|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
.Youtube video here There is one command that I have used for many years. It’s the command ipconfig /all. With that command I can see what network I’m
[See the full post at: Tasks for the weekend – February 27, 2021 Check your DNS]
Susan Bradley Patch Lady/Prudent patcher
Mostly, privacy. Old DNS allows ISPs to easily track you. Also, some DNS providers offer extra features, such as blocking ads, malware, trackers, etc.
Get up to speed on router security at RouterSecurity.org and Defensive Computing at DefensiveComputingChecklist.com
I use Cloudflare via HTTPS, using their free cloudflared program for Linux (it also has Windows and Mac versions). On the front end, cloudflared sets up a local DNS server at 127.0.0.1:53 (127.0.0.1 is localhost, meaning the local computer itself, over port 53, the normal DNS port), which I can then set as the DNS server for the connection in the connection settings. On the back end, it creates a tunnel over HTTPS to the Cloudflare DNS server at 1.1.1.1.
This means that all DNS for the connection is encrypted and is unknown to the provider (being my ISP or the ISP used by a public internet connection). If the public wifi connection is misconfigured and DNS is not working, it won’t matter, as I’m not using their DHCP-selected server for DNS anyway. That was actually the impetus for me to start investigating DNS over HTTPS, which led to me discovering cloudflared. It’s been a few years since then by now!
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)
These DNS providers prefilter what is offered up to you. So even if you are as careful as you think you can be, they make sure that code being offered up to you is pre-sanitized. They get the big picture view and thus block phishing attacks or other web sites with nefarious intentions.
Susan Bradley Patch Lady/Prudent patcher
That’s a really complicated topic. You get the benefits of DNS over HTTPS, the virtues of which are the subject of debate.
Mozilla thought DNS over HTTPS was important enough to include it as a default setting, which was controversial. Corporate entities don’t necessarily like it because it bypasses their ability to block certain things by DNS, and others deride it as being a “hacky” kludge (which it kind of is) rather than a real solution, but it’s here and functional right now if you want it.
In general, having things encrypted is potentially beneficial to the user. I say “potentially” because it is only really of benefit if someone is trying to use the DNS data for malicious purposes, and if they are, you probably won’t know about it.
There are many posts and opinions about DNS over HTTPS on the internet, and if you read some of those, you might begin to see why I can’t definitively give a “yes” or “no” answer. It’s… complicated.
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)
It’s… complicated.
Fortunately, I could decide to un-complicate it.
I’ll stick with my ISP’s DNS servers (Telenet.be). 
Steve Gibson’s DNS Benchmark tells me they’re the fastest for my location anyway: https://www.grc.com/dns/benchmark.htm
Still, thank you and Susan for the additional info.
There are better alternatives to the standard DNS provider lists with some researching..without ruining your task for the weekend 
A DNS with a Security blocklist, DNSSEC, TLS 1.3 with an encrypted SNI makes me feel better.
Living in Hawaii, I have no choice but to use my ISP’s LOCAL (Honolulu based…I’m on the Big Island) DNS servers. If I run DNS Bench, my LOCAL DNS servers from my ISP are 4-5 times faster than ANY Mainland DNS providers. That’s a result of living in the middle of the Pacific Ocean. I have tried various recommended DNS servers over the years and the slowness because they are not LOCAL like my ISP’s ones are is quite noticeable.
I would NEVER use a router from my ISP or modem. I purchase my OWN equipment.
my router says 1.1.1.1 and 8.8.8.8 So what DNS am I actually using?
Cloudflare as primary and Google as secondary (I think).
DNS is brutally complicated. If you change your computer, be aware that on a laptop, Ethernet might use different DNS than Wifi. And, each WiFi network can be configured to use different DNS. And, the router might over-ride all the settings on the local computer. Or, the DNS settings in a web browser might over-ride both of them. Then too, a VPN and Tor play in the DNS game. Not to mention the transition from old DNS to new DNS. And, Android has a great Secure DNS feature, etc. etc.
There are a number of DNS tester websites listed here
https://routersecurity.org/testdns.php
But, again, the browser could be using one DNS provider and the OS outside of that browser could be using a different DNS provider.
Get up to speed on router security at RouterSecurity.org and Defensive Computing at DefensiveComputingChecklist.com
I don’t follow.
Get up to speed on router security at RouterSecurity.org and Defensive Computing at DefensiveComputingChecklist.com
OK
From your site
It is commonly thought that if the Operating System specifies DNS servers, they will get used. This is not always the case. Some routers (such as the Pepwave Surf SOHO) can force clients to use the DNS servers specified in the router. That said, in my experience has been that this only applies to old DNS. Browsers that specified DoH type DNS servers had their requests honored.
Yet you would recommend Pepwave? This seems a scary transgression to me!
Thank you. That is one strange IP address you have for a DNS server. I know that 127.0.0.1 is always your computer, but I have no idea what the other 127s are.
Get up to speed on router security at RouterSecurity.org and Defensive Computing at DefensiveComputingChecklist.com
If you are worried about DNS speed, you are taking advice from the wrong people.
Without a VPN or Tor, your ISP can spy on you easily with DNS. Without DNS, spying is much harder. They can see the IP addresses of computers you interact with but I really doubt that that tells them much.
With HTTP they see everything. With HTTPS they may be able to see the domains you visit, depending on whether a site uses HTTP version 1.2 or 1.3. With mobile apps you have no way to tell if its HTTP or good HTTPS or bad HTTPS.
If privacy is a concern, use a VPN or Tor. They are not perfect, but they do hide your activities from the ISP.
Get up to speed on router security at RouterSecurity.org and Defensive Computing at DefensiveComputingChecklist.com
I remember checking my speed options when Cloudflare started the 1.1.1.1 DNS, using GRC’s DNS Benchmark, and due to location, the speeds were significantly degraded using such services directly.
Have you read @michael432’s webpage linked above? He has a number of such resources, with various information about them 
DNSLeakTest is the first listed.
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Notifications
