My ISP is AT&T (located in the U.S.) and I have issues loading random websites. Currently have Google DNS set in my router, which works great. But I’m guessing there’s a better, more private, option?
You must log in or register to comment.
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
- Don’t promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
- 0 users online
- 124 users / day
- 1.05K users / week
- 1.3K users / month
- 4.58K users / 6 months
- 1 subscriber
- 3.35K Posts
- 85.3K Comments
- Modlog
Quad9 (9.9.9.9) is my go to.
This tool is great for figuring out which one is the fastest for you: https://www.grc.com/dns/benchmark.htm
I use 1.1.1.1 as my dns because I don’t forget it. Should I not be?
The question to ask yourself is why is cloudflare offering that service for free? Probably because they get something out of it, like analysing the data.
NextDNS has the ability to change the logging region to one that’s outside your governments jurisdiction
Go directly to the root.
Rethink DNS, DNS Warden, and ControlD with Hagezi blocklists via DoH/3. I highly recommend the ‘+ TIF’ as they are threat intelligence feeds which are up to date lists of bad actors/malware.
quad9, blahdns, dnscry.pt, ibksturm, koki, litepay.ch serbica
nextdns or mullvad？
If you need a traditional, unencrypted DNS service, check out Quad9 and AdGuard’s Public DNS. If you can use DoT or DoH, use LibreDNS or Mullvad DNS. If you want more customization, check out NextDNS.
Quad9 does also offer DoT and DoH.
Even DNSCrypt, but I think nobody really uses that.
In regards to all the answers in this thread, consider: If you’re not paying for it with money, then what are you paying for it with?
The most private DNS is a recursive resolver.
I use a local unbound DNS server on my router with Quad9 as upstream. I actually have google DNS entirely blocked/rerouted on my router because google uses it for advertising tracking, but I get creepers out by targeted ads showing up in random places when I do do something on a totally unrelated site. Most important thing, though, is to use
DNSSECDNS over TLS or DNS over HTTPS to reduce middlemen from using your DNS info to track what sites you visit and sell that data. Of course ISPs still see the destination of all of your data for tracking what sites you visit unless you use a VPN or similar tools, so you can’t hide it from them that way.Edit: DNS over TLS not DNSSEC, totally different thing…
DNSSEC is a means of authenticating the data receives was not tampered with, such as MITM attacks, thus ensuring data integrity. It uses PKI but it’s not an alternative to DoH or DoT which encrypts the DNS traffic, either over HTTPS or TLS, providing confidentiality.
DNSSEC can be used in conjunction with DoH or DoT to achieve the Security CIA triad - Confidentiality, Integrity, Authenticity.
Thanks for the correction, that was a typo based on a long work day screwing with my brain processing acronyms. I meant to say DNS over TLS or DNS over HTTPS.
Do you have the local unbound server respond to DoH so that the browser also uses encrypted client hello?
No. I don’t use DoH inside my network because I redirect DNS traffic on my primary VLAN to a pihole for ad and malware reducing. But I also control what has access to that VLAN pretty strictly. I have another VLAN for guests and untrusted devices that doesn’t use the redirecting, but does use the Unbound server as the default DNS, just doesn’t enforce it. And I have an even more locked down VLAN for self-hosted servers that also doesn’t use the pihole, but does use Unbound.
Yeah fair. I tried setting it up, but honestly probably not worth the effort in home networks. Problem is browsers don’t know that the other end of the unbound DNS server is DoH, so it won’t use ECH. Even once set up, most browsers need to be manually configured to use the local DoH server. Once there’s better OS support and auto config via DDR and/or DNR it’ll be more worth bothering with.
Check out PrivacyGuides. They have recommendations for DNS including what others have commented
Adguard DNS, so I can block ads in my entire house without having to invest in a PiHole. dns.adguard-dns.com More IPs
I’ve been using Adguard public DNS for over a year across my LAN and it works great, with much less hassle than a pihole, which I previously used for years.
I miss the ability to add random hosts to either black or white lists, but in reality only used it sporadically.
Controld.com. I use their free version that blocks ads and online tracking and malware.
Cloudflare 1.1.1.1 Google 8.8.8.8 or 8.8.4.4
You are suggesting trackers
Don’t use these unless you are properly configure them but even then… They are used for tracking
Mullvad and quad9 are better for privacy people
There are others tho
A simple solution is Quad9 aka 9.9.9.9. NextDNS is fairly simple but allows customization.