<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt'>
<p>On 20/11/2017 22:08, Damian Menscher wrote:</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">On Mon, Nov 20, 2017 at 3:47 AM, Florian Weimer <span><<a href="mailto:fweimer@redhat.com" rel="noreferrer">fweimer@redhat.com</a>></span> wrote:<br />
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left: 1px solid #cccccc; padding-left: 1ex;"><span class="gmail-"><span class="gmail-">On 11/18/2017 09:11 AM, Damian Menscher wrote:<br /></span></span>
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left: 1px solid #cccccc; padding-left: 1ex;">Your argument that you don't trust the ISPs between you and<br /> Google/OpenDNS/Quad9, and therefore run your own local recursive resolver,<br /> confuses me. After all, your local recursive needs to query third-party<br /> authoritative servers anyway.<br /><br /> To convince yourself, answer these two questions:<br /> - How many ISPs are between you and 8.8.8.8? I'm on Comcast, and they<br /> have direct peering with Google, so the number is zero.</blockquote>
8.8.8.8 is increasingly seen as an anycast service address for DNS unrelated to Google, similar to how you download the SSH keys for root login from 169.254.169.254 or instance-data. I expect that many ISPs route 8.8.8.8 to their own servers.</blockquote>
<div> </div>
<div>Unlike 169.254/16 which is defined by RFC to be link-local, <a href="http://8.8.8.0/24" target="_blank" rel="noreferrer">8.8.8.0/24</a> has been allocated to Google.</div>
<div> </div>
<div>If you identify instances of BGP hijacking please report either privately to the victim (Google in your example) or publicly to the nanog mailing list, so corrective action can be taken.</div>
<div> </div>
</div>
<div class="gmail_quote"> </div>
</div>
</div>
</blockquote>
<div> </div>
<div> </div>
<div>ISP's I've been with in times gone by have often "hijacked" open DNS resolvers, to ensure their users get best experience by using their own DNS servers. not a thing likes of google etc, can do about it. for instance, with the new laws in Australia, you'll find plenty localising googles and opendns's resolvers ip's to enforce and satisfy court directions from copyright orders</div>
<div>also allows them to use RPZ's to stop their users from going to phishing sites and so on, most users wouldnt know the difference, nor care.</div>
<div> </div>
<div> </div>
<div>-- <br />
<p>Kind Regards,</p>
<p>Noel Butler</p>
<table border="1" width="748" cellspacing="0" cellpadding="5">
<tbody>
<tr>
<td style="text-align: left;"><span style="font-size: 10pt;"><small><small><small><small>This Email, including any attachments, may contain legally privileged information, therefore remains confidential and subject to copyright protected under international law. You may not disseminate, discuss, or reveal, any part, to anyone, without the authors express written authority to do so. If you are not the intended recipient, please notify the sender then delete all copies of this message including attachments, immediately. Confidentiality, copyright, and legal privilege are not waived or lost by reason of the mistaken delivery of this message. Only <a href="http://www.adobe.com/">PDF</a> and <a href="http://en.wikipedia.org/wiki/OpenDocument">ODF</a> documents accepted, please do not send proprietary formatted documents </small></small></small></small></span></td>
</tr>
</tbody>
</table>
</div>
</body></html>