Hacker News new | ask | show | jobs
by justsomehnguy 1207 days ago
You can run your own resolver
2 comments

Doing so is usually pointless. Either your ISP isn't evil, in which case there's no need since you could just use theirs, or your ISP is evil, in which case they'll hijack all of the recursive queries that your own resolver would need to make.
Note: you can run your own resolver not at your home machine
If you have a suitable machine to do so, then couldn't you just tunnel your DNS traffic through it and out its default resolver, without having to run your own?
The question would be why bother with 3rd-party resolvers in that case?

NB I have a slightly different setup - I run Unbound locally and route DNS requests through the 'suitable machine' on VPS over VPN established by my LAN router. I considered moving the resolver there but didn't yet found the setup what would be usable for me when I would be out of my LAN. Opening my resolver to the whole world is the way to be a part of the bot relays for DDoS attacks, so this is out of question.

What if root servers just take it down? Retract the domain registration, etc.
> What if root servers just take it down?

Root servers only control the mapping up to the TLD. That is, they for instance know the nameservers for ".br", but they know nothing about the nameservers for ".com.br", or about the domains below that. If your domain is "example.com.br", the nameservers which could "just take it down" are the nameservers for ".com.br", not the root nameservers. In the same way, the root servers are completely unrelated to domain registrations (other than pointing to nameservers which know about them).

Then noone could resolve it, including Quad9, CloudFlare, Cisco, Google etc.
Your resolver can resolve any domain to any IP.

As long as it’s a static IP and the server is still there, you’d still have access as long as you had that mapping.