from unitedwithme@lemmy.today to privacy@lemmy.ml on 20 Sep 15:42
https://lemmy.today/post/60365924
I responded to someone in comments on a post that may not get as much visibility, and wanted to share something that might help some others who are new or unfamiliar.
I referenced Quad9 DNS as probably one of the best private DNS you can use, Swiss based, no log, no tracking, no data to sell, etc. They also implement DNSSEC, DoH, DoT, QUIC, ECS (which you may or may bot want), malware blocking, content filtering, and maybe something else I’m forgetting.
Many DNS sinkhole apps, OSes, or systems can actually utilize Quad9 for your resolver while those systems also block ads. Below is my functional list of systems that I’m aware of, though I haven’t tested everything. I believe all are considered FOSS, too. If you don’t have a spare Raspberry Pi laying around, try running in HomeAssistant, Yunohost, ZimaOS (previously CasaOS), or others.
DNS sinkhole (Adblocking) apps:
Feel free to comment and add your own I’m maybe not aware of. I’m no software engineer, but I can read through some code, though not an expert, nor have combed through these personally. Usually I’ve tested/run at the recommendation of others over the years before my ban on Reddit (for shitting on AI).
Hope this helps!!
threaded - newest
do you use something of DNSSEC, DoH, DoT, QUIC, ECS and if, why?
I do use DNSSEC for my website and my XMPP server. I do not use ECS as Quad9 references possible IP addresses leaking quad9.net/support/faq/#edns.
For my home network, my piholes point to:
IPv4
IPv6
I do also use dns.quad9.net/dns-query for my phone when on data or non-Home WiFi. I typically use a VPN, but for logging into my bank website I need to disable the VPN. I have LineageOS with no 3rd party Google Play apps, they’re all FOSS through F-Droid.
+1 for both Quad9 and AdGuard.
I run AdGuard Home and all of the devices in my home use it for DNS.
In the last 24 hours, 41% of the DNS queries on my network were blocked as a tracker or ad.
<img alt="ZVgAvCw6JIpvCZ2.png" src="https://media.piefed.social/posts/ZV/gA/ZVgAvCw6JIpvCZ2.png">
I just do it all in my openwrt router now. Set up any DoH (https-dns-proxy) or DoT (stubby) with DNSSEC, plus blocklists with adblock-fast.
Hagezi has some servers with default blocking github.com/hagezi/dns-servers
github.com/hagezi/dns-blocklists#dnsservices
I was liking NextDNS, they have good features, and I liked not having to maintain blocklist files with shady domains in plain text saved in my hardware, but their jurisdiction and their code being closed source made me reevaluate.
I’ve been using technitium in a primary/secondary pair for about three years, and oldheads like me definitely like the real DNS server options, like zone transfers. Very stable, too.
Opnsense has packages can directly DNS resolve, with blocklist subscriptions.