Best DNS for privacy?
Best DNS for privacy?
I read a bit about using a different DNS for Privacy and I think the best one should be quad9? Or is there anything better except self hosting a DNS?
Use your own. I use unbound.
Yes, but what does it use?
Authoritative name servers.
Good enough write-up about it here: https://docs.pi-hole.net/guides/dns/unbound/
Use your own. That may not always be the best way to go, as it'll make fingerprinting also much easier. The more custom your setup is, the less there are like you, the easier your tracked by fingerprinting techniques.
Not saying it's bad per se, but the idea that trusting no one and setting everything up yourself is always more private isn't true either. Both providers and do-it-yourself have negative sides one should stay critical about.
Seconded. Docker with blocky + x2 unbound user here. The speed/snappyness difference is absurd.
Using NextDNS for quite long time
I use Quad9 for my upstream.
This!
I'm using dnscrypt combined with a firewall app. RethinkDNS on android and postmaster on pc.
There's OpenNIC, which is run by a community.
Check out this guide on How to configure NextDNS
Want something that works fast? NextDNS, Adguard or DNSwatch
Want something a bit more complicated but better for privacy? Setup PiHole + DNSCrypt proxy with anonymized DNS
I use NextDNS, but also use Cloudflare sometimes.
I use cloudflare dns
I use DNS from Applied Privacy i don't know if it good or not and Intra app for android.
I'm not an expert on what makes a "good DNS", but I have been using a pi-hole for about 5 years and it has been super stable the whole time, despite my best efforts.
Quad9 is decent, but there's some weird legislative issues (they can be court ordered to not resolve certain sites) BC weird reasons.
If you have a raspberry pi or similar sitting somewhere, you can set up a pihole DNS with unbound as upstream. Then you've got a DNS that's as private as you want, locally cached and with additional ad/malware/... blocking capabilities.
/etc/hosts
The one from your ISP. Your ISP can see your traffic anyway, so you gain nothing by using a third-party DNS server.
As far as I read (I'm no expert!) they could check the SNI of the TLS handshake if they want. But using the DNS of the ISP is handing them the data right in a way they can analyze/use them very easily afaik?
Still learning about this topic!
The header of a Http request always contains the domain unencrypted because it's possible to host many different websites on the same IP. So this information is needed before the encrypted tunnel is built up.
Even if you use DOH for upstream servers?
In the end it comes down to what your goals is. DOH indeed hides DNS queries from sniffers and your ISP, but the traffic between you and your destination is still visible for the ISP (unless you use a VPN or TOR).
If you only care about the content blocking aspect a third party resolver may make sense as @[email protected] explained below.
My 50 cents: Nowadays most traffic is encrypted and your ISP can only see what server you are talking to, but not which domain. The domain although can be figured out with a reverse DNS lookup. So unless more then one domain is hosted on a given up, your ISP could also know the domain.
HA! My ISP injects ads into search results with their DNS. No thanks!
glowing hard
