[caconym_]

> Interesting that traffic didn't return to completely normal levels after the incident.

Anecdotally, I figured out their DNS was broken before it hit their status page and switched my upstream DNS over to Google. Haven't gotten around to switching back yet.

[radicaldreamer]

What would be a good reason to switch back from Google DNS?

[Algent]

After trying both several time I since stayed with google due to cloudflare always returning really bad IPs for anything involving CDN. Having users complain stuff take age to load because you got matched to an IP on opposite side of planet is a bit problematic especially when it rarely happen on other dns providers. Maybe there is a way to fix this but I admit I went for the easier option of going back to good old 8.8.8.8

[homebrewer]

No, it's deliberately not implemented:

https://developers.cloudflare.com/1.1.1.1/faq/#does-1111-sen...

I've also changed to 9.9.9.9 and 8.8.8.8 after using 1.1.1.1 for several years because connectivity here is not very good, and being connected to the wrong data center means RTT in excess of 300 ms. Makes the web very sluggish.

[Aachen]

Does that setup fall back to 8.8.8.8 if 9.9.9.9 fails to resolve?

Quad9 has a very aggressive blocking policy (my site with user-uploaded content was banned without even reporting the malicious content; if you're a big brand name it seems to be fine to have user-uploaded content though) which this would be a possible workaround for, but it may not take an nxdomain response as a resolver failure

[sammy2255]

Depends who you trust more with your DNS traffic. I know who I trust more.

[nojs]

Who? Honest question

[immibis]

Myself, I suppose? Recursive resolvers are low-maintenance, and you get less exposure to ISP censorship (which "developed" countries also do).

[Elucalidavah]

Realistically, either you ignore the privacy concerns and set up routing to multiple providers preferring the fastest, or you go all-in on privacy and route DNS over Tor over bridge.

Although, perhaps, having an external VPS with a dns proxy could be a good middle ground?

[daneel_w]

If you're the technical type you can run Unbound locally (even on Windows) and let it forward queries with DoT. No need for neither Tor nor running your own external resolver.

[Tijdreiziger]

Middle ground is ISP DNS, right?

[sumeno]

If privacy is your primary concern I would 100% trust Cloudflare or Google over an ISP in the US

[daneel_w]

Quad9, dns0.

[misiek08]

Google is serving you ads, CF isn’t.

And it’s not conspiracy theory - it was very suspicious when we did some testing on small, aware group. The traffic didn’t look like being handled anonymously at Google side

[mnordhoff]

Unless the privacy policy changed recently, Google shouldn't be doing anything nefarious with 8.8.8.8 DNS queries.

[daneel_w]

Yeah it's not like they have a long track record of being caught red-handed stepping all over privacy regulations and snarfing up user activity data across their entire range of free products...

[DarkCrusader2]

They weren't supposed to do anything with our gmail data as well. That didn't stop them.

[opan]

CF breaks half the web with their awful challenges that fail in many non-mainstream browsers (even ones based on chromium).