[HN Gopher] DNS Provider Quad9 Sees Piracy Blocking Orders as "E...
___________________________________________________________________
DNS Provider Quad9 Sees Piracy Blocking Orders as "Existential
Threat"
Author : gslin
Score : 229 points
Date : 2025-11-10 11:21 UTC (11 hours ago)
(HTM) web link (torrentfreak.com)
(TXT) w3m dump (torrentfreak.com)
| MangoToupe wrote:
| I've increasingly taken the attitude that digital media is simply
| lost to corporate interests and there's nothing we can do about
| it aside from not spending money or time on the internet.
| ACCount37 wrote:
| No, "not spending money or time" is utterly worthless.
|
| It has zero leverage. Even if you could convince 1 person in
| 1000 to do that, you'd represent 0.1%. And that "1 in 1000" is
| hopelessly optimistic as it is.
|
| If you want to change the world, "individual action" should be
| at the very last place in your list of actions to take.
| anonym29 wrote:
| >If you want to change the world, "individual action" should
| be at the very last place in your list of actions to take.
|
| The heliocentric model began with one person out of the
| entire population of earth having the courage to publicly,
| loudly, and assertively disagree with TPTB.
| iso1631 wrote:
| Presuming you're talking Europe only, are you talking
| Copernicus? Brahe? Kepler? Galileo? You know that the
| heliocentric model had been discussed 2000 years earlier in
| Europe.
| cess11 wrote:
| Guessing this might be interpreted by some as a reference
| to Galileo so I'll take the opportunity to mention Against
| Method.
|
| https://en.wikipedia.org/wiki/Against_Method
| ACCount37 wrote:
| Let's assume that correct. Now, what did that "one person"
| do? Just reject the idea of Earth being the center of the
| universe? Or actually seek ways to make an alternate model
| more accepted?
|
| "Individual action" is fucking worthless. But not all types
| of activism are.
| MangoToupe wrote:
| My point was not about changing the world but having a
| pleasant consumer experience. My local library works just
| fine for just the cost of my tax dollars.
| Imustaskforhelp wrote:
| > "At what point does legal compliance become de facto
| censorship?"
|
| I genuinely agree with this statement a lot. Also another aspect
| of this is that the bigger companies can somehow "legally" do
| things which I don't think would work but they have so many
| resources to strech the court case for a long time.
|
| And the fact is that even after that, even if they are fined for
| some dollars. They are more than likely to just pay than try to
| actually fix the core issues which effects everyone harmfully
| except the company.
|
| All for profit smh. I sometimes wonder if there is a word for
| this phenomenon for how our system has gotten into such a rotten
| state from lobbying to this yet at the same time genuine non
| profits get existential threats for the same behaviour but they
| simply don't have the funds...
| gtsop wrote:
| > if there is a word for this phenomenon for how our system has
| gotten into such a rotten stat
|
| There is, it's the system's name: Capitalism
|
| Noone ever in the universe claimed that this system serves
| primarily the needs of humans. It serves profit. Now there is a
| ven diagram that has a union area between profits and needs,
| but the system does not care about making this union bigger, it
| cares about making the profits bigger. When that overlaps with
| needs... it is just a happy side effect.
| kannanvijayan wrote:
| I tend to agree with this sentiment, but my takeaway is
| slightly different.
|
| People who would describe themselves as supporters of
| "capitalism", as well as supporters of "communism" or
| "socialism", are not able to admit that their belief systems
| are actually religious in structure. Not spiritual perhaps,
| but effectively "secular religions".
|
| Both capitalism and its nemesis arose in the mid 1900s, when
| humanity was obsessed with modernist thinking about "solving
| problems once and for all". And in that context, the people
| fell in love with these two "clean systems". A more perfect
| set of rules.
|
| Sure, capitalism doesn't claim to be the most powerful god.
| But in surrogacy, it claims to be "the least imperfect
| system". Which is structurally the same claim: declaring the
| scripture to be some apex that is not surpassable.
|
| The main difference between communism and capitalism was how
| it was implemented. The USSR went full-tilt ideologically
| rigid, and collapsed very quickly. The US didn't go full-tilt
| capitalism. It implemented a hybrid system with a high
| marginal tax, welfare programs, subsidies, labour unions,
| public works projects, along with a market system, and that
| hybrid non-ideologically rigid model served it well.
|
| Around the time it was clear the USSR was collapsing, the USA
| went hard tilt in favour of ideological purity in capitalism.
| Systematic series of clawbacks in the tax regime,
| privatization, elimination of labour unions.
|
| As they leaned into the religion, it was used against them,
| much like the communist religion was used against the people
| of the USSR. And now they have been robbed of their
| prosperity, of the value of their efforts, much like the
| people in the USSR were robbed.
| Imustaskforhelp wrote:
| Nice read but we also have democracy to prevent things but
| it still feels effectively hi-jacked by such fictional
| constructs like capitalism and the lobbying power
|
| Theoretically we should be able to think of the majorities
| or ourselves and we can have a good system
|
| but we also feel like a lack of choice I suppose, the
| elections feel between just two parties with choosing the
| lesser evil (I think zohran is cool tho in the democratic
| party and maybe he could signify some good things I guess)
|
| Personally I feel like we need to focus more on the
| incentives and competency of people more than anything and
| try to vote it on that and not what they speak I suppose.
| iso1631 wrote:
| We don't have democracy because the people with the most
| money can use a century of learning how to manipulate
| people through mass propaganda, advertising, pr, spin to
| get the results they want. People don't form political
| opinions in a vacuum, they are formed by the messages
| they receive.
| cess11 wrote:
| 'Both capitalism and its nemesis arose in the mid 1900s,
| when humanity was obsessed with modernist thinking about
| "solving problems once and for all". And in that context,
| the people fell in love with these two "clean systems". A
| more perfect set of rules.'
|
| All of this is junk. Karl Polanyi famously puts the birth
| of capitalism very late compared to other important
| thinkers, in 1834, by defining it as characterised by
| markets of fictitious commodities, i.e. stuff like labour,
| land, money. More mainstream would be to point to the
| Renaissance or british 16th century.
|
| The idea that capitalism and communism would be dependent
| on an art movement of the early 20th century is quite
| bizarre, the Communist Manifesto was published in 1848 and
| by the late 19th century when modernism started to form
| unions and communist parties were already common.
|
| Actually, modernism is a reaction to the apparent stalling
| of 'progress', WWI and nostalgia for the optimism of the
| early modern period. I.e. from 1500 to late 1800s. In part
| it was also a reaction to what is usually called modern
| physics, i.e. things like newtonianism and ether hypotheses
| breaking down in due to Michelson-Morley and early study of
| quantum phenomena, relativity and so on.
| whimsicalism wrote:
| another absurd ahistorical comment on HN, where capitalism
| apparently arose in the mid 20th century despite the long-
| standing pre-existence of stock issuing multinationals,
| wage laborers, currency-mediated trade, reserve banking,
| etc.
| whimsicalism wrote:
| and yet the largest group of professional utilitarians in the
| world (economists) largely do claim what you are saying
| 'nobody even in the universe' would.
|
| transitive preference satisfaction is generally a pretty good
| framework. if you give more people what they want, you get
| more of what you want in turn.
| benlivengood wrote:
| Free markets are not unbridled capitalism; capitalism needs
| strong trust-busting and anti-monopoly enforcement.
| iso1631 wrote:
| I find it amusing that it's always the governments fault. Or
| the users fault.
|
| It's never the fault of the trillion dollar industries that are
| millions of times more powerful than any individual.
|
| Our system get gotten into a rotten state because a tiny number
| of modern barons have all the power, and none of the civic
| responsibility. Concentration of money - when money is power,
| is the same as concentration of power.
| mvandermeulen wrote:
| What is always the governments fault?
| walletdrainer wrote:
| > Also another aspect of this is that the bigger companies can
| somehow "legally" do things which I don't think would work but
| they have so many resources to strech the court case for a long
| time.
|
| A big part of this impression is that people very often very
| much underestimate what they can get away with, whereas big
| companies have lawyers to tell them "oh yeah you can totally do
| this".
|
| Of course there are some exceptions. Uber and AirBnB are
| probably decent ones, in some jurisdictions anyway.
| immibis wrote:
| This seems true.
|
| Look at Donald Trump - he failed, over and over again, but he
| always kept trying. Seven bankruptcies, but he never said
| "I'm bankrupt so I'm not allowed to do any business again" -
| he just kept on doing business. And look at the government
| shutdown - he kept saying the Democrats will eventually fold
| and do what he wanted, and they have now folded and done what
| he wanted. This is a man who doesn't understand the word "no"
| and look where it got him.
|
| Not just him - you have basically every successful tech
| entrepreneur too. They don't ask permission. However, some
| people don't ask permission and as a result of not asking
| permission they end up in jail, like Sam Bankman-Fried,
| instead of as billionaires out of jail, like Larry Ellison.
| So it seems you need a good intuition on which things you
| shouldn't ask permission for, and this has very little to do
| with facts and very much to do with personal connections.
| walletdrainer wrote:
| > and this has very little to do with facts and very much
| to do with personal connections.
|
| Disagree, anybody would have gone to prison for doing what
| SBF did
| immibis wrote:
| CZ got a presidential pardon alongside giving the
| president a bunch of money. So did Ross Ulbricht. SBF did
| not give him money, and is in jail. It's true none of
| them did the exact same crimes as each other, but there's
| a clear pattern here. Let's see if in the future SBF
| gives the president a bunch of money and gets a pardon.
| flumpcakes wrote:
| Going after DNS resolvers seems like the easy win. If a website
| was breaking the law so egregiously then take it to ICANN to get
| the domain name seized. I'd wager that's a much harder thing to
| prove, hence the strong arming of DNS resolvers.
| michaelt wrote:
| Seizing a domain name via ICANN has to be global, as I
| understand it, while a website might have only broken _some_
| nations laws.
|
| If the UK government wants to ban porn but loves gambling,
| while the US wants to ban gambling but loves porn, a blocking
| mechanism that lets them have different blocklists allows both
| nations to get the censorship their voters have chosen.
| whimsicalism wrote:
| Pretty sure the US does it all the time or just contacts the
| registrar.
| iamnothere wrote:
| Only for TLDs within legal reach. TLDs like .ru and .su
| require diplomatic outreach and backroom deals.
| dc396 wrote:
| ICANN has no mandate, mechanism, or ability to seize domains.
| The only tool they have is de-accreditation of registrars
| (which obviously affects ALL domains registered by that
| registrar) and that tool is only used when there is clear and
| non-cured breach of the ICANN Registrar Accreditation
| Agreement.
| BLKNSLVR wrote:
| Would the root DNS servers ever get modified or censored as a
| result of court action?
|
| My thoughts were that DNS-level censorship is essentially a dead
| end because the root servers are sacrosanct, and there will
| always be secondary DNS servers to query, who then use the root
| servers.
|
| Sucks for DNS providers in authoritarian countries though.
| Macha wrote:
| The root DNS servers basically only tell you where the registry
| servers are, they don't contain records themselves. If someone
| censored a domain at the registry level then the root servers
| would be no help
| iamnothere wrote:
| This is true but I can imagine where they might go after the
| lowest reachable branch of the tree, up to threatening to
| remove country-level TLDs from the root servers for
| noncompliance. Only the US really has the leverage to do
| this, and it would just fragment the internet, as additional
| root servers would pop up to serve the missing TLDs. So it's
| unlikely but possible.
| dc396 wrote:
| "Additional root servers" popping up that would server
| missing TLDs would fail DNSSEC validation unless you
| modified the root hints and turned off DNSSEC or resigned
| the root zone and updated the trust anchors in validating
| resolvers.
| iamnothere wrote:
| Oh it would be chaos, but I'm sure there would be a
| workaround available within a week. Alternative roots
| already exist:
| https://en.wikipedia.org/wiki/Alternative_DNS_root
| lokar wrote:
| But the query is of the whole name. In theory they could
| nxdomain blocked names.
|
| But long ttls and caches would mostly break this as an
| approach
| JdeBP wrote:
| Ever since the Verisign coup in 2003, the world has had the
| idea of "delegation-only" and suchlike filtering on
| responses from superdomain servers. More recently, query
| minimization was invented. Both of these can militate
| against the root content DNS servers doing that.
|
| Better still, one can run one's own private root content
| DNS server. I've been doing that (in several ways) for a
| couple of decades. If ICANN decided to blackhole (say)
| www.microsoft.com. tomorrow, my DNS lookups wouldn't be
| affected.
|
| To affect them, the aforementioned "court action" would
| have to target Verisign.
| dc396 wrote:
| I'm curious: how did you implement your "private root
| content" DNS server such that it keeps up with (valid --
| and how would you know?) updates made by the TLD
| registries via IANA?
| dc396 wrote:
| Yes and no. See QNAME Minimization
| (https://datatracker.ietf.org/doc/html/rfc7816.html).
| iamnothere wrote:
| I suspect the US would push back on this unless they were the
| ones doing the censoring. So far the US has not opened that
| door with DNS; it's important to make sure that the door stays
| closed, as this would create chaos and major fragmentation.
|
| In the meantime it might be worthwhile to develop alternatives,
| like some kind of DNS-over-Tor or DNS-over-DHT scheme, along
| with normalizing Tor onion services as an alternative access
| method for clearnet sites.
| idiotsecant wrote:
| Yes, some kind of alternative DNS system where domain
| assignment is authenticated using some kind of distributed
| system of ownership consensus! If only such a thing has
| existed for years already and was well tested and
| performant...
|
| https://www.kraken.com/learn/what-is-ethereum-name-
| service-e...
|
| All the things that crypto true believers believed would
| happen are slowly coming to pass. It wasn't all bored apes
| and gambling. There was some legitimate developing going on,
| and still is.
| iamnothere wrote:
| After the Samourai case, you shouldn't be so confident in
| cryptocurrency-based solutions for things like this. If
| devs can somehow stay anonymous and out of reach, maybe.
|
| I'm not ideologically against cryptocurrency-based
| solutions, but it isn't a magic bullet by any means. I
| still think that the EU in particular isn't done making
| life difficult for crypto users.
|
| Not to discourage projects like ENS, I think it's good to
| have alternatives, but I do think we need noncommercial
| fallbacks to the current system as well. Anything involving
| money will always have choke points.
| dc396 wrote:
| How does the access method matter?
| belorn wrote:
| As a sibling comment mentioned, the root servers are unlikely
| to get such order since they deal with registries and not what
| I would call end user domain names.
|
| Registries do get block orders. When the Swedish registry got
| that for piratebay they choose to treat it like a domain
| dispute and gave ownership of the domain to the police, which
| the police in turn could treat like any other taken property
| and auction it out. The trouble is when the police wanted to
| destroy it, as there isn't a good definition on how to destroy
| a name so it can never be used again, and the registry was not
| keen on allowing the concept of a block.
| dc396 wrote:
| The root servers do not deal with registries. They deal with
| the Root Zone Manager (Verisign, under contract to ICANN)
| only.
|
| The way you "destroy" a name is either to not delegate it or
| give it to the Registrar of Last Resort
| (https://www.rolr.eu).
| belorn wrote:
| You can choose not to delegate it, but then how long and
| who should maintain the list of names that should not be
| delegated? Who should pay for the work to implement it, and
| who should pay for the maintenance for said system, and for
| how long? Should there be an appeal process or some kind of
| oversight, and who should body those roles?
|
| In theory the law makers could specify this in law as form
| of registry regulation, but no one want to do that just to
| address one or two court cases where this question comes
| up. The registrar of last resort doesn't give any direct
| answer to those questions either.
| dc396 wrote:
| These cases come up far more frequently than "one or two
| court cases" -- many takedowns of botnet/malware (e.g.,
| Avalanche) end up in ROLR. See "domain generation
| algorithms".
|
| In general, the vast majority of registries are fine with
| marking particular domains as "allocated but not
| delegated" as long as they get paid. ISTR ICANN waiving
| their fees, so the costs of marking a domain as
| undelegatable essentially turn in lost opportunity cost,
| which most registries are willing to eat.
| dc396 wrote:
| No. While root servers are NOT sacrosanct, if such a court
| action were to occur and a root server operator were to carry
| it out, the change would fail DNSSEC validation in resolvers
| that have DNSSEC enabled (which varies depending on where you
| are, see https://stats.labs.apnic.net/dnssec), resulting in a
| SERVFAIL. In such cases, resolvers generally try another root
| server, until it gets a non-SERVFAIL answer, so for this to
| have the desired effect, you'd have to get all the root servers
| to implement the same change. This would be unlikely.
|
| However, the root server operators merely publish what ICANN
| (via the IANA functions) produces.
|
| If the US (either federal or perhaps even the states of
| California or Virginia) were to decide to "censor" a TLD in the
| root zone, they would simply go to ICANN, PTI (the folks who
| provide the IANA functions under contract to ICANN) or, more
| likely, Verisign (who generate and publish the root zone under
| contract to ICANN) and demand the root zone be modified.
| fundatus wrote:
| Many ISPs in Germany have stopped fighting this fight as well and
| sadly have now even started to self-censor their DNS servers.[1]
|
| [1] https://cuii.info/en
| dewey wrote:
| > have now even started
|
| This has been the case for a very long time. Back when TBP was
| popular this was already the case.
| iamnothere wrote:
| More people should run their own recursive resolvers with
| unbound. There's no need to rely on centralized DNS anymore.
| kavouras wrote:
| Isn't this putting unsustainable load on the root servers?(on
| the scenario that many people do that)
| seethishat wrote:
| https://datatracker.ietf.org/doc/html/rfc8806
|
| Abstract
|
| Some DNS recursive resolvers have longer-than-desired
| round-trip times to the closest DNS root server; those
| resolvers may have difficulty getting responses from the
| root servers, such as during a network attack. Some DNS
| recursive resolver operators want to prevent snooping by
| third parties of requests sent to DNS root servers. In both
| cases, resolvers can greatly decrease the round-trip time
| and prevent observation of requests by serving a copy of
| the full root zone on the same server, such as on a
| loopback address or in the resolver software. This document
| shows how to start and maintain such a copy of the root
| zone that does not cause problems for other users of the
| DNS, at the cost of adding some operational fragility for
| the operator.
|
| This document obsoletes RFC 7706.
| belorn wrote:
| If we are talking about the actually root servers, there
| are 13 redundant names spread out (thanks to anycast) on
| around 1700 servers located around the world, and the
| lookup a user would do is cached for 2 days. That mean the
| highest amount of traffic a system will generate is one
| request per unique TLD (like .com) per 2 days, and it will
| fit a single UDP package.
|
| We can then do some guesses about size for questions like
| "what is the nameservers for .com". Those are a bit larger
| than most dns queries since the answer is a bit bigger than
| most, since .com has a lot of nameservers, so lets put it
| down to 800 bytes. Every 2 day a average use might then,
| using some guessing, generate maybe 10 kb of traffic, or
| about 0.015 seconds of watching a 1080p video on youtube.
| Bender wrote:
| Everyone used to query the root servers directly from their
| ISP or corporate edge servers until the big platforms
| wanted to gather more of everyone's data in the name of _"
| keeping people safe"_ from _" bad ISP's"_. As with any
| manipulation campaign there are a few incidents corporate
| propagandists can site to say, _" See! We are protecting
| you!!"_ forcing people to debate the issue and knowing the
| majority will accept the default settings. Blocking all the
| DoH/DoT resolvers would be trivial for any ISP to do just
| as I have been doing at home since the inception of DoH.
|
| The root Anycast clusters are absolutely designed to handle
| the entire internet querying them which I do from Unbound.
| If one wishes to help reduce load they can enable large
| memory caches and rewrite min-ttl to something sane to
| protect the root servers from Amazon EC2's default 5 second
| ttl and others like them. Blocking known spam and tracking
| domains also helps reduce the total number of queries.
| Groups of friends can even further reduce the load by
| setting up their own DoH/DoT servers using Unbound DNS and
| sharing the cache and using cron to keep their favorite
| domains hot in the cache and increasing private by making
| the crond queries from a VPS node.
|
| Here's my cache stats for a 3 day uptime:
| total.num.cachehits=18149 total.num.cachemiss=2300
| total.num.prefetch=4561
|
| Memory usage _permitting up to 1.5 GB_ :
| Private + Shared = RAM used Program 343.1 MiB
| + 523.5 KiB = 343.6 MiB unbound
| ectospheno wrote:
| RFC 7706. Even has config file examples.
| giantg2 wrote:
| Seems like a great use case for Pi-hole to add include lists
| - have files with lists of DNS entries that are delisted in
| some areas. Of course a VPN is probably more beneficial in
| general though.
| celsoazevedo wrote:
| Regarding censorship, that works only if there's no network
| side blocking, otherwise the unencrypted requests to root
| servers also get intercepted. That's why some people use DoH
| as the upstream for their resolver.
|
| Not all countries or ISPs do this, but some do.
| iamnothere wrote:
| True, DNSSEC should tell you if requests are being
| rewritten or blocked, but it will not help you circumvent
| this.
| kidmin wrote:
| In Japan the PM's office once considered to block online piracy
| websites[1] with DNS in 2018. Japanese tech community fought
| against it[2][3][4] and it wasn't implemented.
|
| The telco authority currently considers to block online casino
| websites[5] (gambling is illegal in Japan).
|
| [1]
| https://www.kantei.go.jp/jp/singi/titeki2/tyousakai/kensho_h...
| [2] https://www.nic.ad.jp/ja/topics/2018/20180625-01.html [3]
| https://www.wide.ad.jp/News/2018/20180912.html [4]
| https://www.nic.ad.jp/ja/materials/iw/2018/proceedings/d3/d3...
| [5]
| https://www.soumu.go.jp/main_sosiki/kenkyu/online_casino/ind...
| dengolius wrote:
| Does anyone use Mullvad DNS servers?
| https://mullvad.net/en/help/dns-over-https-and-dns-over-tls#... I
| found them more acceptable.
| b3lvedere wrote:
| Didn't know they have publicly available DNS servers. Thanks.
|
| I've also started using/testing the DNS4EU servers:
| https://www.joindns4.eu/
| Tadpole9181 wrote:
| I have had nothing but problems with their DNS service. Outages
| what feels like a daily basis.
|
| But the VPN itself is great!
| kristofferR wrote:
| They're pretty slow for me, 350ms on average:
|
| https://i.imgur.com/7CeydnY.png
| LeoPanthera wrote:
| I do (as a fallback), but they're extremely slow.
|
| Did you know Wikimedia also runs a public DNS service?
|
| https://meta.wikimedia.org/wiki/Wikimedia_DNS
| 0xbadcafebee wrote:
| Re: "Cisco has decided to leave france":
| (https://web.archive.org/web/20250614052849/https://support.o...)
| Effective June 28, 2024: Due to a court order in France issued
| under Article L.333-10 of the French Sport code and a court order
| in Portugal issued under Article 210-G(3) of the Portuguese
| Copyright Code, the OpenDNS service is not currently available to
| users in France and certain French territories and in Portugal.
| We apologize for the inconvenience. July 23, 2024:
| Cisco's OpenDNS service has been reactivated in Portugal and is
| currently available following a decision by the Lisbon Court of
| Appeal.
|
| It's laudable that Quad9 want to fight censorship, but they too
| could block French requests in this way. Maybe redirect to an
| HTTP/HTTPS IP that tells users about the issue and gives them
| contacts to their government representatives?
| sudopsuedo wrote:
| > _Other companies, such as Google and Cloudflare, have the
| technical means to restrict the blockades to France, but not
| all providers can do so easily. That includes Quad9, which had
| no other choice than to apply the French blocking request
| worldwide._
|
| Just quoting the article, can anyone weigh in on the
| costs/complexity of a public DNS resolver implementing geo-
| fencing?
| 0xbadcafebee wrote:
| There are multiple free and paid geoip databases, from $0 to
| $1000 a year, depending. Then an hour to write a script to
| add iptables rules from the database for the country of
| choice. (Example: https://gist.github.com/asheroto/934e056a30
| 2adda334077f0c85c...)
|
| I don't know what is unique about Quad9 that they couldn't do
| this, but it's possible they have some technical limitation
| strictnein wrote:
| There's likely a performance impact that is significant at
| that scale. If they're blocking 670M DNS requests a day,
| they're likely doing 10-100x that overall.
|
| Have you implemented something at that scale to say this is
| no big deal for them to do? And what about when 180
| countries want their own list and maybe even states,
| providences, etc do as well?
| walletdrainer wrote:
| You seriously underestimate how fast modern CPUs are,
| especially considering how many distributed servers
| OpenDNS runs on. There's no meaningful performance impact
| to be found here.
|
| Also keep in mind we're talking about Cisco here and not
| some Ruby on Rails shop.
|
| Anyway, I'm a big fan of the "fuck country $x" approach
| mike_d wrote:
| > can anyone weigh in on the costs/complexity of a public DNS
| resolver implementing geo-fencing
|
| I was a small part of the original team that built OpenDNS. I
| also operate a less well known public resolver now.
|
| DNS is extremely latency sensitive. You have basically a 20ms
| budget to work with, which includes the time the request and
| response traverse the internet. It is also extremely high
| volume, a large public service like Quad9 could easily see
| single digit millions of requests per second.
|
| There is nothing that technically prevents you from doing
| geofencing. Cisco has the money to absorb the costs of the
| additional overhead - but I could not. My first stab at the
| problem would be to simply shut down my servers in France to
| try to get out of the legal jurisdiction. I don't know if
| that would be sufficient without paying for a lawyer.
|
| Quad9 absolutely has a valid argument here and it pushes more
| of our public infrastructure into the centralized hands of a
| small number of players because people like me can't afford
| to just run free shit on the internet anymore.
| Dylan16807 wrote:
| Blocking a growing list of entire countries also sounds like an
| existential threat.
| sschueller wrote:
| This is also why it is important for Switzerland to not sign the
| deal with the EU next year. The 8k+ page deal would also require
| Switzerland to pull the line with EU regulation regarding
| copyright. The freedom we have right now to download would fall
| away. Doesn't matter if you are left or right, the deal is bad
| for all of us.
| Havoc wrote:
| Another side effect of law makers yoloing legislation on things
| they don't seem to understand
| styanax wrote:
| Hoping the HN DNS savvy reading this can help me understand a
| Quad9 thing I ran into. I was debugging (as in scratching my
| head) a bank website login problem and ended up doing some DNS
| checks against their domain, usual stuff, while using Quad9 as my
| DNS provider.
|
| While testing, I was using Google and Cloudflare as well, and
| started noticing something - Quad9 does not return all A records
| listed for a domain, the same way Google/Cloudflare do.
| dig -t A google.com @8.8.8.8 +short (6x IPs) dig -t A
| google.com @1.1.1.1 +short (6x IPs) dig -t A google.com
| @9.9.9.9 +short (1x IP)
|
| This gave me a weird feeling; I get there's a lot of DNS geo
| magic and 8.8/1.1 serve 2 different subnets, and 9.9 a third.
| But... where did the other 5 expected IPs from Quad9 get off to?
| tom1337 wrote:
| interestingly, i only get one IP from each command:
|
| $ dig -t A google.com @8.8.8.8 +short
|
| 142.250.184.206
|
| $ dig -t A google.com @1.1.1.1 +short
|
| 216.58.206.46
|
| $ dig -t A google.com @9.9.9.9 +short
|
| 142.250.185.238
| styanax wrote:
| I'm sure geo has something to do with it - my connections
| generally terminate in Austin, TX but it varies around
| Central US. I have T-Mobile Home Internet and our IPs show up
| to remotes under the same general ASNs as the traditional
| mobile network (big huge CGNAT, my IP can change 5 times a
| day or whatnot and it doesn't reflect where I actually am
| located).
|
| Edit: in case useful to someone reading, right now I have an
| IP assigned out of this block: NetRange:
| 172.32.0.0 - 172.63.255.255 CIDR:
| 172.32.0.0/11 NetName: TMO9 NetHandle:
| NET-172-32-0-0-1
|
| Edit edit: in the network record is a link to the self-
| reported geo data, I missed that. Comment:
| Geofeed https://raw.githubusercontent.com/tmobile/tmus-
| geofeed/main/tmus-geo-ip.txt
| toast0 wrote:
| If you're behind a big CGNAT and Google knows it, they
| might intentionally return multiple addresses to have more
| capacity.
|
| Each service port (IP:Port) can only receive 64k
| connections from each NAT IP, returning more IPs from DNS
| makes more connections available. Google is a very popular
| service, so it makes sense to do. (Less so for v6, though)
|
| Alternately, if they can't get a good feel for where you
| are, returning A records for multiple locations makes
| sense, too.
|
| No idea why 4 AAAA vs 6 A; Google runs dual stacked and I'd
| expect the same number of records for both; IIRC, 8 AAAA
| will usually fit in a 512 byte udp reply, and anyway DNS64
| might expand As into AAAAs, so you have to gauge sizes with
| those anyway.
| b3lvedere wrote:
| Isn't that because Quad9 does (more) filtering than the other
| two?
| styanax wrote:
| I actually do (did, I demoted it for now) use the unfiltered
| service (9.9.9.10) but find the same result on both, so I
| used .9 here to keep the chat more streamlined. But, could
| still be relevant somehow?
| laz wrote:
| I see a single IP for all 3
|
| While I'm here: Google uses edns0 client subnet to geo target
| your client IP.
|
| Try a dig -t txt o-o.myaddr.l.google.com @8.8.8.8 vs the others
| to see the src IP of the packet sent to Google's DNS server,
| and any edns0 info that came along with it.
| styanax wrote:
| Interestingly, I get 3 different source IPs, BUT! The one
| from Quad9 is IPv6 and the ones from 8.8/1.1 are IPv4. Google
| returns an extra TXT record as well with "edns0-client-subnet
| 172.56.95.0/24". I'm not a DNS pro, so not sure what to make
| of it.
|
| As 9.9 returned an IPv6, I tested with AAAA records just now
| - 1.1/8.8 respond with 4x IPs, 9.9 only 1x so it mirrors the
| A records in spirit.
| df0b9f169d54 wrote:
| I used quad9 as the primary upstream DNS for my home. about 11
| days ago I wasn't able to send any query to quad9, kinda
| blocking. Their status page was green I suspected my ip was
| blocked. Now I'm on quad1 :(
| miyuru wrote:
| Have you tested it with a static domain with multiple IPs?
|
| Using google is bad way to test this scenario, since they use
| EDNS and many other DNS load balancing methods to distribute
| the load.
| Sanzig wrote:
| I really wanted to like Quad9, and used it for a while, but
| there have been constant issues in the northeast with random
| SERVFAILs for months now. I had to switch back to Cloudflare.
| seethishat wrote:
| This all started, in earnest, with Response Policy Zones being
| added to BIND. RPZ allow DNS resolvers to lie to clients by
| returning (nxdomain or redirects to other domains) and the client
| does not know it is being lied to.
| https://www.isc.org/docs/BIND_RPZ.pdf
|
| At first, RPZ was used to block known malicious domains (drive by
| malware downloads, etc.). Then, the security weenies started
| using RPZ to block other things like TikTok (for
| administrative/legal reasons). That's when the DNS became a big
| lie.
|
| I guess some day, one political party will use it to block the
| websites of other political parties, etc. That's stupid to say (I
| know) but that seems to be the slippery slope we are sliding
| down.
| mzajc wrote:
| Does Quad9 run a resolver with DNSSEC but _without_ "malware"
| blocking? So far I've had multiple instances (twice for a torrent
| tracker, once for gist.github.com) where they blocked a non-
| malware domain for a short while, which is really annoying to
| deal with.
| input_sh wrote:
| Unfortunately no, they run 9.9.9.10, which is without "malware"
| blocking _and_ without DNSSEC.
| estimator7292 wrote:
| Kind of wild that we're approaching a decentralized internet not
| for the virtue of decentralization, but because of insane
| authoritarian censorship.
| qqvga wrote:
| ironically/appropriately[?] a virtue of decentralization would
| be combatting insane authoritarian censorship
| jMyles wrote:
| > insane authoritarian censorship
|
| Sanity, liberty, and censorship-resistance are virtues.
|
| (before mental wellness people get up in my grill, by "sanity",
| I mean the preconditions likely to make sanity widespread)
| xboxnolifes wrote:
| I consider conser resistance _the_ defining virtue of
| decentralization.
| BikiniPrince wrote:
| I just run my own name server. DNS blocking is no longer an issue
| unless they get to the root name servers. With a little domain
| warming from the top 5000 domains it's pretty snappy most of the
| time.
| lokar wrote:
| Or block outbound 53 on residential networks
| JdeBP wrote:
| More realistically, DNS blocking is no longer an issue unless
| "they" get to the registries for the top-level/second-level
| domains. It's easy to make yourself immune to things injected
| by the root content DNS servers, with at least two mechanisms
| for combatting this (the better one being just running your own
| private root content DNS server) having existed for most of
| this century.
| mlhpdx wrote:
| Are we heading to a place where there will be many DNS resolvers
| just to get a "full" picture of the internet? Or perhaps topical
| upstream resolvers?
| immibis wrote:
| Easier to run your own uncensored resolver, no?
| dc396 wrote:
| See RFC 8806
| charcircuit wrote:
| if (geoip[sourceIp] === "France") { if
| (geoblocks["France"][sourceIp]) { return NOT_FOUND;
| } }
|
| I don't think the cost of writing the above code is an
| existential threat.
___________________________________________________________________
(page generated 2025-11-10 23:01 UTC)