by stanislavb on 6/12/25, 5:47 AM with 52 comments
by JimDabell on 6/12/25, 6:29 AM
by antonkochubey on 6/12/25, 6:12 AM
Yeah, right. Good timing.
by halpow on 6/12/25, 6:10 AM
by zerof1l on 6/12/25, 8:10 AM
The only true private DNS server is the one you own. It should be a recursive DNS server configured with DNS root zone and DNSSEC. So it would first contact one of the root DNS servers (obtained from ICANN), validate the authenticity of the response ensure it is not tampered with using DNSSEC, and then proceed to call the next server in the chain until the query is fully resolved. Such DNS server would bypass all censorships.
Also nice is that more and more root servers already support DoT meaning that the request and response would be encrypted preventing intermediaries like your ISP from seeing the data.
As a last resort, your DNS server can be hosted outside of the country on a server and then you'd connect to it over DoT or DoH.
by snvzz on 6/12/25, 6:42 AM
- Censor: So they can refuse to solve a name, or solve to whatever address they mandate.
- Log: So that you can get criminally prosecuted for having requested resolution of names at any point in the future.
No thanks. I'll keep my unbound local cache pointed to a tor-based dns-on-tls server.
by nektro on 6/12/25, 6:32 AM
by laughing_snyder on 6/12/25, 9:19 AM
by hunglee2 on 6/12/25, 6:09 AM