The Lagoon TechMy little blog in Cyberspace.

Should I switch my current DNS resolver?

If you are just a regular Internet user (not self-hosting anything), and you are currently using your ISP’s DNS resolver, I would switch to a 3rd party DNS service (e.g., Cloudflare).

However if you are self-hosting anything (e.g., email), then I would opt for running my own DNS resolver for reliability.

Here are my opinions on the three typical ways to get DNS.

ISP DNS Resolver:  usually OK performance / no privacy

• Works out-of-the-box with your Internet service.
• Since you are using servers they control, always assume your ISP is logging your DNS requests (no privacy).
• Sometimes an ISP actually has worse DNS resolvers (slower, less secure) than a 3rd party DNS service.
• I used to make use of my ISP’s DNS resolvers. They would occasionally go down every few months. It made it look like the Internet was down, but it was just their DNS resolvers that were down, which caused software to fail since they could not resolve domains to connect to services.
• Some ISPs will redirect you to their own online search engine, if the domain you are looking for does not exist. That is real tacky. They should just give the standard DNS error response, instead of – effectively – hijacking your DNS service.

Third-Party DNS Resolver (e.g., Cloudflare, OpenDNS):  good-to-excellent performance / potentially less private

• 3rd party DNS resolver may be logging your DNS lookups, regardless of what their Privacy Policy says.
• Can be faster than your ISP’s DNS resolvers. This is due to 3rd party DNS services having a very large network infrastructure. They can handle large amounts of traffic with ease.
• Cloudflare does support DNS-over-TLS. However this is just encrypting your connection to Cloudflare. When Cloudflare retrieves the DNS records for you – assuming they do not have a cached copy – that connection of theirs is unencrypted. This means the DNS records Cloudflare gets for you can be manipulated by a 3rd party, outside of Cloudflare’s control.
• Encrypting your DNS does not prevent your ISP from seeing what domains you are going to, if the web-server you are connecting to does not support both the TLS 1.3 protocol and the ESNI extension. This is due to the fact the SNI (Server Name Identification) gets sent from the web-server in plain text. With this information, your ISP can effectively see which domains you are visiting, regardless if your DNS is encrypted via Cloudflare or another 3rd party service.
• Unless you are using a VPN service, your ISP will still have to route your connection to the website (they can see the web-server’s IP address). This may give away where you are going on the Internet, even if your ISP cannot read your DNS queries.
• There are some free public DNS resolvers, run by volunteers (read: no large corporations), who claim they do not log your domain lookups. Just like I mentioned before, you must take their word for it.

Self-Hosted DNS Resolver (e.g., Unbound DNS server):  OK-to-good performance / potentially more private

• Useful if you want to have reliable lookups, since you are cutting out the middle-man handling your DNS requests (you are going directly to the source, instead of having someone else do it for you).
• If you are self-hosting web services (e.g., web and email), it is recommended to run your own DNS resolver. While not necessary, this will help prevent interruptions to your services.
• While there is no worry about the DNS resolver keeping logs (you are running it, after all), there still is the possibility of your ISP and/or other entities sniffing your DNS lookups and keeping a log that way. This is because DNS is inherently insecure (not encrypted).
• Unbound runs on many different operating systems (e.g., FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows).
• Unbound does require some knowledge of DNS to be setup properly. Users who have little to no experience with DNS servers may find setting up Unbound to be difficult.
• Something to keep in mind. When doing your own DNS lookups, usually you are contacting the Root DNS servers, domain TLD nameservers, and of course one of the domain’s nameservers using your public IP address from your ISP. This means all three of those services may log your IP address when doing lookups.
  • For example, if I lookup my domain computerlagoon.com via Unbound, it will first ask a Root DNS server for a nameserver belonging to the .com TLD. From there it will ask one of the TLD’s nameservers for one of my nameservers to get the webserver’s IP address.
  • There is a very good chance the .com TLD nameserver, run by Verisign, is logging domain lookups. This means someone, somewhere is more than likely logging your lookups (associating your lookups with your IP) even if you opt to self-host your own DNS resolver.

Summary Chart