[dns-operations] new public DNS service: 9.9.9.9

[Damian Menscher]

On Mon, Nov 20, 2017 at 4:32 PM, Noel Butler <noel.butler at ausics.net> wrote:

> On 21/11/2017 03:16, Damian Menscher wrote:
>
> On Mon, Nov 20, 2017 at 4:28 AM, Noel Butler <noel.butler at ausics.net>
> wrote:
>
>> On 20/11/2017 22:08, Damian Menscher wrote:
>>
>> On Mon, Nov 20, 2017 at 3:47 AM, Florian Weimer <fweimer at redhat.com>
>> wrote:
>>
>>> On 11/18/2017 09:11 AM, Damian Menscher wrote:
>>>
>>>> Your argument that you don't trust the ISPs between you and
>>>> Google/OpenDNS/Quad9, and therefore run your own local recursive
>>>> resolver,
>>>> confuses me.  After all, your local recursive needs to query third-party
>>>> authoritative servers anyway.
>>>>
>>>> To convince yourself, answer these two questions:
>>>>    - How many ISPs are between you and 8.8.8.8?  I'm on Comcast, and
>>>> they
>>>> have direct peering with Google, so the number is zero.
>>>
>>> 8.8.8.8 is increasingly seen as an anycast service address for DNS
>>> unrelated to Google, similar to how you download the SSH keys for root
>>> login from 169.254.169.254 or instance-data.  I expect that many ISPs route
>>> 8.8.8.8 to their own servers.
>>
>>
>> Unlike 169.254/16 which is defined by RFC to be link-local, 8.8.8.0/24
>> has been allocated to Google.
>>
>> If you identify instances of BGP hijacking please report either privately
>> to the victim (Google in your example) or publicly to the nanog mailing
>> list, so corrective action can be taken.
>>
>>
>> ISP's I've been with in times gone by have often "hijacked" open DNS
>> resolvers, to ensure their users get best experience by using their own DNS
>> servers. not a thing likes of google etc, can do about it. for instance,
>> with the new laws in Australia, you'll find plenty localising googles and
>> opendns's resolvers ip's to enforce and satisfy court directions from
>> copyright orders
>> also allows them to use RPZ's to stop their users from going to phishing
>> sites and so on, most users wouldnt know the difference, nor care.
>>
>
> Actually the users *do* care, which is why they explicitly changed their
> settings from the ISP default to 8.8.8.8.
>
>
> Maybe I'm old school, but I dont see a need for any open public resolvers,
> those that run them, dont do it out the kindness of their heart, there is
> always a commercial reason.
>

You're right, there is a commercial reason Google operates an open public
resolver: "our business depends on functional internet, so let's provide
users an alternative to slow, broken, or actively malicious ISP servers."

I suppose you'll have us believe the ISPs are hijacking 8.8.8.8 to their
own systems out of the goodness of their hearts, and not for some
commercial reason (which is likely exactly what the users are trying to
avoid)?  Sorry, but I don't buy the claim that hijacking another company's
address space to violate the express intent of your users is something
you're doing just to be nice.

Damian
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20171120/1e0346f0/attachment.html>