Has anyone tried using OpenDNS?

[SteveRiley]

DNS is hierarchical and based on delegated zones. There is no "propagation," as such, because servers use recursion to find answers.

Start by learning the basics: https://en.wikipedia.org/wiki/Dns

[GreyGeek]

How big of an HD does one need to set up their own DNS, or can one install bind9 on their laptop and use it as a server. Seems to me that it would involve a massive downloading of DNS tuplets, and regular refreshing. How much traffic would that generate? Would it saturate a 15Mb/s connection?

[dibl]

The *buntu repositories include Namebench ...

Now THERE is a useful tip -- thank you very much, Steve! I ran it at home and it showed me a pair of servers that ostensibly are 33% faster than my stupid default u-verse setup. Already converted 3 out of 5 computers.

Nice one!

[Snowhog]

Yes indeed. I download/installed/ran it last night. When it finished it reported that my ISP's DNS IP's (primary/secondary) were 37% slower than the two it recommended! I made the changes in my router and the wireless connection configuration for ipV4 in networkmanager.

[Feathers McGraw]

Cool, I can't wait to try it out.

I wonder how much processing power a DNS server uses, I may run it on my router, makes sense to have the DNS and DCHP severs on the same box.

[Feathers McGraw]

Ran it twice, once for localhost and once for my router.

For my router, Google public DNS was ~40% faster, OpenDNS was ~34% faster
For localhost, Google public DNS was ~63.5% faster, OpenDNS was ~53.5% faster

I don't want Google to have a list of every page I request (they already have too much of my data), so I might use OpenDNS.

Feathers

[Feathers McGraw]

That was ridiculously easy. <3 OpenWRT

[GreyGeek]

I just tried namebench. It took about 20 minutes. It said 192.168.1.1 was my fastest DNS and recommend 4.2.2.2 and 4.2.2.4 as secondary and tertiary DNS servers. In the list those two were 30% slower than 192.168.1.1 and Google's 8.8.8.8 was only 8% slower.

Also, it doesn't appear to be supported any more. It claimed that Paypal, Google and some other IP address had been hijacked, but that was because namebench wasn't aware that those domains had added IP addresses. Lots of childish posts in the comments section.

[Feathers McGraw]

I just tried namebench. It took about 20 minutes. It said 192.168.1.1 was my fastest DNS and recommend 4.2.2.2 and 4.2.2.4 as secondary and tertiary DNS servers. In the list those two were 30% slower than 192.168.1.1 and Google's 8.8.8.8 was only 8% slower.

Also, it doesn't appear to be supported any more. It claimed that Paypal, Google and some other IP address had been hijacked, but that was because namebench wasn't aware that those domains had added IP addresses. Lots of childish posts in the comments section.

I noticed that too, for example:

PayPal has been hijacked by... www.PayPal.com.akadns.net?

Try the link, you get to the proper website, verified by VeriSign

The websites that "aren't OK" seem consistent across the servers, so it's still a decent check. Perhaps these websites have recently updated their records?

What do you mean by childish posts?

[GreyGeek]

Childish posts? Seeing the hijack msgs and the youporn listings, and Google performance led to usual conspiracy posts.

[SteveRiley]

How big of an HD does one need to set up their own DNS, or can one install bind9 on their laptop and use it as a server. Seems to me that it would involve a massive downloading of DNS tuplets, and regular refreshing. How much traffic would that generate? Would it saturate a 15Mb/s connection?

DNS is very efficient.

On the wire, a DNS question can fit in a single UDP datagram. Most answers can also fit in a single UDP datagram; however, if the answer is longer than 512 bytes (rare), DNS switches to TCP.

On disk, a DNS server stores a handful of service configuration files and a small file for each authoritative or delegated zone (Internet domain). My home network is rileyz.local, and I have two zone files: /var/lib/bind/rileyz.local.hosts stores "A" records (host-to-IP) and /var/lib/bind/192.168.0.rev stores "PTR" records (IP-to-host, for reverse lookups).

And that's it. DNS servers do not store the domain name system of the entire Internet -- the whole point of DNS is avoid this requirement. When a host on my network wants to resolve foo.bar.com, it asks my DNS server. My server is not authoritative for the domain bar.com, therefore it will begin discovery of the answer by consulting the Internet's root servers. The conversation is as follows:

MY-SERVER: "Root, who is authoritative for .com?"
ROOT-SERVER: "W.X.Y.Z"
MY-SERVER: "W.X.Y.Z, who is authoritative for bar.com?"
W.X.Y.Z: "A.B.C.D"
MY-SERVER: "A.B.C.D, what is the address of foo.bar.com?"
A.B.C.D: "H.J.K.L"

My server then returns the answer to the host asking the question. It will also cache the answer (up to the duration of the time-to-live included in the answer) so that subsequent requests for the same information can be answered locally. DNS caches live only in RAM, not on disk.

[SteveRiley]

I wonder how much processing power a DNS server uses,

Almost nothing:

root@m92p:~# [B]ps -ef | grep named[/B]
bind      2552     1  0 Dec06 ?        00:00:29 /usr/sbin/named -4 -u bind

root@m92p:~# [B]ps eho %cpu -p 2552[/B]
 0.0

root@m92p:~# [B]ps eho %mem -p 2552[/B]
 1.4

That was ridiculously easy. <3 OpenWRT

Your configuration is a little different than running an instance of bind on a server. Note the "DNS forwardings" entry. A forwarder is a DNS server that performs external name resolution on behalf of another server. Typically, you configure a forwarder on a DNS server that can't directly contact the Internet's root DNS servers to begin a query. In your case, you need a forwarder, because dnsmasq requires it. Unlike bind, which is a fully recursive and Internet-aware DNS server, dnsmasq is a forwarding-only resolver.

[SteveRiley]

Also, it doesn't appear to be supported any more. It claimed that Paypal, Google and some other IP address had been hijacked, but that was because namebench wasn't aware that those domains had added IP addresses. Lots of childish posts in the comments section.

I noticed that too, for example...

Yeah, like Jerry wrote -- Namebench's config files haven't been kept up to date. See the comment by jan...@gmail.com dated 22 April 2013 for a good explanation. The tool is incorrectly using the term "hijack" in this context, which is unfortunate.

[GreyGeek]

DNS is very efficient....

Wow! This 72 year old brain actually understood that!
"Pan-Galactic Quordlepleen" doesn't do you justice. "Pan-Galactic Polished Diamond" would fit better, unless "Quordlepleen" means that!

It looks like I am going to be installing bind9.

Next I'll need to figure out how to add IPv6 DNS support. I've started reading RFC 4472.
Scratch that. I checked with http://test-ipv6.com/ and it gives me a 10/10. Apparently my ISP (timewarner) now supports IPv6 DNS:

[TABLE]
[TR]
[TD]Test with IPv4 DNS record[/TD]
                  [TD] [/TD]
                  [TD]                   ok (0.100s) using ipv4
                 [/TD]
               [/TR]
                [TR]
                 [TD]Test with IPv6 DNS record[/TD]
                  [TD] [/TD]
                  [TD]                   ok (0.218s) using ipv6
                 [/TD]
               [/TR]
                [TR]
                 [TD]Test with Dual Stack DNS record[/TD]
                  [TD] [/TD]
                  [TD]                   ok (0.321s) using ipv6
                 [/TD]
               [/TR]
                [TR]
                 [TD]Test for Dual Stack DNS and large packet[/TD]
                  [TD] [/TD]
                  [TD]                   ok (0.128s) using ipv6
                 [/TD]
               [/TR]
                [TR]
                 [TD]Test IPv4 without DNS[/TD]
                  [TD] [/TD]
                  [TD]                   ok (0.143s) using ipv4
                 [/TD]
               [/TR]
                [TR]
                 [TD]Test IPv6 without DNS[/TD]
                  [TD] [/TD]
                  [TD]                   ok (0.297s) using ipv6
                 [/TD]
               [/TR]
                [TR]
                 [TD]Test IPv6 large packet[/TD]
                  [TD] [/TD]
                  [TD]                   ok (0.204s) using ipv6
                 [/TD]
               [/TR]
                [TR]
                 [TD]Test if your ISP's DNS server uses IPv6[/TD]
                  [TD] [/TD]
                  [TD]                   ok (0.323s) using ipv6
                 [/TD]
               [/TR]
                [TR]
                 [TD]Find IPv4 Service Provider[/TD]
                  [TD] [/TD]
                  [TD]                   ok (0.282s) using ipv4 ASN 11955
                 [/TD]
               [/TR]
                [TR]
                 [TD]Find IPv6 Service Provider[/TD]
                  [TD] [/TD]
                  [TD]                   ok (0.253s) using ipv6 ASN 19255
[/TD]
[/TR]
[/TABLE]

[SteveRiley]

Ah, Jerry, I'm just doing what I like to do. Paying forward, as it were. What good is all this crap cluttering my brain if I can't share it?