[saaaaaam]

I use cloudflare DNS because it’s faster. But should I worry, having read your comment? What is the downside to using it? What would you recommend instead?

[surgical_fire]

Quad9.

Many years ago I used Cloudflare, and more than once I had issues with them blocking websites I wanted to access.

I absolutely despise that. I want my DNS to resolve domain names, nothing else.

For blocking things I have Pi-Hole, which is under my control for that reason. I can blacklist or whitelist addresses to my needs, not to the whims of a corporation that wants to play gatekeeper to what I can browse.

[akerl_]

So… why not use 1.1.1.1, cloudflare’s resolver that does not block resolution?

1.1.1.2 and .3 are explicitly offered with filtered responses.

[surgical_fire]

I used to use 1.1.1.1. I still had issues.

Quad9 behaves exactly as I expect a DNS to work, in the sense that I only remember I use it when the topic of DNS pops up.

[akerl_]

Your claim was that 1.1.1.1 was blocking sites.

Are you saying now you just had issues with the quality of service? Or do you want to provide more details to substantiate the claim that they were blocking sites?

[surgical_fire]

No, I do not keep any logs from domain name resolution from the DNS service I used from 7+ years ago. If you do, I commend you.

I used the term "blocking" in a loose sense. I have no idea if Cloudflare was failing to resolve certain domains because it is a shitty service, or if it was ordered to block those domain names by its government, or if it was actively not resolving domain names because it thought a good idea to be a sort of arbiter and gatekeeper. I suspect the last option, but it is just speculation.

What I can affirm is that I had issues more than once with domain name resolution when I used 1.1.1.1. After it annoyed me enough I switched to Quad9, and it has been great ever since, which is why I recommend it as a user of their service.

[longislandguido]

> I have no idea if Cloudflare was failing to resolve certain domains because it is a shitty service, or if it was ordered to block those domain names by its government, or if it was actively not resolving domain names because it thought a good idea to be a sort of arbiter and gatekeeper.

I'm going to go with option D) whatever shitty site you were browsing to had a broken DNS or more likely DNSSEC configuration and Cloudflare was correct to not serve a corrupt response.

99% of the time, tales of "they're blocking my site! you guys are nazis!" always turn out to have a root cause of broken DNS configuration.

[akerl_]

I don’t keep DNS logs at all. But I also don’t show up 7 years later trash talking a company or product based on guesswork and fear.

[hirako2000]

Because that would be subject to the whim of the provider, who subject to court orders would have to oblige to continue operating as US entity.

[akerl_]

How does that differ from Quad9? You’re subject to Swiss laws, so there’s still a government involved? And you’re now hosted in an area where the US government has far fewer limitations on what they can attempt.

[Kwpolska]

Quad9 is based in Switzerland, but the three founders-sponsors are US-based [0], so I’m not sure if it can be considered 100% safe from US government intervention.

[0] https://quad9.net/about/sponsors/

[KomoD]

The ASN and stuff is also operated by a US entity it seems like:

  ASHandle:       AS19281
  Street:         CleanerDNS Inc. dba Quad9
  Street:         1442A Walnut Street, Suite 501
  City:           Berkeley
  State/Prov:     CA
  Country:        US

They also have servers in the US, so that's yet another reason not to consider them "100% safe from US government intervention"

[akerl_]

Also a quick search suggests that Switzerland has made Internet providers in-country block DNS results in the past.

[ranger_danger]

Why give all your queries to a single company with an interest in tracking you and selling your data?

[saaaaaam]

But don’t most ISPs do this? And if you use google’s DNS, for example, are they not doing this? Does cloudflare sell the data?

[ranger_danger]

IMO all the more reason to run your own resolver and not just forward every query to a single entity.