[3xblah]

Do not use third party recursive DNS services, such as Google or OpenDNS.

If running own DNS recursor, turn off EDNS; only send traditional 512 byte DNS packets.

Use DNS software that does not support EDNS, such as djbdns.

[DanielDent]

Third party DNS servers are helpful in one sense - you can share your state with other users.

Turning off EDNS with your own recursor won't really make much difference. Limiting the maximum cache length will help, but will also eliminate much of the benefit of having a local recursor.

The other issue with running your own recursor is nasty networks will transparently proxy DNS and you can end up using a cache you don't even know exists.

DNSCurve, DNSCrypt, and DNS-over-HTTPS solve one set of problems while introducing different ones.

[3xblah]

Sharing a cache with other users introduces its own set of problems, e.g., cache poisoning. The problems that arise from shared DNS caches gave rise to "solutions" that in turn introduced further problems.

For transparent proxying, i.e., hotel internet, I use a local forwarder and a remote recursor listening on a non-standard port and it has worked flawlessly.

I prefer to serve static address info via authoritative DNS or /etc/hosts. I have other methods of getting DNS data besides querying caches. I have no need for DNS caches. Most websites I visit do not change addresses frequently. I also like to know when they change, if they ever do.

I have not experienced any problems with DNSCurve.

[ignoramous]

Thanks.

> DNSCurve, DNSCrypt, and DNS-over-HTTPS solve one set of problems while introducing different ones.

You seem to know quite a bit: Are there series of blog posts where you've detailed these issues and/or proposed mitigations?

[DanielDent]

I appreciate the compliment, but sadly I haven't yet made the time to write much on the subject. There's a lot I'd like to see implemented.