this post was submitted on 04 Feb 2025
65 points (98.5% liked)

Privacy

33294 readers
1070 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
65
What, if any, Public DNS is preferred? (self.privacy)
submitted 1 day ago by splintertank to c/[email protected]
29 comments fedilink hide all child comments
 

My ISP is AT&T (located in the U.S.) and I have issues loading random websites. Currently have Google DNS set in my router, which works great. But I'm guessing there's a better, more private, option?

top 29 comments
sorted by: hot top controversial new old
[–] [email protected] 4 points 7 hours ago* (last edited 7 hours ago) 
Light + TIF                     https://sky.rethinkdns.com/1:AAkACAQA
Normal + TIF                https://sky.rethinkdns.com/1:AAkACAgA
Pro + TIF                 https://sky.rethinkdns.com/1:AAoACBAA
Pro plus + TIF               https://sky.rethinkdns.com/1:AAoACAgA
Ultimate + TIF              https://sky.rethinkdns.com/1:gAgACABA

Light + TIF                 https://dns.dnswarden.com/00000000000000000000048  
Normal + TIF                 https://dns.dnswarden.com/00000000000000000000028  
Pro + TIF                 https://dns.dnswarden.com/00000000000000000000018  
Pro plus + TIF               https://dns.dnswarden.com/0000000000000000000000o  
Ultimate + TIF              https://dns.dnswarden.com/0000000000000000000000804  

Light                https://freedns.controld.com/x-hagezi-light
Normal                https://freedns.controld.com/x-hagezi-normal
Pro                https://freedns.controld.com/x-hagezi-pro  
Pro plus                https://freedns.controld.com/x-hagezi-proplus  
Ultimate                https://freedns.controld.com/x-hagezi-ultimate
TIF                https://freedns.controld.com/x-hagezi-tif

Rethink DNS, DNS Warden, and ControlD with Hagezi blocklists via DoH/3. I highly recommend the '+ TIF' as they are threat intelligence feeds which are up to date lists of bad actors/malware.

[–] [email protected] 23 points 1 day ago (1 children)

If you need a traditional, unencrypted DNS service, check out Quad9 and AdGuard's Public DNS. If you can use DoT or DoH, use LibreDNS or Mullvad DNS. If you want more customization, check out NextDNS.

[–] [email protected] 7 points 1 day ago (1 children)

Quad9 does also offer DoT and DoH.

[–] [email protected] 3 points 1 day ago

Even DNSCrypt, but I think nobody really uses that.

[–] [email protected] 1 points 20 hours ago

quad9, blahdns, dnscry.pt, ibksturm, koki, litepay.ch serbica

[–] [email protected] 29 points 1 day ago

A simple solution is Quad9 aka 9.9.9.9. NextDNS is fairly simple but allows customization.

[–] [email protected] 20 points 1 day ago

I recently switched to NextDNS. I used to run my own AdGuard Home with multiple DNS provider as upstream.

[–] [email protected] 17 points 1 day ago (3 children)

Regular DNS can be monitored, intercepted, and modified however your ISP decides, even with you specifying custom DNS servers.

I run pihole on my LAN, with cloudflared as its upstream DNS. Cloudflared translates regular DNS into DOH using cloudflare and quad9 as the upstream DOH providers (configurable).

Pihole DOH with cloudflared

Finally I block all port 53 (dns) traffic at the router so it cannot leave my LAN. All LAN devices that want regular DNS are forced to use the LAN DNS server which wraps their requests in DOH for them. (as well as blocking ads, tracking/telemetry, and known malware sites)

[–] [email protected] 2 points 1 day ago (1 children)

Why would you need cloudflared? Can't you justbset DoH/DoT servers as a backend in Pi-Hole?

[–] [email protected] 1 points 1 day ago* (last edited 1 day ago)

Pihole doesn't directly support DOH. What I linked is their official guide for implementing it: using cloudflared.

There is other ways you can do this. This is just what I've been using.

[–] [email protected] 8 points 1 day ago (1 children)

What ISP do you use that makes you trust Cloudflare more than your ISP? You must really be between a rock and a hard place.

[–] [email protected] 3 points 1 day ago

I'm not all that concerned about either tbh; I was just already capturing DNS traffic and funneling it through pihole for the customizable blocking, and figured I may as well add DOH while I'm at it.

Just sharing the knowledge for those that are interested. You can use any DOH provider you like.

[–] [email protected] 4 points 1 day ago

Adguard Home supports TLS, HTTPs, QUIC and other stuff natively, in case anyone reading wants to set up a pihole equivalent with less work for encrypted DNS.

https://github.com/AdguardTeam/AdGuardHome/wiki/Configuration#upstreams

[–] [email protected] 2 points 1 day ago

nextdns or mullvad？

[–] [email protected] 14 points 1 day ago

I use Mullvad DNS when I'm mobile and unbound on my pi when I'm at home

[–] [email protected] 7 points 1 day ago* (last edited 14 hours ago) (2 children)

I use a local unbound DNS server on my router with Quad9 as upstream. I actually have google DNS entirely blocked/rerouted on my router because google uses it for advertising tracking, but I get creepers out by targeted ads showing up in random places when I do do something on a totally unrelated site. Most important thing, though, is to use ~~DNSSEC~~ DNS over TLS or DNS over HTTPS to reduce middlemen from using your DNS info to track what sites you visit and sell that data. Of course ISPs still see the destination of all of your data for tracking what sites you visit unless you use a VPN or similar tools, so you can't hide it from them that way.

Edit: DNS over TLS not DNSSEC, totally different thing...

[–] ITeeTechMonkey 2 points 1 day ago (1 children)

DNSSEC is a means of authenticating the data receives was not tampered with, such as MITM attacks, thus ensuring data integrity. It uses PKI but it's not an alternative to DoH or DoT which encrypts the DNS traffic, either over HTTPS or TLS, providing confidentiality.

DNSSEC can be used in conjunction with DoH or DoT to achieve the Security CIA triad - Confidentiality, Integrity, Authenticity.

[–] [email protected] 2 points 14 hours ago

Thanks for the correction, that was a typo based on a long work day screwing with my brain processing acronyms. I meant to say DNS over TLS or DNS over HTTPS.

[–] calamityjanitor 2 points 1 day ago (1 children)

Do you have the local unbound server respond to DoH so that the browser also uses encrypted client hello?

[–] [email protected] 2 points 14 hours ago (1 children)

No. I don't use DoH inside my network because I redirect DNS traffic on my primary VLAN to a pihole for ad and malware reducing. But I also control what has access to that VLAN pretty strictly. I have another VLAN for guests and untrusted devices that doesn't use the redirecting, but does use the Unbound server as the default DNS, just doesn't enforce it. And I have an even more locked down VLAN for self-hosted servers that also doesn't use the pihole, but does use Unbound.

[–] calamityjanitor 1 points 7 hours ago

Yeah fair. I tried setting it up, but honestly probably not worth the effort in home networks. Problem is browsers don't know that the other end of the unbound DNS server is DoH, so it won't use ECH. Even once set up, most browsers need to be manually configured to use the local DoH server. Once there's better OS support and auto config via DDR and/or DNR it'll be more worth bothering with.

[–] abominable_panda 7 points 1 day ago

Check out PrivacyGuides. They have recommendations for DNS including what others have commented

[–] Psythik 4 points 1 day ago (1 children)

Adguard DNS, so I can block ads in my entire house without having to invest in a PiHole. dns.adguard-dns.com More IPs

[–] [email protected] 3 points 1 day ago

I've been using Adguard public DNS for over a year across my LAN and it works great, with much less hassle than a pihole, which I previously used for years.

I miss the ability to add random hosts to either black or white lists, but in reality only used it sporadically.

[–] [email protected] 2 points 1 day ago

In regards to all the answers in this thread, consider: If you're not paying for it with money, then what are you paying for it with?

The most private DNS is a recursive resolver.

[–] carl_dungeon 2 points 1 day ago

I use the cloudflare dns, but there are all kinds of adguard ones too. The Adguard app itself has a big list of options for the fallback.

If you’ve never used adguard, check it out, it can run as a container or on a pi, you just point your router dns at it

[–] [email protected] 1 points 1 day ago

Controld.com. I use their free version that blocks ads and online tracking and malware.