|
Patch reliability is unclear, but widespread attacks make patching prudent. Go ahead and patch, but watch out for potential problems. |
ON SECURITY By Susan Bradley There is a long-standing joke in enterprise technology: “It’s always DNS.” That’s because if something isn’t working, che
[See the full post at: Choosing your own domain name services]
Susan Bradley Patch Lady/Prudent patcher
I set up a “Pi-Hole/Raspberry PI” DNS server for my home network and it’s the best thing I’ve ever done.
It’s setup to be my only DNS server on each computer. Pi-Hole can be setup to use any DNS server out there. Pi-Hole then blocks any requests for ADs from known AD sites (it currently knows of 116,155 sites and this is updated daily). Blocking the sites means my meager bandwidth is not used for downloading ADs (I live in a rural area with a 9 Mbps up/down as the fastest connection I can get here).
Pi-Hole blocked 30% of my DNS queries just this morning. Sometimes I feel bad about not letting a site earn some money from the ADs, but when I take my laptop elsewhere and connect to a non-Pi-Hole network I’m reminded of the incredible amount of ADs pushed at me and I bless my Pi-Hole again.
Setting this up does take some technical skills and you have to purchase a Raspberry PI, but it is incredibly well worth it. See https://pi-hole.net/ for more info.
Marc
As for not being able to change these DNS servers, be aware that the router from an ISP is only 1 of 13 possible sources for your DNS configuration. For the full list, see the long DNS explanation here
https://www.routersecurity.org/testdns.php
The introduction of new secure DNS, a few years back, made this list much longer. Also, an active VPN connection always changes your DNS configuration.
OpenDNS is owned by Cisco and personally, I find it hard to trust Cisco. Many other DNS providers offer assorted filtering. Here are just a few
https://www.routersecurity.org/DNS.providers.php
As for manually changing Operating System level DNS configuration, note that Windows has two settings, one for Ethernet and one for Wi-Fi. On top of that, DNS can also be set for each SSID in Windows 11 (not in Windows 10).
And, as the person before me commented, most every desktop web browser now supports new/secure DNS (DoH or DoT) and my experience has been that the DNS setting in the web browser over-rides anything else. You can verify this using the many DNS testers in the link above.
As for “The modem supplied by Comcast has hard-coded DNS servers — 75.75.75.75 and 75.75.76.76.” Modems do not do DNS, routers do. The device being referred to here must be a combination modem/router. Yes, nitpicking, but still.
Get up to speed on router security at RouterSecurity.org and Defensive Computing at DefensiveComputingChecklist.com
All ISPs are not the same, of course, but using DNS from your ISP is often the worst option. For one thing, running a DNS server is not their core competence. Plus, it makes it easier for them to spy on you. Finally, they probably do not offer a filtering service.
Get up to speed on router security at RouterSecurity.org and Defensive Computing at DefensiveComputingChecklist.com
Steve,
You can verify the use of Mullvad’s DNS system here
https://mullvad.net/en/check
In your case, check all browsers with and without an active VPN configuration.
The one time I tried Mullvad DNS, I found I was using a DNS server thousands of miles from my location. They were nice enough to respond to a question (I was not a customer at the time) about it, and its just the way Anycast works. That said, the important things about DNS are filtering and encryption, not speed.
Get up to speed on router security at RouterSecurity.org and Defensive Computing at DefensiveComputingChecklist.com
I always put my Xfinity gateways into bridge mode and use my own routers so I can take complete control of my Internet experience. At one small property, I have a decent router that isn’t too expensive. At another larger, three floor property that must have been designed by a secret government agency in the early 2000’s to make each room a Faraday Cage, I use a very expensive three router mesh system using powerline networking for the Ethernet backhaul (and I frequently think profane thoughts in the home builder’s general direction — alternated with daydreams of pulling Cat 6 through the entire house to serve the backhaul).
https://www.xfinity.com/support/articles/wireless-gateway-enable-disable-bridge-mode
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
