[Mindless2112]

Interesting that traffic didn't return to completely normal levels after the incident.

I recently started using the "luci-app-https-dns-proxy" package on OpenWrt, which is preconfigured to use both Cloudflare and Google DNS, and since DoH was mostly unaffected, I didn't notice an outage. (Though if DoH had been affected, it presumably would have failed over to Google DNS anyway.)

[caconym_]

> Interesting that traffic didn't return to completely normal levels after the incident.

Anecdotally, I figured out their DNS was broken before it hit their status page and switched my upstream DNS over to Google. Haven't gotten around to switching back yet.

[radicaldreamer]

What would be a good reason to switch back from Google DNS?

[Algent]

After trying both several time I since stayed with google due to cloudflare always returning really bad IPs for anything involving CDN. Having users complain stuff take age to load because you got matched to an IP on opposite side of planet is a bit problematic especially when it rarely happen on other dns providers. Maybe there is a way to fix this but I admit I went for the easier option of going back to good old 8.8.8.8

[homebrewer]

No, it's deliberately not implemented:

https://developers.cloudflare.com/1.1.1.1/faq/#does-1111-sen...

I've also changed to 9.9.9.9 and 8.8.8.8 after using 1.1.1.1 for several years because connectivity here is not very good, and being connected to the wrong data center means RTT in excess of 300 ms. Makes the web very sluggish.

[Aachen]

Does that setup fall back to 8.8.8.8 if 9.9.9.9 fails to resolve?

Quad9 has a very aggressive blocking policy (my site with user-uploaded content was banned without even reporting the malicious content; if you're a big brand name it seems to be fine to have user-uploaded content though) which this would be a possible workaround for, but it may not take an nxdomain response as a resolver failure

[sammy2255]

Depends who you trust more with your DNS traffic. I know who I trust more.

[nojs]

Who? Honest question

[immibis]

Myself, I suppose? Recursive resolvers are low-maintenance, and you get less exposure to ISP censorship (which "developed" countries also do).

[Elucalidavah]

Realistically, either you ignore the privacy concerns and set up routing to multiple providers preferring the fastest, or you go all-in on privacy and route DNS over Tor over bridge.

Although, perhaps, having an external VPS with a dns proxy could be a good middle ground?

[daneel_w]

If you're the technical type you can run Unbound locally (even on Windows) and let it forward queries with DoT. No need for neither Tor nor running your own external resolver.

[Tijdreiziger]

Middle ground is ISP DNS, right?

[daneel_w]

Quad9, dns0.

[misiek08]

Google is serving you ads, CF isn’t.

And it’s not conspiracy theory - it was very suspicious when we did some testing on small, aware group. The traffic didn’t look like being handled anonymously at Google side

[mnordhoff]

Unless the privacy policy changed recently, Google shouldn't be doing anything nefarious with 8.8.8.8 DNS queries.

[opan]

CF breaks half the web with their awful challenges that fail in many non-mainstream browsers (even ones based on chromium).

[anon7000]

They go into that more towards the end, sounds like some smaller % of servers needed more direct intervention

[bastawhiz]

If your Internet doesn't work, you'll get up and do other things for a while. I strongly suspect most folks didn't switch DNS providers in that time.

[motorest]

> Interesting that traffic didn't return to completely normal levels after the incident.

Clients cache DNS resolutions to avoid having to do that request each time they send a request. It's plausible that some clients held on to their cache for a significant period.