Cloudflare DNS

[yellowsulphur]

Today Cloudflare launched a public DNS service that offers:

• DNS-over-HTTPS and DNS-over-TLS

• A global response time of 14ms

• DNS queries purged every 24 hours

• Free as in beer

• ~ 43% faster than Google's public DNS

1.1.1.1
1.0.0.1

https://1.1.1.1

Thought this might be of interest everyone, but especially those trying to move away from everything Google.

[AJAX22]

Cloudflare is actually pretty damn good.

there are ways to use their services in ways never intended by them to speed content delivery quite a bit.

[the86d]

Today Cloudflare launched a public DNS service that offers:

• DNS-over-HTTPS and DNS-over-TLS

• A global response time of 14ms

• DNS queries purged every 24 hours

• Free as in beer

• ~ 43% faster than Google's public DNS

1.1.1.1
1.0.0.1

https://1.1.1.1

Thought this might be of interest everyone, but especially those trying to move away from everything Google.

If you never login to Gmail on Chrome, only Private Firefox tabs, and fake names tied to said Gmail accounts there is less reason for concern, if you are trying to be the monkey wrench.

I would be more worried about Apple, with everybody using their real name on Applecare, iMessage, and using Safari, with genuine names and credit cards required.

[zrockstar]

You can also use OpenDNS (Cisco) for free for personal use: https://www.opendns.com/home-internet-security/

[Robotron2k84]

What a ridiculous waste of energy. Run your own caching resolver like the internet was designed to operate. Signing up and using a consolidated resource is buying into someone else's idea of how free your information should be.

[lazyworm]

just test it well before using it. Some network gear cannot properly route to 1.x.x.x

[Dubious_Beans]

What a ridiculous waste of energy. Run your own caching resolver like the internet was designed to operate. Signing up and using a consolidated resource is buying into someone else's idea of how free your information should be.

For those of us who skipped class that day, can you tell us a little more about that and how it's done?

[Robotron2k84]

Tell me more about your network topology and I can be of more help.

In general, there are two forms of DNS server, full resolvers and stub resolvers. Full resolvers are authoritative or infrastructure-level DNS servers that handle traffic at scale. Authoritative servers have the SOA and A records that everyone else needs to make a request to Calguns into a reachable IP address.

Stub resolvers are used to cache and offload request traffic at the local network level. They sit on your router or on your PC and perform requests to authoritative servers, get the results and keep them until their TTL expires and they have to be fetched again.

Google and CF's DNS servers, as well as most ISP customer-facing DNS are stub resolvers since they generally don't host authoritative data and are used as caches.

The novelty of encrypted DNS is so far just a gimmick. The only part of the transaction that is encrypted is from your DNS client code in the resolver library that all programs use, to the local resolver (in this case CF). The remainder of the traffic is not encrypted as it's completely public data and DNS protocols don't yet have a STARTTLS-like mechanism, although it is being worked on. The only benefit to client SSL is for the link to the DNS cache from the client. If a TLA wishes to snoop on your DNS traffic, there isn't much you can do at this point outside of a VPN anyway.

So, if you run a DNS caching resolver locally there is no need to traverse the internet for DNS data multiple times in the first place. RTT takes longer for a caching resolver locally, but subsequent requests are generally under 5ms. This speeds up your perception of browsing because you don't need to traverse the internet each time a DNS name needs to be resolved. Most OSs have a caching component to name services regardless, but they are flushed frequently when networks change or interfaces change operational status.

At the present there are numerous DNS caching resolvers you can use, Knot, Stubby, and legacy BIND if you want the OG server.

You can run them on your local PC, your router, a dedicated PC / Server or in a VM. Every request you make is to the origin servers and authoritative data back. No middle men or agendas to serve.

[jdfthetech]

For those of us who skipped class that day, can you tell us a little more about that and how it's done?

it's actually pretty pointless considering you'll still be downloading the DNS records constantly while also having less chance of catching poisoning issues. There is a reason there are DNS admins , don't try and admin it yourself, you don't have the time to do this effectively unless it's already your job.

[Robotron2k84]

it's actually pretty pointless considering you'll still be downloading the DNS records constantly while also having less chance of catching poisoning issues. There is a reason there are DNS admins , don't try and admin it yourself, you don't have the time to do this effectively unless it's already your job.

Cache poisoning doesn't happen if you are always fetching authoritative data, unless your entire route table has been compromised, at which point all of your traffic is being intercepted. Most of these attacks happen at the router anyway where it's settings are forcibly altered to point to a poisoned server. If you run your own cache, or not, poisoning is still possible based on how secure the next client up the chain is. If this is a concern, and DNSSEC is available, it can be configured to validate addresses on a caching resolver. Harder to do without one.

DNS admins work on Authoritative servers. Caches are autonomous in 99% of cases.

[jdfthetech]

Cache poisoning doesn't happen if you are always fetching authoritative data, unless your entire route table has been compromised, at which point all of your traffic is being intercepted. Most of these attacks happen at the router anyway where it's settings are forcibly altered to point to a poisoned server. If you run your own cache, or not, poisoning is still possible based on how secure the next client up the chain is. If this is a concern, and DNSSEC is available, it can be configured to validate addresses on a caching resolver. Harder to do without one.

DNS admins work on Authoritative servers. Caches are autonomous in 99% of cases.

My point is you won't catch it until much later than a dedicated NOC.

Also, advising people to setup their own routing tables etc when it's way outside the scope of most folks technical know how is kind of silly.

It's one thing to change a dns host in your resolv or hosts file, it's entirely a different thing to setup a dns server at home. There are numerous security issues with doing so as well (as I'm sure you are very aware). It seems your telling people to dig deep into their router hardware or set up servers when the vast majority of people on this forum just want something simple that helps them be a bit more secure.

If someone has the knowledge to configure their routing tables, or admin a DNS server a free DNS server offered by cloudfare is going to generally be outside their interest level.

[Robotron2k84]

I'm not suggesting that people change their routing tables. That's disingenuous and a failure of comprehension. Nor am I suggesting setting up a DNS server proper, only a recursive resolver. I'm not entirely sure you understand the difference between the two.

Cache poisoning happens because an exposed (and that's important) resolver cache is overwhelmed by bogus queries in a short-enough period of time that it blocks out legitimate traffic. During that window bogus authoritative responses can be inserted to where ns.somedomain.com can be forged to an illegal host for the duration of that entry's TTL. The potential for a cache to be poisoned in such a way is astronomically higher when it is a large public service, like Google or CF. They have monitoring to detect such events specifically because their risk profile is about a million times larger, without exaggerating. In addition UDP SPR now prevents that type of attack in most circumstances.

In a home-user setting, the cache is not public and setting it so would take extra effort. But, in any event the traffic required to exploit such a setup would have to be generated by the inside hosts and risk detection where a low-intensity attack against the router to change its DNS settings would be more logical. So, in no way are you more susceptible to such an attack, actually statistically less so.

As for installation and configuration, it's really not difficult and my own caching resolver on my home network's configuration hasn't been touched except for routine upgrades in literally years. I pay almost no attention to it because it's not exposed and it's not a source of exploits. If you trust dnsmasq or some other embedded daemon, such that is included with most router software, it's completely illogical to somehow fear software so similar that adds exactly one extra feature for the case we are discussing.

There are many sites on the net that will give you a stock configuration file for a caching resolver, it's really not rocket science or as difficult as you are making it sound.

The only other change that needs to be made other than installing the server is setting your DNS configuration to the IP of the installed software's host. It requires so little intervention you'd probably be best writing yourself a note to stick on the bottom of your keyboard that you even have the server installed.

[jdfthetech]

I'm not suggesting that people change their routing tables. That's disingenuous and a failure of comprehension. Nor am I suggesting setting up a DNS server proper, only a recursive resolver. I'm not entirely sure you understand the difference between the two.

Cache poisoning happens because an exposed (and that's important) resolver cache is overwhelmed by bogus queries in a short-enough period of time that it blocks out legitimate traffic. During that window bogus authoritative responses can be inserted to where ns.somedomain.com can be forged to an illegal host for the duration of that entry's TTL. The potential for a cache to be poisoned in such a way is astronomically higher when it is a large public service, like Google or CF. They have monitoring to detect such events specifically because their risk profile is about a million times larger, without exaggerating. In addition UDP SPR now prevents that type of attack in most circumstances.

In a home-user setting, the cache is not public and setting it so would take extra effort. But, in any event the traffic required to exploit such a setup would have to be generated by the inside hosts and risk detection where a low-intensity attack against the router to change its DNS settings would be more logical. So, in no way are you more susceptible to such an attack, actually statistically less so.

As for installation and configuration, it's really not difficult and my own caching resolver on my home network's configuration hasn't been touched except for routine upgrades in literally years. I pay almost no attention to it because it's not exposed and it's not a source of exploits. If you trust dnsmasq or some other embedded daemon, such that is included with most router software, it's completely illogical to somehow fear software so similar that adds exactly one extra feature for the case we are discussing.

There are many sites on the net that will give you a stock configuration file for a caching resolver, it's really not rocket science or as difficult as you are making it sound.

The only other change that needs to be made other than installing the server is setting your DNS configuration to the IP of the installed software's host. It requires so little intervention you'd probably be best writing yourself a note to stick on the bottom of your keyboard that you even have the server installed.

I used to do DNS maintenance for NSI so I do understand what I'm talking about.

What you are suggesting is much more difficult than editing a plain text file.

You can spout off plenty of config info here that few people will care about if it makes you feel important, but the fact is recommending these things is not helpful for those who aren't doing it for a living or are extremely interested in it.

There are plenty of pitfalls that came come from running your own show with DNS, so I don't recommend it to anyone unless they know what they are doing.

This is not slashdot it's calguns, let's know our audience a bit.

If you want to get into a pissing contest about who knows what, I'm not going to go there, I'm just suggesting this thread shouldn't be filled with stuff nobody will have the time nor inclination to do.

[sholling]

I've used OpenDNS for years and Cloudflare is noticeably faster for me. Keep in mind that while 14ms doesn't seem that much faster than 24ms, when you surf to a website the DNS is not just resolving the IP address of the main page, it's also resolving the IPs of every object and advertisement on that page and those add up.

Cloudflare is not a fly by night company and what they offer is very fast basic DNS services (no anti malware or child safe modes) with no destination logging and no selling your surfing history. They also promise to pay an outside auditing company to keep them honest.

[Robotron2k84]

I used to do DNS maintenance for NSI so I do understand what I'm talking about.

What you are suggesting is much more difficult than editing a plain text file.

You can spout off plenty of config info here that few people will care about if it makes you feel important, but the fact is recommending these things is not helpful for those who aren't doing it for a living or are extremely interested in it.

There are plenty of pitfalls that came come from running your own show with DNS, so I don't recommend it to anyone unless they know what they are doing.

This is not slashdot it's calguns, let's know our audience a bit.

If you want to get into a pissing contest about who knows what, I'm not going to go there, I'm just suggesting this thread shouldn't be filled with stuff nobody will have the time nor inclination to do.

Not going to get into a public spat with you, but your post is utter BS. People in this sub-forum are inclined technically and want to learn. You are trying to shut them down to other options, what's your deal?

By the way, I've done NS admin for over 100 companies, a dozen or so being Fortune 50's, so you can stick your NSI crap you know where. Done with arguing. If anyone else wants info, I'll be happy to answer their questions.