← Back to context

Comment by Kwpolska

6 months ago

1.1.1.2 is their malware-blocking DNS, and 1.1.1.3 is their parental-controls DNS. If you want an unfiltered DNS, use 1.1.1.1 - which resolves archive.today just fine, although archive.today itself refuses to work on Cloudlfare DNS.

56 comments

Kwpolska

Reply
sgbeal  6 months ago

> 1.1.1.2 is their malware-blocking DNS, and 1.1.1.3 is their parental-controls DNS. ...

TIL, thank you. Time to go tweak my pi-hole server...

  • arvid-lind  6 months ago

    I'm just curious, given all the other options that respect your privacy and don't put data collection at the center of their business model, why do you use Cloudflare on your pi-hole?

    • sgbeal  6 months ago

      > why do you use Cloudflare on your pi-hole?

      Because "if it ain't broke, don't fix it." i'm not one of those users who want to endlessly tweak their ad blocker. i want to set it up, clicking as few checkboxes as necessary to get it going, and then leave it. However, (now) knowing that Cloudflare filters different only each of their servers, i'm incentivized to go tweak a number in the config (as opposed to researching the pros and cons of every possible provider, a detail i truly have no interest in pursuing).

      2 replies →

    • TZubiri  6 months ago

      what is the vector here? dns traffic is practically anonymous, there would have to be some very specific and purposeful trickery going on to link dns traffic to an identity. It sounds like something more hypothetical than a tangible threat model

      11 replies →

surgical_fire  6 months ago

I have no idea why anyone would use Cloudflare DNS, much less trust their more filtered versions.

  • saaaaaam  6 months ago

    I use cloudflare DNS because it’s faster. But should I worry, having read your comment? What is the downside to using it? What would you recommend instead?

    • surgical_fire  6 months ago

      Quad9.

      Many years ago I used Cloudflare, and more than once I had issues with them blocking websites I wanted to access.

      I absolutely despise that. I want my DNS to resolve domain names, nothing else.

      For blocking things I have Pi-Hole, which is under my control for that reason. I can blacklist or whitelist addresses to my needs, not to the whims of a corporation that wants to play gatekeeper to what I can browse.

      18 replies →

  • 8cvor6j844qw_d6  6 months ago

    Same thoughts. Cloudflare DNS is noticeably slow to resolve on some of my devices.

    Switching to literally any other DNS and the same domains resolve instantly.

    Could be a issue specific to my location or devices, but its been consistent enough that I stopped bothering.

    • Bender  6 months ago

      I don't use the public resolvers but here [1] is a script that will show which of those public resolvers is fastest from your location. Add or remove resolvers as you desire. Be sure to scroll down to see a few of the sorting examples. Not my script or repo.

      Just as a side note: Something I have done with this in the past as a fun experiment was to set up an Unbound DoT server on assorted VPS nodes in assorted locations around the country, run this script and configure each Unbound to use the 5 to 10 fastest servers on each node and cache results longer. Then I used Tinc (open source VPN) to connect to these VPS nodes from my home's Unbound and distribute the requests among all of them. I save query logs from all of them and use cron to look up all my queries hourly to keep the cache fresh and mess up any analytic patterns for my queries. Just a fun experiment. 99.99% of the time I just query the root DNS servers for what NS servers are authoritative for a given domain or what I call bare-backing the internet.

      [1] - https://github.com/cleanbrowsing/dnsperftest