Issues with 1.1.1.1 public resolver and WARP(cloudflarestatus.com) |
Issues with 1.1.1.1 public resolver and WARP(cloudflarestatus.com) |
I think the world could use more alternatives to 8.8.8.8. Hopefully 1.1.1.1 will become more reliable as the years tick by.
(Do you use something besides 8.8.8.8 or 1.1.1.1? If so, post it here! Collecting reliable DNS servers might be a niche hobby, but it's a fun one. I was going to suggest 9.9.9.9 aka Quad9, but apparently it comes with strings attached. https://news.ycombinator.com/item?id=16728214)
Cloudflare doesn't support the DNS Extension that sends part of clients' IPs to the upstream resolver (https://en.m.wikipedia.org/wiki/EDNS_Client_Subnet). Cloudflare believes this is better for privacy.
Archive.is doesn't like this (because it prevents DNS-based CDN routing), and thus has a hardcoded exception to intentionally return bogus results to Cloudflare's resolvers.
Lack of EDNS only makes DNS based routing slightly worse if your CDN has a POP density similar-or-greater-than Cloudflare's.
This is a bad practice.
- In addition to not supporting EDNS, Cloudflare sends DNS requests from effectively random PoPs, so the recipient doesn’t know even the visitor’s nationality.
- The reason archive.is doesn’t like this is it makes them vulnerable to DoS attack.
Source and details: https://news.ycombinator.com/item?id=36971650
If you want to use the client's IP geolocation to resolve a CNAME to an edge server, this blocks you from doing so. You have to buy Cloudflare's products to get this benefit, and use their edge servers.
99% of the time I just talk directly to the root servers from my home network and pre-cache the most popular places I visit. Unbound also supports DoH but most distributions of Linux do not enable that compile time flag in their Unbound package build and I have long since stopped compiling things as most distributions finally started using the right security options in their builds. I also have DoT running at home which the cell phone figured out on it's own.
I keep DoT Unbound DNS running on several VPS providers that also talk directly to the root servers just in case. Useful for cell phones. My ISP is a tiny community ISP and would never filter any results and DNS privacy is just one tiny piece of browsing habits. Until encrypted SNI is fully adopted by all SSL libraries and applications they can still see where I browse unless I am using my own Tinc VPNs or SSH tunneling.
Out of curiosity: Why, if you generally trust your ISP? Do you get worse performance using their DNS servers?
https://community.cloudflare.com/t/archive-today-works-again...
I like the 300K requests per month free tier that nextdns.io has. Comes with plenty of filters.
> The European public DNS that makes your Internet safer.
> A free, sovereign and GDPR-compliant recursive DNS resolver with a strong focus on security to protect the citizens and organizations of the European Union.
for example france: https://www.patrick-breyer.de/en/data-retention-france-illeg...
> In a decree made public today, French Prime Minister Élisabeth Borne has extended the temporary retention of communications data of all citizens in France for another year. The blanket retention obligation concerns identity data (surname, first name, date and place of birth, postal address(es), e-mail address(es), telephone number(s)) as well as payment information, connection data (IP addresses, port numbers, identification numbers of users and their devices, date, time and duration of each communication, data on supplementary services and their providers)
they basically collect everything.
It isn't too complicated to set up and provides faster responses than external DNS servers, especially after the cache gets built up a bit.
[1]: Maybe only in EU?
I have set up Cloudflare DoH in my router, I block other popular DoH servers on my network and I also redirect any other DNS queries (UDP 53) to my router's DNS (which in turn uses Cloudflare).
And at least in my region (EU) I did not notice any issues with 1.1.1.1.
So, I don't go to archive.is anymore.
The site once used a tracking pixel as a poor mans ECS. The client IP address was inserted into the image name. Apparently the operator of the site explained this was used to achieve CDN-like functionality:
https://news.ycombinator.com/item?id=27501867
1. Perhaps we should be clear that "servers" here means open resolvers. These servers are of course not authoritative for any name, and generally recursion is slower than iteration, i.e., use of authoritative servers only (fee free to challenge me on this and I will share a citation, although I know this is true from own experiments). Thus "reliable" is perhaps ambiguous. Not all of them always return the same results. Some will return different answers, and not always for "load balancing" reasons. Some may be missing data entirely. Some will return wrong answers, e.g., pretending to be authoritative. Much DNS funny business on the internet today. I gather results from a variety of resolvers, from authoritative servers as well as other sources of DNS data, e.g., public zone files, scans and crawls, and I compare notes; I personally would not feel comfortable using one open resolver (third party DNS) as the source for all DNS data; I could not rely on it. As such, "reliable" is IMHO a loaded term if used to describe open resolvers.
From the makers of Windscribe VPN (Canadian)
I use the filter that blocks ads and malware 76.76.2.2 76.76.10.2
NextDNS
Running your own DNS resolver is super easy. It probably has the highest ROI of any self-hosted service, because it is so easy and inexpensive to do.
I recommend Unbound: https://nlnetlabs.nl/projects/unbound
My nameserver, 8.8.8.8, and 1.1.1.1 are all about 25ms away from me. Mine is actually a few ms closer, but that will vary.
Bigger nameservers will have warmer caches, so first lookup might be a bit slower on my nameserver.
I presume the big nameservers are managed well under capacity, so load should not be significant.
All told, I cannot perceive any performance difference at all.
Found it the reverse chronological order (with timestamps being a smaller/lighter font, at least on mobile) to have caused extra thinking, which, for a status, seems undesireable.
I get wanting to expose the latest thing first, but the "top-posting" style seems intuitive. Perhaps, as a compromise, a status page would have a "Latest" block at the top, with the timestamp prominent, where the latest known status would be placed by whatever makes the updates, but the updates themselves are in the chronological order?
Their DNS? or all of their services?
Let’s say you want to block Peacock, and there’s a bunch of urls you want to block, each is it’s own individual rule. If you accidentally delete one instead of disable it, it’s gone. If you can remember the url you accidentally deleted, now it’s placed at the top of the list, out of order. There appears to be no log of changes you make. It would be nice to be able to add custom parental controls with sets/bundles of urls.
Also you can’t toggle or package ad blocking rules, only delete and add. Sort of the same interface complaint as above. I have to go in and delete four ad blocking packages every time I want to watch Paramount+. Then go find them again when I am done.
They forward every info that is required for cdn's to function, that's why no other cdn's are complaining.
See the statement of the CEO:
https://news.ycombinator.com/item?id=19828317
Tldr:
> We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results. For a relatively small operator like archive.is, there would be no loss in geo load balancing fidelity relying on the location of the Cloudflare PoP in lieu of EDNS IP subnets.
We are working with the small number of networks with a higher network/ISP density than Cloudflare (e.g., Netflix, Facebook, Google/YouTube) to come up with an EDNS IP Subnet alternative that gets them the information they need for geolocation targeting without risking user privacy and security.
I do think that this has the effect of locking customers into Cloudflare's geoip data, which seems a little sketchy. The operator of archive.is claims that the data itself is bad[1] but I can't speak to his biases or motivations.
If the data is incomplete or bad, then you gain an advantage by using Cloudflare's services over rolling your own or using a competitor if a large number of customers are using their DNS, so I think the original point does stand. And if you are a competitor, your ability to compete with greater edge capacity or more targeted edge capacity is nonexistent.
[1] https://twitter.com/archiveis/status/1018691421182791680
If you're cdn is Azure, GCE, or AWS, than you're cdn is spread over the regions that their cloud offers. You still have no use-case to know more.
So, who? There isn't a provider atm in the world. So the issue at hand is currently not existent, as far as I'm aware.
I think you can set rules per device in Pihole? I haven’t tried personally. I’ve only had set a few (3-4) sites manually allowed through the blocklists.
Even so, why would an extra few dozen ms matter at all? Archive.is appears to be spindle-limited, is a client with marginally higher RTT an issue? The admin is silly.
The whole thing is very odd.
They still get the client ip from the request to the service itself (unless you're using a VPN, but if you're using a VPN then archive wouldn't get your ip from your DNS request either).
To the best of my knowledge they do not publish this, which makes it quite a chore to track all their edge locations manually.
Speaking of stats, I can also see what IoT/Cell devices are requesting to keep an eye on their behavior and look for interesting patterns of DNS requests.
I have honestly never used the ISP DNS servers so I don't know what their performance is like. It's just muscle memory for me to set up my own home Linux router to be a DNS server. I highly doubt they could top the performance of Unbound and cron-jobs that request commonly used records on an hourly basis. I do know that my performance is better than talking to the DoH/DoT servers on the internet. The cached record response time is in microseconds vs 23ms for CF and non cached response time is generally between 50ms and 70ms vs 80ms to 160ms for CF not-cached.
Another nifty option in Unbound is to cache the "Infrastructure" records and to "Keep Probing" multiple nodes. This combines into a nice balance of speed and resilience especially if someones name server is having a moment but their status page is green.
unbound-control dump_infra|wc -l
1235
total.num.cachehits=20949
total.num.cachemiss=8010
total.num.prefetch=753
total.recursion.time.median=0.0698958Yeah, local caching is a good point if your operating system(s) doesn't already do it in the DNS client.
> This also gives me the option to block domain names used for dark patterns or outright malevolent behavior.
I wonder how long this will actually remain possible, given that with DoH it now seems entirely feasible for websites to provide their own application-level DNS resolver?
You're quite welcome!
I wonder how long this will actually remain possible, given that with DoH it now seems entirely feasible for websites to provide their own application-level DNS resolver?
For me, forever. Applications can not bypass my DNS unless they are hard coding IP addresses in the application. Windows Update does have some hard coded IP addresses it can fall back on.
It is often said that DoH can't be blocked because in theory it can be hosted on any generic CDN IP pool but to my knowledge this has never been the case. It's quite the opposite, most DoH/DoT providers try to use vanity IP addresses. I null route them and NXDOMAIN the canary domain use-application-dns.net which is entirely optional but a nice gesture to applications to behave. Some vendor may decide one day to host their own DoH/DoT servers but I suspect I would learn about them. I would likely just avoid buying/using that device/application.
Perhaps some day a DoH provider may be so bold as to use a generic CDN pool and I will have to address that issue when it arises. I suspect this would be more challenging for the provider as the app/device will need a way to discover this pool DNS name, HTTP headers, API calls, etc... unless they hard code IP's. Either way I could dynamically null route them.
Is there some other option where you talk directly to the top level DNS root and the nameservers directly??
Edit: my bad you said you talk to the root servers directly. Not sure how to delete comments
It's still a valid question. You are right, one has to bootstrap the root servers. There are a few ways to do this. Assuming one had working DNS server at some point in the past they can
dig @e.root-servers.net +nocookie +tries=4 +retry=4 +time=8 . ns | grep -Ev "^;|^$" > /etc/unbound/named_hints.tmp # sanity check this
I don't know if this is happening at the moment, but it's pretty clear that there is no real incentive to even attempt this given that you simply will not be able to offer any benefits because you don't have the data.
The example given doesn't make any sense.
You're just giving an ideological example. Not one that occurs in the real world.
Here is one that actually happens: Using cloudflare DNS to protect privacy is one that occurs in the real world and eg. Apple is using them for exactly that.
But let's repeat:
> We are working with the small number of networks with a higher network/ISP density than Cloudflare (e.g., Netflix, Facebook, Google/YouTube) to come up with an EDNS IP Subnet alternative that gets them the information they need for geolocation targeting without risking user privacy and security.
> We are working with the small number of networks with a higher network/ISP density than Cloudflare (e.g., Netflix, Facebook, Google/YouTube) to come up with an EDNS IP Subnet alternative that gets them the information they need for geolocation targeting without risking user privacy and security.
---
I don't know what happened between that statement and now. Since they were working together with eg. Google to solve it.
Still. No example? So not an issue now?
Generally it is already included with most DNS servers, such as BIND.
The original post for that is https://mailarchive.ietf.org/arch/msg/dnsop/WCVv57IizUSjNb2R... from Paul Vixie
Also:
An Internet Born In a Threat-Free Environment - https://www.recordedfuture.com/podcast-episode-201 (2021)
Paul Vixie and Peter Lowe on Why DoH is Politically Motivated - https://www.dnsfilter.com/blog/paul-vixie-and-peter-lowe-on-... (also from 2021)
It does not really address the issue of privacy unless one is only making DNS requests and not doing anything with said DNS results, as encrypted SNI is still not widely adopted. I guess I would call that cart before the horse. It does not prevent an abusive ISP from blocking access to a site as they can just block all the DoH resolvers or just NXDOMAIN the canary domain which also turns it off by default on most browsers. The bigger issue to me is that it doubles the number of organizations that can track behavior. Now my ISP gets this data and so does Cloudflare if I am the type to leave things default as most people are and they know it. CF may not wish to block something but should they receive a court order from any country they do business in then most people will lose access to something. That could be a future phase we have not yet reached due to mass adoption not reaching a set goal at this time. This is also a one-stop-shop for law enforcement to gather browsing data vs. having to issue a court order to each ISP.
Some people mention it protects against rogue nations but they are by far the last people that DoH would be useful for. Rogue / bad / totalitarian nations will just null route anything they suspect to be a DNS servers not in their control and will extract people from their homes to re-educate them. In a way I can see DoH as being a risk to people in such situations. Meaning they could be accused of bypassing some state level control and may not even realize they were.
In my opinion DoH/DoT should have been highly customizable in a GUI before it was ever implemented and default-off, default opt-out settings and instead if the browser or ideally the OS recognizes it is in a shared WiFi then maybe prompt the person to temporarily enable DoH. That's another issue, it's in the browser and not the OS. So the browser gets protection but nothing else does at least for the last few years. That is coming soon to some operating systems. Curious if they make it obvious what DNS partnership is in place.
That's what I mean: What if websites and applications just start querying IP addresses for the hostnames they want to connect to over DoH (to api.someapp.com, so you can't distinguish it from a regular API call that you want to allow for the app to work), and then connect to the resolved IP directly?
local-zone: "api.someapp.com." always_nxdomain
Another heavy-handed option would be to force all traffic through a MITM proxy which I have done in the past. Any device that can't have my CA cert loaded would be a paperweight and thus returned to Amazon with less than 5 stars and a review that details the DNS implementation which most customers would not care about or understand but my fellow cranky network admins may find useful. If it's a website then I would just not use it. Some businesses take this approach. There are both commercial and open source solutions for this. Look for Squid SSL-Bump MITM proxy if one is curious. This requires bypasses for domains still using public key pinning which is an insignificant number of them. Most have moved away from HPKP due to the induced fragility and risks.
There are other methods but they come with security implications such as decompiling applications, shimming something into it or pre-loading libraries to do the same thing but this usually requires rooting a device and potentially compromising security as the vendor signing may be removed. I'm sure some of the mobile developers here have more elegant and secure methods.
I doubt many would do any of this of course, but you asked.