these queries requires assumptions about the software that is sending them Hence it is not surprising the advertising companies that control the popular web browsers want users to choose DoH _within the browser_ or corporate OS, deceptively labeled as "private DNS"^1, so these third parties can more effectively correlate these queries with non-DNS traffic from browsers or software running on corporate OS 1. Perhaps these companies will be sued for these deceptive claims. For example, users have successfully sued for deceptive claims about "private browsing"
- pawal 3mo ago
  The author merely suggests that those 29 or in someway trusted by a lot of people to handle DNS queries. Those 29 also publish information on what properties the service have. If you read the whole page, the author also lists other publi DNS resolvers worth a mention. For the long tail of unknown open DNS resolvers, use Shodan. But I would not suggest that you use any findings from Shodan to trust your internet usage with. Yes, SNI is a generic internet privacy problem. However, it is not a property of DNS. On the positive side, ECH has been pushed through the IETF and should slowly be available to the general user. / The author
- 1vuio0pswjnm7 3mo ago
  ECH is not generally available to www users aside from a few "test" sites It is not clear to whom the term "you" refers in the author's reply As for myself, I do not use remote DNS except to periodically retrieve bulk DNS data. When I am accessing HTTP servers I do not make remote DNS requests. I already have the IP address information I need. For me, this is faster and more reliable I store bulk DNS data, obtained from a variety of sources, loaded into the memory of local TLS forward proxies Every user is different and each user should think for themselves
h4kunamata 3mo ago
Public DNS is blackbox, they always have problems especially if you are using your ISP. I run my own Unbound recursive DNS, it only talks with the 13 root nameservers and has its own caching, the subsequent requests are lightning fast. It is for local use only, it is not exposed to the public. When I leave home, I have a WireGuard VPN at home so my phone connects to it and the full traffic is sent via my home network. Everything works flawlessly for the past 5 years or so.

285 points by pawal 3mo ago

Obsessive5300 3mo ago

[dead]

denkmoon 3mo ago

9.9.9.9 is all you need

_def 3mo ago

quad9 seems fine. Glad there are a bunch of alternatives though. We should never stop practicing decentralization in the net.

mzajc 3mo ago
Be cautious with Quad9; their main address (9.9.9.9) has a "malware" blacklist that has misfired several times already: twice for a private torrent tracker, once for gist.github.com, issue was resolved within minutes to hours. They have a non-filtered address (9.9.9.10), but it doesn't do DNSSEC verification. IMO they're too unreliable to be worth the hassle.
- deleted 3mo ago
  [deleted]
- johnhtodd 3mo ago
  Quad9 employs DNSSEC on all endpoints now. https://quad9.net/news/blog/quad9-enables-dnssec-on-all-service-endpoints/ https://quad9.net/news/blog/quad9-enables-dnssec-on-all-serv...
  - mzajc 3mo ago
    This is great, thanks for the correction! I tried resolving dnssec-failed.org and it does indeed fail with EDE 6 (DNSSEC Bogus). I'm not sure why this hasn't been updated on the info page[0] yet, given that the change is about three months old. [0]: https://quad9.net/service/service-addresses-and-features/ https://quad9.net/service/service-addresses-and-features/
- Scroll_Swe 3mo ago
  Was about to comment this. I actually don't like advert or malware blocking on my public DNS resolvers. It sounds cool but annoying when it misfires. Once Quad9 blocked Halo MCC XBOX Live -> Steam achievements, several fileshare services (probably used for malware somewhere but not my usage) etc... 1.1.1.1 blocked archive.is or got blocked by them or something... Gone back to Google DNS (gasp) for now, yes as a European... no blocking, fast, never goes down.
  - ethanhawksley 3mo ago
    I believe cloudflare only blocked archive.is on their "Families" filtered dns. I've been using their normal 1.1.1.1 and haven't encountered any blocks.
    - jaychandra68 3mo ago
      Yesterday 1.1.1.1 failed to resolved "theinformation.com" (hosted on CF itself!) for many hours, answering NXDOMAIN.
    - vitus 3mo ago
      IIRC the block was on archive.today's side as a protest against 1.1.1.1 intentionally not supporting ECS. https://news.ycombinator.com/item?id=36971650 https://news.ycombinator.com/item?id=36971650 https://news.ycombinator.com/item?id=19828702 https://news.ycombinator.com/item?id=19828702
      - Scroll_Swe 3mo ago
        This is what I am referring to. But from an end-user side, one option does not work, and one does work. Then I will use the working DNS.
  - microgpt 3mo ago
    It's fine when it's a non default option. Like use x.x.x.x for DNS, x.x.x.y for DNS+adblocking, x.x.x.z for totalitarian corporate blocklist that doesn't let you do anything fun

Bender 3mo ago

I use Unbound locally as a DoH server. The Alpine Linux Unbound package is compiled with libnghttp2, required for the built in DoH listener. That's more than enough to enable ECH [1]. I pre-cache all the domains I use hourly via cron. My ISP is not going to dork with my DNS requests and their employees are bigger deviants than I. If I ever started browsing the web from a phone I would just set up my own public DoH server. It only takes a few minutes and gives me my own query logs for debugging weird issues. [1] - https://tls-ech.dev/ https://tls-ech.dev/

harshreality 3mo ago
Why pre-cache? For speed... what is it, 30-50ms at most? If the authoritative server's TTL is <60minutes, do you force it to 3600? Do you audit all the connections that occur for every website you visit, collect all the domains hosting assets, and pre-cache those as well, or is the main site's domain the only critical one because that affects perceived latency the most?
- Bender 3mo ago
  I pre-cache for speed, verifying records that have expired since I retain the expired records for sites that have intermittent DNS issues and also to throw in domains that I do not use in the off chance someone is logging where I go and when. They will see the Cloudflare top 20K domains hourly. Myself and family members have been able to access sites when others around the internet can not due to infrastructure related DNS problems. In other words, when others will say "It's always DNS" for myself and family members that is rarely the case as DNS records do not change as often as people seem to think they do.
  - abcdefg12 3mo ago
    Or you could use dnscrypt so ISP doesn’t see your lookups at all
    - Bender 3mo ago
      When all the authoritative servers support TLS I can enable TLS outbound but very few of them do at the moment. At some point someone is decrypting, turtles all the way down. I could of course just do DoT to another instance of Unbound somewhere else but I do not need to do that as my ISP does not care about my queries. I used to keep standby DoT Unbound servers around but I have never once seen a US ISP tinker with my traffic. If they did I would put up billboards saying they what they are doing.

degenerate 3mo ago

9.9.9.9 with 1.1.1.1 as secondary

chopin 3mo ago
I use 9.9.9.9 but it failed me a couple of times in the past two months. Cloudflare is very robust but I just don't like them. Falling back on them silently is not what I want. I am rather using them directly when quad9 fails.

kingo55 3mo ago

It would be nice if a site like this could offer a basic speed comparison test to your local network. Imagine seeing response times at P90 for a series of random lookups and comparing the median response times.

snailmailman 3mo ago
I run an instance of smokeping locally for this purpose. It pings a variety of DNS servers (including my ISPs DNS) and several of the top websites. I periodically update my local DNS server’s upstream accordingly. All the big DNS servers are in the 5-6ms range for me, but that hasn’t always been the case. My ISPs DNS is about the same but with crazy variance and spikes of up to 50ms, even though they should be able to be the fastest.
Bender 3mo ago
Clone this repo [1] and then edit the domain names and resolvers to your liking. It will be something close to what you might be looking for. [1] - https://github.com/cleanbrowsing/dnsperftest https://github.com/cleanbrowsing/dnsperftest
pawal 3mo ago
Author here, I added this now: https://evilbit.de/dns-resolver-guide2.html#speedtest https://evilbit.de/dns-resolver-guide2.html#speedtest Only works for DoH though.

JdeBP 3mo ago

Every time that this comes up, be it a general list like this or someone announcing a new service, my reaction, and that that I see of surprisingly many other people on Hacker News, is fairly unmoved. I've run my own proxy DNS service for about a quarter of a century at this point, using three different sets of softwares on six different operating systems, and every single point on the filter tab is something that I can (and do) just do for myself. The list is not so much interesting for the options that it presents, as far as I am concerned, but for the things that it reveals. Every single entry that is explicitly marked 'China' also has 'operates under Chinese regulations'; which is, in 2026, something that is of concern for more than just the Chinese entries on the list, to people on my continent for starters. 'Run by one individual in Denmark.' is an interesting statement of bus factor, but I don't think that all of the other entries should be assumed to be better just because they are mute on the point. There's far less information about who is behind DNS.Watch than there is about Thomas Steen Rasmussen. And it appears that DNS.Watch went off the air at least once in recent years, so it is a legitimate concern. Then there are all sorts of things not on this list that might matter to people, such as Quad101 looking like it has geographic restrictions on whom it is available to and Gcore being an AI company.

duskwuff 3mo ago
> 'Run by one individual in Denmark.' is an interesting statement of bus factor I find it more interesting as a statement about organizational oversight. If there are multiple people involved in operations, they can keep an eye on each other and speak up if they see anything weird going on (e.g. a DNS resolver implementing selective logging or interfering with results). If there's only one person running the show, there's no one to call them out. (And if you're thinking, "but so-and-so is a principled person, they would never do anything like that" - pressure from law enforcement can be a powerful thing.)
- JdeBP 3mo ago
  It isn't really primarily about organization oversight, though. The weird goings on are in practice usually at the behest of the people paying the salaries of all of the people involved (which includes law enforcement, which goes through corporate channels). There's no real independent oversight for that common case. Everyone is on the payroll. (-: As a concrete thought experiment, consider if (say) a WWW/DNS hosting company providing such free proxy DNS service decided to covertly record the domain name lookups from the general public that fail in order to compile a list of domain names for the company to prospectively squat on. Having multiple employees handling the public service doesn't stop this if it is the company's actual business decision to sneakily do this. It really is a statement of bus factor, not about oversight. To make a statement about oversight one has to take into account something else not covered by this list: which of the list entries has attempted to show some level of independent auditing or oversight of its data protection. * https://blog.cloudflare.com/announcing-the-results-of-the-1-1-1-1-public-dns-resolver-privacy-examination/ https://blog.cloudflare.com/announcing-the-results-of-the-1-... CloudFlare has had some independent auditing done, by an accountancy firm. DNS4EU holds itself subject to GDPR rules on Personal Data with respect to query data, and so is auditable by the Czech ÚOOÚ. AdGuard likewise, except that it holds Personal Data in Frankfurt. CZ.NIC likewise, except that it hasn't actually updated its legal doco since 2018 and it's only by implication that the Czech ÚOOÚ can audit the Personal Data handling under the GDPR. DNS.SB simply disclaims the existence of any Personal Data whatsoever, which as with AdGuard is overseen by the German BfDI and relevant Land authorities (HBDI for Frankfurt). * https://legal-documents-dns4eu.s3.fr-par.scw.cloud/DNS4EU-Public-DNS-Resolver-policy-2025.pdf https://legal-documents-dns4eu.s3.fr-par.scw.cloud/DNS4EU-Pu... * https://uoou.gov.cz https://uoou.gov.cz * https://adguard-dns.io/en/privacy.html https://adguard-dns.io/en/privacy.html * https://nic.cz/files/documents/20180525_Zasady_zpracovani_osobnich_udaju_AJ.pdf https://nic.cz/files/documents/20180525_Zasady_zpracovani_os... * https://dns.sb/privacy/ https://dns.sb/privacy/ * https://bfdi.bund.de/EN/Home/home_node.html https://bfdi.bund.de/EN/Home/home_node.html * https://datenschutz.hessen.de https://datenschutz.hessen.de Even Thomas Steen Rasmussen, who also claims zero Personal Data, would be subject to oversight by the Datatilsynet. * https://datatilsynet.dk https://datatilsynet.dk

deleted 3mo ago

[deleted]

adithyassekhar 3mo ago

Should add one more filter: EDNS client subnets. Some like cloudflare doesn’t support that in the name of privacy. EDNS lets the dns server of the site you are visiting know from where you are connecting and can give you the closest server. 1.1.1.1 does not do that. This breaks all sorts of ISP cache and peering arrangements. Here’s an example: My ISP’s google global cache is broken every time I use cloudflare. With google dns, opendns, isp’s own dns I get my ISP’s own ip address for the domain “googlevideo.com” which is where youtube videos load from. With cloudflare dns I get an ip address of an actual google server which may or may not be in my country. Result: my downloads from google drive/youtube/play store all are faster with a dns server with proper EDNS support. Now imagine this on a global scale for smaller websites, your request might go to a different continent. I understand the product decision for cloudflare and I don’t want them to change but this is something people should know about. There are numerous reports on their forums which are always locked with no activity. I am not saying it’s a conspiracy but this doesn’t affect sites on cloudflare btw due to their global anycast routing/infra setup which I don’t know enough to explain.

js2 3mo ago
CTRL-F "ECS: Yes"
microgpt 3mo ago
There's some anti-competition going on there too - Cloudflare's own CDN uses anycast, which doesn't need geo-DNS, but some of their competitors use geo-DNS, so Cloudflare actually prefers that geo-DNS is broken.

vzaliva 3mo ago

unfortunately many DNS resolvers are integrated with CDNs. I do want privacy of an independent non-tracking DNS but I also want my video streaming work fast. :(

progval 3mo ago
What does it mean for a DNS resolver to be "integrated with CDNs"? And why does that affect streaming speed negatively?
- zinekeller 3mo ago
  Some CDNs (like Cloudflare) use solely BGP anycast steering for routing to the "nearest" server. Other CDNs (like Akamai, Fastly, Netflix, and YouTube) use a hybrid BGP-DNS steering because some ISPs have extremely questionable routing practices. Unfortunately, if the CDN only rely on BGP steering (or conversely if you are a user who is stuck on an ISP monopoly), there are cases where this is not necessarily the nearest network-wise (or performant network-wise) if there are peering disputes. If the said ISP is a virtual monopoly or (worse) state-sanctioned to collect network "toll fees" (like in South Korea), non-preferred and international routes are (intentionally) congested.* If you use a third-party DNS, you basically lose this DNS optimization, and ECS does not fully solve this (because sometimes the DNS override are placed only on the ISP's recursive DNS servers). You're basically in a lose-lose position: either use third-party servers and the IP addresses served to you on popular CDNs are in the congested path, or use the often-unreliable and heavily-logged ISP-provided DNS. * Usually. There are exceptions, but this comment is just a simplification of the complexities of real-life networking (where RFCs and mutual cooperation die out without fanfare). Edit for further reading: DNS is the new BGP by Geoff Huston of APNIC (https://ispcol.potaroo.net/2023-09/service-routing.html https://ispcol.potaroo.net/2023-09/service-routing.html), How LinkedIn used PoPs and RUM to make dynamic content download 25% faster from the old LinkedIn engineering team (Archived at https://web.archive.org/web/20160310065302/https://engineering.linkedin.com/performance/how-linkedin-used-pops-and-rum-make-dynamic-content-download-25-faster https://web.archive.org/web/20160310065302/https://engineeri...), Wikimedia's mapping of their CDNs (https://gerrit.wikimedia.org/r/plugins/gitiles/operations/dns/+/refs/heads/master/geo-maps https://gerrit.wikimedia.org/r/plugins/gitiles/operations/dn...)

kev009 3mo ago

I always just set up root recursors at my home and other locations. I've never noticed any downside.

icedchai 3mo ago
Same. I’ve been running my own caching DNS servers since my earliest home network, dating back almost 30 years.
colinsane 3mo ago
the _one_ downside i've seen is on an airplane serviced by Starlink: UDP was extremely lossy to the point that whatever recursive resolver i was using at the time would mark half of all nameservers it saw as "unhealthy" and start returning NXDOMAINs to the clients before even trying to hit the authoritative NS.
themacguffinman 3mo ago
The downside is obviously that uncached queries take much longer (adding >100ms) and more queries are uncached since you can't share the cache with a large user-base. Unless you just visit the same websites over and over again, this results in worse overall performance.
- kev009 3mo ago
  I've never felt this. Most large services run or delegate to anycast DNS services. If you have knowledge of TCP, you know you will occasionally get stalls much greater than that beyond control.
abcdefg12 3mo ago
Downside is privacy
- kev009 3mo ago
  Versus letting a singular entity snoop everything? If you actually open a connection to the result what is the difference? The only way to fully deal with all that is an overlay or mixnets.

exiguus 3mo ago

Most important and super privacy/security related topic: DNS. Instead of choosing a public one. Host your own infrastructure. You don't need public instances. Just run ADGUARD or unbound/dnsmasq/dnsdist in recursive mode on your router or machine. And you can set limits and block-lists to your needs.

abcdefg12 3mo ago
And your isp can record all your queries
- exiguus 3mo ago
  Do you mean when communicating directly with a root DNS server over unencrypted UDP or TCP? You're right. There's currently no universal way to encrypt direct queries to root DNS servers. To work around this, the best approach is to host your own public DNS server outside your untrusted ISPs network and connect to it securely using DoH, DoQ, or DoT. Alternatively, you can rely on a trusted third-party public DNS provider that supports encrypted connections. In the end, there's no perfect solution. You have to choose who to trust. Personally, I trust my ISP more than external DNS providers. For anonymity you could route your DNS root queries throe tor or a VPN for the cost of performance. I also used third-party public resolvers before. Mainly FFM (its not on the list) but non-profit, EU and encrypted. If you boil down the list (from the website) to this categories, you have 4 providers. You can trust, in my opinion. But the problem with all this provider is, that you ran quick into rate limits or some query type restrictions. Especially if you run your own mail server or other DNS expensive task. Fun fact about hosting your own DNS infrastructure and offering it to friends and family: They might actually trust other providers more than they trust you. Even if they know and trust you personally. Because they know you can theoretically read their queries, it’s more convenient for them to have a stranger do it instead.
  - microgpt 3mo ago
    Your friends and family probably don't know what DNS privacy is. If they do know, they'll already be hosting their own. They will care if it works better. When my ISP fucked up DNS once I had my family use mine instead.

Shitty-kitty 3mo ago

DNScryptProxy maintains a extensive list of public DNS servers. It also lists if if they do Dnssec, filetering, logging. https://download.dnscrypt.info/dnscrypt-resolvers/v3/public-resolvers.md https://download.dnscrypt.info/dnscrypt-resolvers/v3/public-...

sevg 3mo ago

Happy NextDNS user. Lots of configurability, including which filterlists to enable, configurable logging etc. Plus it’s reliable and fast from basically anywhere (which is harder to achieve if I ran my own resolvers in the cloud, and anyway I don’t want to have to maintain that).

flyingzucchini 3mo ago
Yeah it’s been pretty good for me too.
HelloUsername 3mo ago
> Happy NextDNS user Yup, same here, especially after hears of messing around with a pihole and got tired of maintaining it. Also, NextDNS works easily with Mullvad VPN, when needed.

itake 3mo ago

Does anyone have advice on how to use public wifi alongside DNS resolver? Many public wifi network works need you to use their DNS, so they can redirect you to a gated "accept ToS" screen (and may even require re-approval every 30-60 minutes). To resolve the issue is so frustrating: 1. realize the internet stopped working 2. ping google.com, wait for timeouts to show up. 3. try to guess if its a ISP issue, but then realize the wifi probably timed out. 4. Switch the dns. Flush DNS. 5. try to access a non-TLS domain 6. approve the gate 7. switch the DNS back There has to be something that manages this

charcircuit 3mo ago
This is something your OS should handle as part of the OS's support for captive portals. I'd recommend contacting your OS's creator about this and filing a bug.
boramalper 3mo ago
For macOS and iOS, you can create a profile to configure which DNS server you want to use at all times (including across different Wi-Fi networks and mobile data). See: https://doh.lvv.me/ https://doh.lvv.me/ That’s what I’ve been using for years and never had any issues with public hotspots.
- itake 3mo ago
  I want the DNS to resolve the captive portal when it needs too. I think if I force the dns this way, the public dns won’t resolve the captive portal. When the internet is cut, it needs to use the network’s dns to resolve the captive portal domain (whatever that is)
jer0me 3mo ago
On macOS, you might be able to use /etc/resolver to fix this: sudo sh -c 'echo "nameserver 192.168.1.1" > /etc/resolver/captive.apple.com' I did this for an internal website at my university that could only be resolved using the network name server. It just occurred to me that it might also work for the URL macOS uses to detect captive portals. We'll have to see if it works the next time I'm at a café.

flyingzucchini 3mo ago

Interesting puzzle on the top level url… what’s that all about ?

gblargg 3mo ago
Google's AI Mode was pretty effective at solving it. I'm impressed. I just copied and pasted the two lines.

ValentineC 3mo ago

Random, but I don't understand why anyone would choose a "block ads and trackers" DNS server as a default. Even if it's configuring something for boomer family, that sounds like a recipe for "why is this website not working"?

Scroll_Swe 3mo ago
Because to me even as an IT person it sounds like a good idea on the surface. To have no connections to/form ads, malware, c2. But yes, then you happen upon your first false positive. And you switch back to a non filtered DNS OR one that you can whitelist or control, still annoying.
vachina 3mo ago
Because it is very useful on mobile. App typically use an advertising SDK for their monetisation, which means we can BLOCK THEM ALLLLLLL
TacticalCoder 3mo ago
> Random, but I don't understand why anyone would choose a "block ads and trackers" DNS server as a default. I use a "block known malware and known porn sites" and then, on top of that, I use gigantic blocklists blocking known ads and trackers. But then I've got a whitelist of allowed domains, which I updated on-the-go if that one site wife really needed wasn't working due to overzealous filtering. The reason is simple: browsing with ads and trackers blocked at the DNS level feels not just a bit but much snappier (and there's not need to play cat and mouse with browsers' extensions). And privacy. I've got a pretty advanced unbound DNS server, blocking ads, trackers, known porn, known malware and shitloads of homoglyph attacks. Took some time to set up but after that it's smooth sailing. My old Pi 3 running unbound stays always on. The only time I turn it off is when I leave for vacation. It's just that stable. Gen Xer here, not a boomer.
- ValentineC 3mo ago
  > But then I've got a whitelist of allowed domains, which I updated on-the-go if that one site wife really needed wasn't working due to overzealous filtering. That's fine. I'm just puzzled why people would want to use a "block ads and tracking" DNS server without a whitelist feature.

EbNar 3mo ago

ControlD is pretty cool.

nticompass 3mo ago
+1 for ControlD. I've been using for a while, and whilst it does have false positives sometimes and I need to manually add a site to the allow list, it works great for me. Also, their support has been very helpful whenever I needed something.

amaccuish 3mo ago

Shame there is no client subnet filter. I've had issues in the past with various websites when using resolvers that don't add that hint.

w4yai 3mo ago

jabberwocky !

rswail 3mo ago

What would be the additional load if everyone ran a local caching recursive resolver like unbound? It would need to be built into iOS/Android/Linux/Windows/MacOS but what would be the disadvantages? I can see greater load on root servers but caching is specifically designed to reduce that. I can see potential problems for CDNs and equivalent geo-based resolvers. But are they really that bad?

microgpt 3mo ago
Id expect better geo performance because the geo domain is queried from the actual customer and not from some proxy that is hopefully nearby them
hardaker 3mo ago
To avoid hitting the root, don't send your queries there! Problem solved! localroot.isi.edu Bias: I created it, and am a author of one potential set of future specifications (rewrite).
- rswail 3mo ago
  Thanks, interesting, I like making my systems as stand-alone capable as possible :) What is the primary difference between using an Unbound auth-zone (as described in the RFC) compared to localroot?
  - hardaker 3mo ago
    They're both good. The localroot service offered at B-Root does authenticated transfers (TSIG protected) and gives you update notifications to ensure you're notified as soon as the root changes. Otherwise you may be an hour behind or so (at worst). Both methods are fine. It would be best if unbound does ZONEMD checking to ensure the file you receive is properly protected from modification from any network in the middle, and I don't remember without looking what version (and if) Unbound does this. If they don't yet, it's coming soon. With the LocalRoot service at ISI, the TSIG protection gives you this (and is older than the ZONEMD record that is now available in the root zone).

import 3mo ago

Why cloudflare is listed under maximum privacy?

pawal 3mo ago
Author here: Because of their continuing work on privacy, https://blog.cloudflare.com/1111-privacy-examination-2026/ https://blog.cloudflare.com/1111-privacy-examination-2026/ However, as a EU citizen, I would not trust them anyway because of FISA 702.

whalesalad 3mo ago

ok now add benchmarking a-la https://www.grc.com/dns/benchmark.htm https://www.grc.com/dns/benchmark.htm to rank them on performance for your specific region etc. note on privacy: if you are using port 53 you are cooked so make sure you are using dns-over-tls or dns-over-https.

pawal 3mo ago
Done, enjoy: https://evilbit.de/dns-resolver-guide.html#speedtest https://evilbit.de/dns-resolver-guide.html#speedtest (DoH only)

aetherspawn 3mo ago

Use your ISPs official DNS so that you get the shortest path possible from the ISPs handoff location to the CDN (and overseas trunks), not a generic DNS that doesn’t know about your ISPs layout. ISP: 1ms to Cloudflare Cloudflare: 10ms to Cloudflare Thank you for your attention to this matter. Edit: will clarify, this advice applies to countries with good privacy laws and no national surveillance i.e. not the USA

layer8 3mo ago
That’s no good if you want uncensored DNS.
- 1970-01-01 3mo ago
  Absolutely this. Parent advice is terrible for the reality of the problem. Shortest path does not equal fastest web page load, especially when you're filtering 99% of the crap from even resolving on your network. 0.0.0.0 is always faster than your ISP fetching extra garbage.
  - aetherspawn 3mo ago
    More detailed response below, but I believe the best way is to use a router that can filter DNS requests (ie Unifi), and set the upstream of that to your ISP. You can set the DNS server of your entire LAN using Network options without setting it on the individual devices. It’s up to the end-device whether it uses it or not, but 99%-ish do.
deleted 3mo ago
[deleted]
marginalia_nu 3mo ago
Changing your DNS does basically bupkis for privacy, since they can still read your DNS queries and SNIs.
- deleted 3mo ago
  [deleted]

nativeforks 3mo ago

I've been using 1.1.1.1 for performance rather than privacy. Maybe I should revisit that decision after reading this.

daneel_w 3mo ago
Quad9.

xorcist 3mo ago

Without a purpose for why you should use a public resolver it is an impossible choice to make. If it is this hard to choose a resolver, imagine how hard it is to choose a web browser, which is a choice that actually matters. The nearest resolver is $ sudo apt-get install unbound and now your own host is your resolver. The complexity of this is roughly a millionth of a percent of that of your web browser.

opengears 3mo ago

take a look at adguard home, dnsmask or unbound. the best is to run your own infra

asploder 3mo ago

For my fellow Canadians, CIRA operates public resolvers over IPv4/IPv6/DoH/DoT. https://www.cira.ca/en/canadian-shield/configure/summary-cira-canadian-shield-dns-resolver-addresses/ https://www.cira.ca/en/canadian-shield/configure/summary-cir...

soupbowl 3mo ago
Why should Canadians trust CIRA over anything else? I guess it is probably better than using your stock ISP DNS.

1vuio0pswjnm7 3mo ago

Why only 29 Is the author suggesting this represents the actual number of open resolvers on today's internet How can any consideration of "privacy" or "security" of DNS not also consider SNI SNI allows third parties to see when the user tries to connect to an address published for a domain name. It can allow third parties to interfere with such connections DNS only allows third parties to see when a user looks up an address published for a domain name. To associate non-DNS traffic with these queries requires assumptions about the software that is sending them Hence it is not surprising the advertising companies that control the popular web browsers want users to choose DoH _within the browser_ or corporate OS, deceptively labeled as "private DNS"^1, so these third parties can more effectively correlate these queries with non-DNS traffic from browsers or software running on corporate OS 1. Perhaps these companies will be sued for these deceptive claims. For example, users have successfully sued for deceptive claims about "private browsing"

pawal 3mo ago
The author merely suggests that those 29 or in someway trusted by a lot of people to handle DNS queries. Those 29 also publish information on what properties the service have. If you read the whole page, the author also lists other publi DNS resolvers worth a mention. For the long tail of unknown open DNS resolvers, use Shodan. But I would not suggest that you use any findings from Shodan to trust your internet usage with. Yes, SNI is a generic internet privacy problem. However, it is not a property of DNS. On the positive side, ECH has been pushed through the IETF and should slowly be available to the general user. / The author
1vuio0pswjnm7 3mo ago
ECH is not generally available to www users aside from a few "test" sites It is not clear to whom the term "you" refers in the author's reply As for myself, I do not use remote DNS except to periodically retrieve bulk DNS data. When I am accessing HTTP servers I do not make remote DNS requests. I already have the IP address information I need. For me, this is faster and more reliable I store bulk DNS data, obtained from a variety of sources, loaded into the memory of local TLS forward proxies Every user is different and each user should think for themselves

h4kunamata 3mo ago

Public DNS is blackbox, they always have problems especially if you are using your ISP. I run my own Unbound recursive DNS, it only talks with the 13 root nameservers and has its own caching, the subsequent requests are lightning fast. It is for local use only, it is not exposed to the public. When I leave home, I have a WireGuard VPN at home so my phone connects to it and the full traffic is sent via my home network. Everything works flawlessly for the past 5 years or so.