Hacker News Reader

Comment by Karrot_Kream | Hacker News Reader

Why would you use a local DNS resolver instead of using a remote well-known resolver like 1.1.1.1 or 8.8.8.8 in a home networking situation? Your systems will cache DNS entries to paper over unavailability issues, and as long as you use one as your primary and the other as a secondary, there's a very low likelihood (probably < 0.0001%) that you'll ever have issues resolving DNS.

View on HN

If you look at systems like Deco (and a bunch of others I've noticed recently like linksys) the devices have stopped being dns forwarders themselves to clients and instead they assign your ISP (or the ones you've set for your ISP) DNS directly to clients. This means your device now resolves dns over wifi directly. This means each device is now relying directly on google and cloudflare instead of relying on the gateway (which being wired will experience the lowest latency especially when it comes to redirects and should ideally have a robust DNS server).

A local network resolver instead of forwarder on a client seems to work a lot better in my experience especially when I use root DNS on unbound. Yes a root DNS is a lot slower than something like 8.8.8.8 but you could use an upstream dns with unbound if you really want something faster. Either way, a local DNS will be lot less problematic compared to if you devices has to handle all dns over wifi including the redirects (which happen a lot).

Almost every time I see a network problem, it's always a DNS problem. In a typical home network setup these days:

client DNS cache -> upstream DNS -> root DNS. client DNS cache -> local DNS - > upstream DNS -> root DNS.

My setup:

client DNS cache -> local DNS -> root DNS.

The first one works better if the network is wired. Second and third one works better on wireless.

One alternative that works 'okay' is if the client directly uses DoT or DoH for DNS. TCP works little more reliably than UDP (wink) but neither Google nor Cloudflare offer signed profiles for iOS and macOS (third party is there). Stubby works good on linux and android and windows have a built in solution.

because those 3rd-party resolvers are not under your control, which is usually interesting for someone running a homelab, and lie in responses.

"it's always dns" should ring a bell :)

For a homelab yes, but I figured GP was referring to a robust home network, not necessarily a homelab. "it's always dns" goes both ways as I've had local resolvers add huge amounts of latency to connection establishment.

yea. i was also advocating against local resolvers in the name of robustness, until my isp was starting to block certain domains.

not really the fact that some domains i don't care much about are blocked, but this is a dangerous precedent in deviation from facts.

Reply on news.ycombinator.com