Hacker News new | ask | show | jobs
by ams6110 3744 days ago
I don't use my ISP for DNS. Nor for email. Not sure that really protects anything but at least it sidesteps any log mining they're doing on their own servers.
1 comments

I use my ISP (Comcast) for DNS mainly for 2 reasons:

1. No other public DNS is faster. 75.75.75.75 is 6 "hops" away at 15ms rtt. Google's 8.8.8.8 is 10 hops away at 25ms rtt. DNS adds about 3 ms of latency for both services.

2. It's my understanding that many services can use DNS to do geographical load balancing when Anycast isn't an option. When using Google DNS I would routinely get pointed to Akamai nodes in Chicago. I live in Nashville. After switching back to Comcast I know reach Akamai in Atlanta, which provides much lower latency and higher throughput.

Just my two cents.

If you have the ability, you can run DNSmasq[0] locally (i.e. 1 hop or less) on your router. For the sites that you interact with frequently, it is quite helpful.

[0]https://en.wikipedia.org/wiki/Dnsmasq

N.B. I say or less because you can run it on your machine as well.

Sacrificing privacy for speed is a bad tradeoff in this instance as DNS request speed is over emphasized in almost all cases (case in point classifying 15ms vs 25ms as a "problem").

If a site is not already cached at the OS level than a typical DNS lookup from the central / east coast US to EU takes ~120-130ms. 8x slower may at first sound really bad until you pause to consider that the unit in question is milliseconds.

Your web browser and the webpage itself are generally doing far more damage to your page load times than the DNS lookup.

Sacrificing privacy? Sorry, but my ISP knows what DNS queries I make regardless of which service I use.
There is an important difference to recognize between your ISP inspecting network packets 24x7 to target and collect your DNS queries vs you handing the infomation directly to them.
The other problem with using your ISP's DNS severs is they can hijack your request, or be slow/down all the time. 4/5 when the "internet doesn't work" it's just the cable company DNS not working and using Google or OpenDNS "restore service"
This is true, earlier this morning my ISP's secondary DNS server for my state was down. Good thing I roll with my ISP's main server first, and 8.8.8.8 as my secondary nameserver.
They're your ISP, so they can hijack any IP they want if they felt inclined to do so.