What, if any, Public DNS is preferred?

[shortwavesurfer@lemmy.zip]

Controld.com. I use their free version that blocks ads and online tracking and malware.

[psythik@lemmy.world]

Adguard DNS, so I can block ads in my entire house without having to invest in a PiHole. dns.adguard-dns.com More IPs

[abominable_panda@lemmy.world]

Check out PrivacyGuides. They have recommendations for DNS including what others have commented

[vk6flab@lemmy.radio]

I've been using Adguard public DNS for over a year across my LAN and it works great, with much less hassle than a pihole, which I previously used for years.

I miss the ability to add random hosts to either black or white lists, but in reality only used it sporadically.

[mangopenguin@lemmy.blahaj.zone]

Adguard Home supports TLS, HTTPs, QUIC and other stuff natively, in case anyone reading wants to set up a pihole equivalent with less work for encrypted DNS.

https://github.com/AdguardTeam/AdGuardHome/wiki/Configuration#upstreams

[irotsoma@lemmy.blahaj.zone]

I use a local unbound DNS server on my router with Quad9 as upstream. I actually have google DNS entirely blocked/rerouted on my router because google uses it for advertising tracking, but I get creepers out by targeted ads showing up in random places when I do do something on a totally unrelated site. Most important thing, though, is to use DNSSEC or DNS over HTTPS to reduce middlemen from using your DNS info to track what sites you visit and sell that data. Of course ISPs still see the destination of all of your data for tracking what sites you visit unless you use a VPN or similar tools, so you can't hide it from them that way.

[drspod@lemmy.ml]

What ISP do you use that makes you trust Cloudflare more than your ISP? You must really be between a rock and a hard place.

[drspod@lemmy.ml]

In regards to all the answers in this thread, consider: If you're not paying for it with money, then what are you paying for it with?

The most private DNS is a recursive resolver.

[andromxda@lemmy.dbzer0.com]

If you need a traditional, unencrypted DNS service, check out Quad9 and AdGuard's Public DNS. If you can use DoT or DoH, use LibreDNS or Mullvad DNS. If you want more customization, check out NextDNS.

[calamityjanitor@lemmy.world]

Do you have the local unbound server respond to DoH so that the browser also uses encrypted client hello?

[yuki@programming.dev]

nextdns or mullvad？

[dahpu@feddit.org]

Quad9 does also offer DoT and DoH.

[lemmchen@feddit.org]

Even DNSCrypt, but I think nobody really uses that.

[iteetechmonkey@lemmy.world]

DNSSEC is a means of authenticating the data receives was not tampered with, such as MITM attacks, thus ensuring data integrity. It uses PKI but it's not an alternative to DoH or DoT which encrypts the DNS traffic, either over HTTPS or TLS, providing confidentiality.

DNSSEC can be used in conjunction with DoH or DoT to achieve the Security CIA triad - Confidentiality, Integrity, Authenticity.

[lemmchen@feddit.org]

Why would you need cloudflared? Can't you justbset DoH/DoT servers as a backend in Pi-Hole?

[darkassassin07@lemmy.ca]

Pihole doesn't directly support DOH, linked is their official guide for implementing it: using cloudflared.

[darkassassin07@lemmy.ca]

I'm not all that concerned about either tbh; I was just already capturing DNS traffic and funneling it through pihole for the customizable blocking, and figured I may as well add DOH while I'm at it.

Just sharing the knowledge for those that are interested. You can use any DOH provider you like.

[kekmacska@lemmy.zip]

quad9, blahdns, dnscry.pt, ibksturm, koki, litepay.ch serbica

[irotsoma@lemmy.blahaj.zone]

No. I don't use DoH inside my network because I redirect DNS traffic on my primary VLAN to a pihole for ad and malware reducing. But I also control what has access to that VLAN pretty strictly. I have another VLAN for guests and untrusted devices that doesn't use the redirecting, but does use the Unbound server as the default DNS, just doesn't enforce it. And I have an even more locked down VLAN for self-hosted servers that also doesn't use the pihole, but does use Unbound.

[irotsoma@lemmy.blahaj.zone]

Thanks for the correction, that was a typo based on a long work day screwing with my brain processing acronyms. I meant to say DNS over TLS or DNS over HTTPS.