Background for question: I normally run an internal DNS resolver with an upstream pool of 10-15 providers. These are normally a mix of Global Anycast servers (Quad9 etc) with some OpenNIC, YandexDNS etc thrown in towards the end to cover the ‘chilling effects’ blackholes.
Currently Yandex DNS is pinging a timeout (either due to black-holing or DDOS’ing depending on where I connect To/From).
My question to HN is this – Given my ‘Information Wants To Be Free’ viewpoint, are there any DNS equivalents of Switzerland (WWII, Neutral to all parties) providers?
One quick question though - After taking a quick skim of it the list seems to be extremely 'Western-Centric' (reference link https://www.internic.net/domain/named.root)
A lot of people are running recursive resolvers at home (like pi-hole stuff, or most people running some custom openwrt router/modem). I'm running one on my laptop (my resolver is localhost) and it works great.
> After taking a quick skim of it the list seems to be extremely 'Western-Centric'
It is, but that's what the internet is. But by running your own recursive resolver you can control your cache and a lot of the data doesn't change often. If you're extra paranoid you can cache the record data (or even archive the history) for ccTLD (or even all TLDs). For stuff (domains) you're interested in you can also hard-code or otherwise program "non-standard" ways to resolve the ips (by somehow populating a local database that overrides recursive resolution), like pi-hole/safebrowsing blocklists, stuff from institutions or CDNs you trust.
Alternatively, you can maintain the NSes for all the TLDs you are particularly interested in, and alert yourself if they change to something you don't recognize.
Finally, keep in mind that whatever you do, you need to have multiple vantage points to the internet. There's not a lot stopping your ISP from not delivering you to the right host when you try to talk to it. E.g. your ISP can fake the DNS responses.
Otherwise, you could spin up your recursive resolver on your cloud, VPS, or other hosting provider of choice, and then use that.
Unbound is basically your own private DNS resolver and then Pi-hole lets you filter out whatever "junk" you don't want.
Presumably the root and authoritative servers. Which is why I use a local recursive resolver rather than any upstream/third party resolvers.
You should try it. It's easy and fun!
Quad 1 cloudflare is reliable doh but comes from a company with a history of bloviating nonsense about internet freedom only to eagerly capitulate to Twitter lynchmobs and blacklist a customer or ten.
https://dnscrypt.info/public-servers/ will give you a nice list of doh to try out. Ymmv however as many are sporadic.
At this point, the onus is to prove thing $x is not used for Google analytics.
Google stated that for the purposes of performance and security, the querying IP address will be deleted after 24–48 hours, but Internet service provider (ISP) and location information are stored permanently on their servers.
This only helps if they're not doing any advanced blocking though. If I remember correctly, when Russia blocked Telegram, they were blocking their IPs, not just DNS queries. If the rumours of a "RuNet" are true, then they probably need something more advanced (eg: a VPN with traffic obfuscation, Tor, etc).
---
I guess I'm confused on the benefit (theoretical or practical) one would get by using that variety of resolvers. Is it just to prevent theoretical censorship at the DNS level?
There are many different types of resolvers, blocking and unfiltered. We're adding global ECH support in the coming weeks. There is also a paid plan if you need more control.
I think non-disciminating DNS providers are rather the norm and not an exception though.
Then your experience differs greatly from mine (EU based). My usual mix of 'fastest anycast' upstreams’ are reliably black-holing a lot of .ru domains right now
(Rightly or wrongly is a ‘nother question for a ‘nother day).
P.S, YMMV and obviously does :)
103.196.38.3
103.196.38.8
but you did ... thx anyway :)
I have my own resolver on my own server running unbound and it gets service from my paid nextdns account.
Sort of like having a pihole but it is available from anywhere and I don’t have to run a rpi…
That's exactly why Quad9 changed it's HQ to Switzerland:
Is it the cache that improves resolution speed in a meaningful way?
Running your own recursive resolver will almost certainly be slower, on the order of 2x latency. I should test it...
Also, DNS-over-HTTP and DNS-over-TLS are not available with all DNS servers, but can be readily enabled to secure the last mile when the upstream public resolver supports it.
Heck, I did that at home for Chromecast and other devices that hardcode their DNS.
apt install unbound
It sounds like what you really want is your own recursive resolver.
Maybe staying neutral has the higher cost to a free society (and thus „information wanting to be free“) in the long term?