It apprears that NextDNS has removed No Google, No Facebook, and other blocklist without notifying users. One person said the NSA blocklist was also down. The company had made no responses to complaints on the community server when I checked earlier. Crickets…
I noticed Android and Linux being unable to access the app and web interface to confirm connections, starting some time on November 4th. I was able to switch DNS providers on Android and switch back, after which NextDNS seemed to work. On Linux however, systemd confirmed it was enabled but it went right to google’s webpage with no block.
If you’re on NextDNS, go check your domain filters ASAP. I switched to RethinkDNS, and it’s been decent so far. What is everyones preferred solution?
You should realize that your piholes call to 3rd party DNS servers unless you use something like unbound which queries root DNS servers.
And by the way, those root queries are unencrypted too.
So when you say root DNS servers, does that mean the ones we host? Or Unbound just updates resolvers by using queries to external DNS servers?
So instead of querying a recursive dns service like cloudflare or google you query the 13 root DNS servers such as https://a.root-servers.org/
This way no data goes through 3rd parties. However, this is a poor idea since none of the root servers support encrypted DNS queries.
You can use DoH or DoT. DoT already has its own port 853 which can be firewall blocked. So then DoH can be harder to block because it uses port 443 same as HTTPS hence the name.
So the best way of doing it is either using ODoH which uses a proxy to ask on your behalf, but the proxy knows your IP address.
DNS privacy is in my opinion a farce because someone knows your IP address and someone knows your queries. The best way is to hide in numbers and the external promise of no logs queries.
So for me, I just pick the fastest encrypted no logging DNS servers. And the top 3 for my location is
https://dns.nextdns.io/
https://freedns.controld.com/uncensored
https://95.85.95.85/dns-query
I used this tool to help pick the fastest encrypted servers.
https://center2055.github.io/DNS-Hop/
Good luck and happy labbing
I do use unbound with CIRA.
CIRA is hosted in Canada which is part of FVEY.
Sorry I’m not trying to nitpick. Everyone has their own threat tolerance.
I personally just use ODoH for now. Mostly using RethinkDNS with ODoH
I understand that CIRA is Canadian. I wanted to make sure it was not going to big tech if Unbound could not do its thing. I live here in Canada, with three static IP addresses so they know about me just as much as they already know about anyone who has a domain (or two) ending in .ca!
After you mentioned ODoH I looked it up, I read about it and was going to see if unbound supported it and at this point in time it does not appear that they do. I was not going to admit defeat so I looked up DoH, no dice unbound does not support it but they do support DoT, I spent the last few hours learning about and deploying DoT from unbound to CIRA.
When CIRA changes there retention standards I may look for something else.
I want to thank you for enlightening me on my journey for more privacy.