Last Updated on November 29, 2015 by Dave Farquhar
There’s some bad behavior going on with DNS right now. In Washington and at local ISPs.
It turns out that some slimeball ISPs are using DNS as a revenue stream, by sending weird DNS requests to marketing web sites instead of returning an error the way they’re supposed to. Nine of them are doing it: Hughes, Frontier, Cavalier, FiberNet, Spacenet, Onvoy, WOW [Wide Open West], Cincy B., and SDN. If your ISP is on the list, change it now. We shouldn’t reward bad behavior. Change what, you ask? Ideally, change ISPs. If you can’t do that, change to a new DNS.
If you happen to be on one of these ISPs, I recommend you run DNS Bench, as I’ve mentioned before, to find suitable alternatives to use.
The other reason is the Protect-IP act makes DNS servers censor web sites accused of copyright infringement. Accused, not found guilty. I’m not sure what happened to innocent until proven guilty and due process and all those other things we fought a war about, but I guess large corporations get to buy changes to the constitution when it suits them. This act isn’t law yet, but it doesn’t hurt to be prepared.
Here’s the problem with this. I know someone whose Youtube video was shown on MSNBC last week, in unflattering light. If he wanted to be, as my three-year-old would say, “not very nice,” he could file a copyright complaint against MSNBC and get the entire domain blocked.
But of course I’m being silly. This will never work against a large corporation. A more likely scenario is MSNBC claiming copyright on the video and taking down the guy I know. (That he’s also the creator of the video is a minor technicality.) It creates a giant legal loophole for large companies to abuse.
The small-scale, per-individual solution is to use a DNS outside of the United States. If you’re in the United States, you’ll have to find the fastest non-US server you can, and use it. If Protect-IP passes and gets signed into law, it wouldn’t surprise me if a tool to help with this appears soon.
These days, many broadband routers have an onboard caching DNS. This would help ease the pain of using an offshore DNS. Find the fastest offshore DNS you can, then configure your router to point to it. Then point your computers to your router. This way, your router can cache frequently used DNS queries, and get the fastest possible results when it finds something new.
David Farquhar is a computer security professional, entrepreneur, and author. He started his career as a part-time computer technician in 1994, worked his way up to system administrator by 1997, and has specialized in vulnerability management since 2013. He invests in real estate on the side and his hobbies include O gauge trains, baseball cards, and retro computers and video games. A University of Missouri graduate, he holds CISSP and Security+ certifications. He lives in St. Louis with his family.
This has been a mess for ages now. Years of ISPs playing games with users. I say just hardcode 4.2.2.2 and 4.2.2.3 and be done with it. Who needs the headache.
I’ve seen way too many people’s Google searches indicating they had a problem after arbitrarily changing their DNS to 4.2.2.2 or something similar. DNS Bench takes 20 minutes to run–less time than it takes to defrag a hard drive–and lets you make an intelligent decision.
There’s no other way, short of using a tool, to know which DNS server(s) to use. Too many other factors go into it.