[navyrain]

DNSCrypt is a cool utility, but somewhat of a mixed bag, since OpenDNS serves up responses for invalid DNS records, in an effort to send you to website-unavailable.com

This hijacking (I am blanking on the technical term for it) really rubs me the wrong way. Is there a way to get around it?

[davidu]

1) Anyone can run a DNSCrupt resolver...

2) You can create an account with us (free) and disable DNS redirection. This will get _much_ better / easier in the coming months as we continue to move away from ad revenue as a revenue stream.

3) This is a really old story. :-)

[finnn]

How about AAAA (IPV6) records? I've spoken with a number of people who are unable to resolve AAAA records because they made the mistake of using OpenDNS. So instead of seeing a v6 only site, they get a face full of ads

[wesley]

Can't seem to find the setting to disable dns redirection, can you tell me where to look?

Edit: OK, found it - free users need to go to advanced settings > domain typos and disable that.

[ef47d35620c1]

If you are trying to keep you children away from porn sites, you have to set that option:

"Typo Correction is required for Web Content Filtering.

You will lose 13 categories of blocking if you disable Typo Correction."

[davidu]

This will be resolved...soon.

[pstack]

OpenDNS allows you to disable interception of NXDOMAIN. Just go to your Customization settings and make sure "Enable NX Domain Redirection" is unchecked.

Ex: http://i.imgur.com/UxjoLkA.png

I invite correction, if I'm wrong, but I don't believe the option requires being a paying customer of their service.

[da_maire]

Dnsmasq's bogus-nxdomain flag will do what you want, but it's not a good long-term solution. You'd be better off just using a DNS service that doesn't hijack responses.

[atmosx]

Me too, that's why I use OpenNIC + unbound and now thinking of installing dnscrypt-proxy too for the local network to encryption between me and OpenNIC servers, since it's supported.

note: I had a similar on another thread on HN, weird :0

[blibble]

don't use their service?

easier said than done I know... my commuter train's wifi uses "Open"DNS, and most interesting websites are blocked (reddit, anything gaming related, etc), and the block pages are filled with their obnoxious advertising.

I've been saying this for years, but I can't wait for DNSSEC to put people like OpenDNS out of business (isn't it odd they want to FUD the waters by pushing DNSCrypt?)

[pstack]

Why do you want to put OpenDNS out of business? They offer a decent free service that is faster and more reliable than your ISP's nameservers usually are and they offer you a lot of control.

Don't like having NXDOMAIN redirected? Disable it.

Want to filter out and be alerted on queries that seem to be due to known malware and phising and botnets? Select that option.

Want to limit access to websites with certain content? Select what you want to filter (I only filter out the Web Spam, Parked Domain, and Typo Squatting categories). Filter out nothing, if you prefer.

Are you a public library or academic institution or a work place and you have to restrict certain content? Select the porn or social networking or adware or other sections (yeah, this might rub people the wrong way, but OpenDNS is giving the administrator of a given network the control over their network to do what they want with it).

Really hate doubleclick? Add them to the bocked domain list on opendns.

I really fail to see why anyone would have significant problems with OpenDNS. I've been using them for years and I'm a software engineer who requires things to work as expected on my network for testing and debugging -- and OpenDNS hasn't ever been a problem for me, so I'd really like to know what legitimate problems people have with it (other than the fact that, like Comcast or any other provider of a service, they could theoretically be collecting data on you and utilize it in some nefarious fashion, which I just assume of all services free or paid these days).

[drdaeman]

> faster [...] than your ISP's nameservers usually

This is probably incorrect.

Here's one of my ISP's (full disclosure: I work for this ISP) local NS:

    --- 188.64.128.3 ping statistics ---
    50 packets transmitted, 50 received, 0% packet loss, time 990ms
    rtt min/avg/max/mdev = 0.142/0.198/0.423/0.059 ms

And here's OpenDNS:

    --- 208.67.222.222 ping statistics ---
    50 packets transmitted, 50 received, 0% packet loss, time 1156ms
    rtt min/avg/max/mdev = 36.448/36.820/37.379/0.346 ms, pipe 2

So, OpenDNS responses are about 36.6ms slower (considering most queries should be cache hits, not misses), just because it's 4 hops further from me. I believe, unless local ISPs nameservers are running on particularly slow or busy server and have proper caching, they should perform better than more physically distant nameservers. I presume, for most users, OpenDNS servers are farther than local ISP ones.

[pstack]

But you're just pinging the servers, which is not as informative as the actual response time for returning a lookup.

There are exceptions, but ISP-provided nameservers are often problematic. My ISP is one of the two or three biggest in the nation and they intercept NXDOMAIN, their response time is rarely better than OpenDNS or Google's DNS, and they have gone down more than a few times.

I've had none of these problems with OpenDNS.

One would like to believe that address resolution is such a basic vital service that every provider in every region on the planet both emphasizes and executes it superbly. Unfortunately, they frequently do not.

I don't know why using your ISP's nameservers is an assumed thing. Do you assume that everyone uses their ISP's provided email service? Their ISP's complimentary crappy webhosting service? Their ISP's bundled McAffee anti-virus? Of course not. You shop around for the best option for yourself. DNS is the same way. My ISP provides me with it, but so do a lot of other people. Some free and some for pay. When your ISP or another service isn't cutting it for you, you shop around for alternatives.

[drdaeman]

> But you're just pinging the servers

Right. The reasoning is, given that most queries are cache hits (otherwise it's something wrong with the nameserver or environment), lookup times are really negligible if compared to network latency. On our servers cache hits are about 78% of all queries. So, even if 22% of queries are somehow slower (say, latency between ns1.google.com and my DNS is about 47ms, and I guess for OpenDNS it's less than 20ms - so it's, say, 22% of queries are 30ms slower), still it should hold that for a typical user in most cases local ISP nameserver performs better than OpenDNS one.

> they intercept NXDOMAIN

I only wrote about speed, and this is completely another point. Even if they're have faster response times, invalid responses are not worth it, so I'm with you on this. BTW, I remember why I hopped away from OpenDNS - when they introduced premium plans they started to do some NXDOMAIN hijacking and ads injections. Opt-out, but still that annoyed me.

Stability is another issue, too. Guess, OpenDNS should be a clear winner here, too, as they're supposedly having much more redundant nameserver infrastructure than average ISP out there.

> I don't know why using your ISP's nameservers is an assumed thing.

It's not assumed, just a reasonable default. When you set up IP layer, you need NS address(es). You don't need a email or web hosting to participate in basic network connectivity, but you need DNS. Usually, setup is done automatically, using IPCP, DHCP or other sort of configuration protocol, where ISP supplies the client's machine with the necessary information. And obviously, most ISPs provide you with their nameservers, not some third party ones, because in case of failures they can run and fix their own infrastructure, but can only wait for a third party to solve problems on their side and hope it happens soon enough.

In most cases (i.e. unless the ISP is retarded to the extent of filtering out or redirecting DNS packets to another nameservers) you're obviously free to manually override configuration with nameservers of choice. Even encouraged if ISP-provided services are crappy. I've only argued that they should be generally faster, not the other way around.

[pstack]

Fair enough points.

The NXDOMAIN interception is actually why I wounded up at OpenDNS, myself. It was back during the time that Comcast started to force it on users. I work with mega-enterprise-level email servers, among other things, and having my NXDOMAIN response screwed with is unacceptable. Between that and the occasional outages I had with their DNS over the years, I decided it was time to shift away.

Regardless, I think the good takeaway is that we live in a world where we have choices and I hope we keep that (and get more). You get to dislike OpenDNS and prefer your ISP and I get to dislike my ISP and opt for OpenDNS. :D

[blibble]

whilst I can't choose my DNS provider on the train, at home I choose an ISP that is capable of running a recursive name server (if they can't run this very basic part of the service, I dare to think what the rest of it would be like...)

I'm still not sure why the practise of deliberately returning spoofed garbage in response to legitimate queries is seen as an acceptable practise.

[derefr]

> an ISP that is capable of running a recursive name server

I've never experienced such an ISP, and I've been through many. The mismanagement of ISP-hosted DNS, as far as I can tell, is the most common cause of residential "internet outage."

[drdaeman]

> I've never experienced such an ISP

How did they provide DNS services to their clients then? Or they bootstrapped you (via DHCP[v6], PPP's IP[6]CP or whatever they use to set up your IP layer) with public nameserver addresses like OpenDNS or Google Public DNS?

I believe I heard somewhere desktop Windows' resolver won't work iteratively and requires a nameserver capable of recursion. Although I may be mistaken on this matter.

[derefr]

I didn't mean they didn't provide a DNS resolver. I just meant that they weren't capable.

[pstack]

It may be surprising how many sysadmins and staff at even huge companies and massive complex highly-technical deployments don't understand very much about DNS. I have seen so many mission-critical deployments of various systems brought to a halt, because someone didn't configure DNS properly either on the actual nameservers or on the individual hosts.

[hnha]

Are you using some terminals in the train or why are you forced to their choice? Just set up your system to use different servers!

[mathrawka]

Why don't you take the issue up with the train company, since they are the ones deciding to block things.

[blibble]

ha, it was done deliberately.

the government franchise agreement forces the train operating company (TOC) to provide a free WiFi service... it doesn't say it has to be useful, so the TOC reduces their data costs by blocking most of the Internet.

to add insult to injury it's a subsidised service, so I'm paying twice for something that's unusable.

and no, there is no other TOC and no other reasonable way to commute, so I'm stuck with it.

[daveid]

Question: How can people use DNSSEC right now (if it is possible)?

[dobbsbob]

Swiss Privacy Foundation claims to have DNSSEC https://www.privacyfoundation.ch/de/service/server.html

I would rather use Dj Bernstein's DNSCurve though