New DNS privacy server

[bendejo]

Saw this article this morning

https://blog.cloudflare.com/announcing-1111/

 

Set it up and am using it now.  Reaction times are pretty fast, but can't really say if better than before, and have no way of knowing if things are any more private.

Taking a wait-and-see attitude.

 

 

[Crossy]

Well it certainly works and CloudFlare is a respected organisation.

 

I have no way of checking if it's significantly faster than the alternatives but a ping to 1.1.1.1 returns in 2ms as opposed to 28ms for 8.8.8.8 and 57ms for 208.67.222.222 (the latter two are also DNS services from Google and OpenDNS).

 

Security? Who really knows.

 

 

[Oxx]

The performance results I'm getting are a little odd.  Sometimes 1.0.0.1 is the fastest:

 

Fastest individual response (in milliseconds):
----------------------------------------------
1.0.0.1          ####### 4.30489
Wide-2 TH        ######## 4.88305
wide TH          ########### 6.69789
Google Public DN ########################################### 26.21412
OpenDNS-2        ##################################################### 32.45616
UltraDNS         ##################################################### 32.57799
DynGuide         ##################################################### 33.05793
 

However, the mean response time is relatively slow:

 

Mean response (in milliseconds):
--------------------------------
Google Public DN ########### 118.07
UltraDNS         ############# 131.40
OpenDNS-2        ############## 149.52
Wide-2 TH        ############### 154.90
DynGuide         ################### 198.55
1.0.0.1          ###################### 232.59
wide TH          ##################################################### 579.61
 

Google Public DNS refers to 8.8.8.8, which is faster than 8.8.4.4

 

1.0.0.1 appears above because it's faster than 1.1.1.1

[clokwise]

It should be pointed out that a faster DNS only speeds up the initial handshake times - once the server IP address is identified and connected there is no further speed difference. For me the speed improvement is somewhere between negligible and imperceptible.

 

I prefer these DNS servers which remove ads: https://alternate-dns.com/

[DTiger]

You should try this ... and again in a few days.

[Pib]

Yea, best to run DNSBench or some other DNS bench marking program to see how fast the different DNS servers actually do their resolving job versus doing some simple ping test to the DNS server like "ping 1.1.1.1"  or ping 8.8.8.8

  

I did a simple ping test to Cloudfare 1.1.1.1 and to Google 8.8.8.8 and Cloudfare gave me an average 12ms response time and Google an average 39ms.   That's 12ms ping indicates the Cloudfare has a server right here in Thailand....the Google 39ms is because their server is in Singapore.

 

But that's kinda like just seeing how fast your car starts and says nothing about fast the car can speed down the road or how reliably the car runs.  You need a DNS bench marking program more thoroughly test a DNS server...that not the only way, but it's an easy way for the common man.   

 

And keep in mind DNS benchmarking programs tell you nothing about the privacy policies of any DNS service.

 

I just ran DNS Benchmark against the two OpenDNS servers (the 208 addresses below), the two Google DNS servers (the 8 series addresses below) and the Cloudfare 1.1.1.1.    Ran the test twice...see snapshots below. 

 

The only reason you see "bold black lines and solid green dots on the two OpenDNS and Google DNS servers" is only because that's the two servers I use for my computer's DNS settings.   

 

Cloudfare came in as the fourth fastest each time of the five servers tested.   But keep in mind here we are talking minor millisecond differences in speed....such small speed difference a person could probably not notice in using their computers....blink of they eye type speed differences.    All five were 100% reliable in their look-ups.  The red, green, blue bars represent different speed responses using a different kind of benckmark test called Cached Name, Unchached Name, and DotCom Lookup.  For example see partial snapshot of the 208.67.222.222 result directly below.  I'm on AIS Fibre in Bangkok.

 

What the Red, Green, and Blue Bars mean in the test runs shown further below.

 

 

1st Test Run

 

2nd Test Run

[KhunBENQ]

Has anyone currently setup this Cloudfare DNS?

I had and just noticed that I can not "find" this:

http://netalyzr.icsi.berkeley.edu/

At Berkeley University.

I have about 40 links to test protocols there.

 

Changed to Google DNS and it is back.

 

Edited April 5, 2018 by KhunBENQ

[bendejo]

5 hours ago, KhunBENQ said:

Has anyone currently setup this Cloudfare DNS?

I had and just noticed that I can not "find" this:

http://netalyzr.icsi.berkeley.edu/

At Berkeley University.

I have about 40 links to test protocols there.

 

Changed to Google DNS and it is back.

 

 

Got it.

104.18.44.104

 

 

Edited April 5, 2018 by bendejo

[Crossy]

8 hours ago, KhunBENQ said:

Has anyone currently setup this Cloudfare DNS?

I had and just noticed that I can not "find" this:

http://netalyzr.icsi.berkeley.edu/

At Berkeley University.

I have about 40 links to test protocols there.

 

Changed to Google DNS and it is back.

 

Doesn't work for me either using the Cloudflare DNS.

 

[Pib]

12 hours ago, KhunBENQ said:

Has anyone currently setup this Cloudfare DNS?

I had and just noticed that I can not "find" this:

http://netalyzr.icsi.berkeley.edu/

At Berkeley University.

I have about 40 links to test protocols there.

 

Changed to Google DNS and it is back.

 

Although I'm not using  Cloudfare 1.1.1.1, I did do a short term test just now to see if I could reach the Berkeley site.  To ensure I didn't reach it due to a "cached" dns record on my computer and my IPv6 connection did actually reach out to it, I turned off IPv6, did a ipconfig /flushdns, and set my IPv4 DNS server to only Cloudfare 1.1.1.1 (normally I use Google as a primary DNS and OpenDSN as Secondary).  Also rebooted my browser.   End result:  I could reach above site.   

 

I'm on AIS Fibre in Bangkok.   I wonder if not being able to reach the Berkeley site has something to do with a person's ISP provider?  Pretty sure Crossy is on TOT...know know about some others in this thread doing the test if using Cloudfare.

 

I have set my DSN servers back to Google and OpenDNS as some googling shows a good many people not being able to reach certain sites using Cloudfare 1.1.1.1.   Of course when you google above anything you can always find people have problems with anything.   Maybe it has something to do with the DNS service being so new....bugs still to work out....or it could just be unique to a person's connection or ISP...or computer/router setupp...or ????   Who knows. 

 

I'll probably let Cloudfare 1.1.1.1 get a few months of worldwide use, stress, tweaking, debugging, etc. under their belt before I consider switching to them. See more user crossfeed on how Couldfare is working for them, any privacy issues, uptime issues,  malware  issues, etc.   So, so many DNS services to choose from now days....new ones popping up almost daily.   Almost like the dizzying array of various payments/money transfer services and digital currencies popping up.

 

Regarding speed of DNS servers....no, I don't mean just doing a ping test to the the DNS servers IP address address, I mean how fast they do their website resolving job...actually finding and reaching out to the website you want to connect to.  In the earlier DNS Benchmark tests I ran (posted earlier) comparing 5 DNS servers for Couldfare, Google, and OpenDNS, Couldfare came in fourth in terms of speed.  Those tests were run in primetime at night....around 9pm.  But running that the benchmark test again this morning at 9:45am, Cloudfare is the fastest....ran the test two times...see results below....in both test all DNS servers had 100%  reliability. 

 

 

[Pib]

And for those wanting to run the GRC DNS Benchmark program you can download it from the GRC website.   It's just one .exe file that downloads, you click on that .exe file and the program runs.   No install involved like were a program first unzips/decompresses itself and then installs.  Simple, easy, safe.  Been using it for years. 

 

I just downloaded the latest release which is a 4 Apr 18 update.  The latest update adds Cloudfare DNS to the list of preloaded DNS servers to test.   In my earlier tests I just cleared all the preloaded DNS servers and manually added the five I wanted to test...makes the test complete a lot faster compared to testing "all" the preloaded DNS servers.

 

https://www.grc.com/dns/benchmark.htm

 

[Pib]

OK, just running the benchmark test on the primary IPv4 DSN server for Cloudfare, Google, and OpenDNS below are the graphical and tabular results. 

 

Test run at 10:18am...I'm on AIS Fibre in Bangkok.   Tabular data results show the actual time the graphic bars represent which is generally around 0.2 seconds (200 milliseconds) or much less depending on what type of resolver  test is occurring.  We are talking blink of an eye (or faster) times in the test results.  Just keep that in mind when talking how one DNS server is faster than the other.  

 

 

Graphical Data

 

Tabular Data for Above Graph

[bendejo]

Just tried ICSI again, connects quickly.

I am currently in the US just now, though that may not matter.

 

 

 

[Pib]

Curiosity question: For you folks in Thailand, what "ping" average speed do you get for Cloudfare, Google, and OpenDNS servers...specifically Clouldare 1.1.1.1, Google 8.8.8.8, and OpenDNS 208.67.222.222.

 

See a snapshot of my results below....pings ran around 2:25pm....I underlined in blue the server being pinged and it's average ping time. 

 

Apparently Cloudfare has a local server in Thailand, probably Bangkok based on a 9ms ping time I'm getting compared to 30 some milliseconds for Google and OpenDNS  which means their nearest server is in Singapore.  I'm on AIS Fibre in Bangkok.

 

[Pib]

Yeap, Cloudfare has a data center here in Bangkok.   That explains the really low ping time of around 10ms.  Google's and OpenDNS's nearest data center is in Singapore.   See data center locations for the three companies below.

 

Cloudfare

https://www.cloudflare.com/network/

 

Google

https://www.google.com/about/datacenters/inside/locations/index.html

OpenDNS 

https://www.opendns.com/data-center-locations/

 

I'll backtrack on waiting a few months to see how things go with Cloudfare by other guinea pigs.   After some more reading-up on Cloudfare's new DNS service and their privacy policy I'll give them a try now instead of waiting.   For IPv4 and IPv6 I went ahead and changed my Preferred DNS setting to Cloudfare and  Alternate DNS setting to Google.   I'm  now a Cloudfare guinea pig....see how it goes....only takes a minute to change the DNS settings back to Google and OpenDNS guinea pig status if Cloudfare mistreats me as their guinea pig.

 

For IPv4

 

 

For IPv6

 

 

 

 

 

Edited April 6, 2018 by Pib

[muratremix]

I use dnscrypt proxy with opendns hk server. Cloudfront tls seems nice but I don’t think its available on openwrt/lede yet.


Sent from my iPhone using Thaivisa Connect

[Oxx]

22 hours ago, Pib said:

Google's and OpenDNS's nearest data center is in Singapore.

 

You appear to be unaware that Google installs servers in local ISPs' data centres in Thailand.  These handle much of the traffic that would otherwise be handled by Google's data centers.

 

This also explains why (as you can check) Google ip lookups are hijacked so the traffic goes to these local servers.

[Pib]

28 minutes ago, Oxx said:

 

You appear to be unaware that Google installs servers in local ISPs' data centres in Thailand.  These handle much of the traffic that would otherwise be handled by Google's data centers.

 

This also explains why (as you can check) Google ip lookups are hijacked so the traffic goes to these local servers.

If Google installs servers in local ISPs why doesn't a "ping 8.8.8.8" (to Google DNS) return a ping time of around 10ms which would indicate a Google server in Bangkok for my AIS Fibre plan, but instead returns a ping time in the mid 30 ms ballpark which is the ping time to Singapore where the nearest Google data center is.   

 

A "ping 1.1.1.1" (to Cloudfare DNS) returns a ping time of around 10ms since they have a sever in Bangkok as mentioned earlier.  And below webpage give more info on their Bangkok data center they opened in mid 2016.

https://blog.cloudflare.com/bangkok/

 

Now with above being said I'm not saying Google may not install servers in "some" local ISPs as part of a business arrangement with them.  Don't know how a person could confirm which local ISPs do have google servers installed in Thailand/Bangkok.  I'm just going on the data center locations and ping time results.  

 

Ping Time Result to Cloudfare and Google DNS servers

 

Edited April 7, 2018 by Pib

[Crossy]

Anyone else noticed that 1.1.1.1 seems to be down, not responding to a ping.

 

1.0.0.1 is still running fine.

[Oxx]

18 minutes ago, Crossy said:

Anyone else noticed that 1.1.1.1 seems to be down, not responding to a ping.

 

For me, it's not down - just running very slowly

 

[Crossy]

I'm getting a ping timeout from both now ?

 

Shame, it was working well, moving back to Google.

[Pib]

I use Clouldfare as my primary IPv4 and IPv6 DNS.  Didn't notice any problem today...right now or to to include the two times shortly after your 2 posts just above.   But if it was down/slow, since I have Google DNS set as my secondary (fallback) I might not have noticed any problem.

 

This website which monitor various DNS stats doesn't show any downtime or slowdown in speed for 1.1.1.1.  

 

Maybe it an ISP thing....I'm on AIS...I think Crossy in on TOT?

 

https://www.dnsperf.com/dns-provider/cloudflare

 

 

[Crossy]

16 hours ago, Pib said:

Maybe it an ISP thing....I'm on AIS...I think Crossy in on TOT?

Yes, I'm on TOT and 1.1.1.1 seems to be blocked (or some other problem).

 

I get a ping timeout with my local connection, but VPN to Singapore and it responds fine.

 

[Pib]

No problem pinging 1.1.1.1 for me...yesterday or today....below ping at 2:35pm today....I'm on AIS.