How many of you bother with DNSSEC/DNSCrypt? Impact to DNS resolution speed?

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › How many of you bother with DNSSEC/DNSCrypt? Impact to DNS resolution speed?

1 | 2

Aaroona

3204 posts

Uber Geek
+1 received by user: 169

#1537786 21-Apr-2016 22:08

I disabled DNSCrypt and enabled the ISP DNS servers - DNSSEC works, and I've noticed it getting IP's that are closer to where I am - e.g. google.co.nz resolves to a IP closer to here at 24ms, as opposed to 180+ms when using a Tier2 dnscrypt server. (results different IP's)

With that said, the performance difference is not hugely noticeable between using the ISP-non-dnscrypt DNS servers and the Tier2 dnscrypt enabled servers, so I may leave it enabled using the tier2 NZ server.

michaelmurfy

meow
13581 posts

Uber Geek
+1 received by user: 10914

Moderator

ID Verified

Trusted

Lifetime subscriber

#1537810 21-Apr-2016 23:42

I've done some speed comparisons between some dnscrypt providers and found that CloudNS is the fastest of the lot. I tried Tier2 and thought it was quite slow (the Auckland nameserver). This way, I have multiple nameservers that don't log anything (verified), only accept dnscrypt traffic with features such as dnssec + namecoin support.

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

Aaroona

3204 posts

Uber Geek
+1 received by user: 169

#1538080 22-Apr-2016 13:17

michaelmurfy:

I've done some speed comparisons between some dnscrypt providers and found that CloudNS is the fastest of the lot. I tried Tier2 and thought it was quite slow (the Auckland nameserver). This way, I have multiple nameservers that don't log anything (verified), only accept dnscrypt traffic with features such as dnssec + namecoin support.

Interesting. I will flick between the two over the next week or so and see if any difference is noticed. Ping is definitely lower to the NZ Tier2 dns server (by about 3 fold) when compared to Cloudns, but of course, that doesn't always tell the full picture.

Coming from the dnscrypt provider I was using before, our internet is already significantly faster and for the most part where I think it should be for the type of connection that it is. So definitely a huge improvement.

Weirdly, even using the Tier2 NZ server, it still picks up an overseas IP for google.co.nz, taking my normally ~20ms ping to the local google server, up to ~200 for the international one.
But given the speedup of most of my other traffic, I'm willing to deal with that for the moment.

michaelmurfy

meow
13581 posts

Uber Geek
+1 received by user: 10914

Moderator

ID Verified

Trusted

Lifetime subscriber

#1572051 15-Jun-2016 01:29

Just a heads up - I've found CloudNS-Can to now have an expired certificate / their Sydney server has been having problems lately (picked up from some internal logs on my network). I have not found a better DNS server hosted in Australia / NZ that does dnssec checks apart from my ISP's DNS server (BigPipe) so have personally switched back to that.

If you're using dnscrypt + CloudNS I would suggest switching away from them. I sent them a PGP encrypted email a few days ago and have yet to have a reply but it is a little worrying that their website currently has an expired SSL certificate + the keyswap from them to my dnscrypt client has stopped working.

I've got quite a few servers under 20ms away so might implement my own dnscrypt network however my ISP's DNS servers are fine for now.

1 | 2