11

What situations are you thinking are good candidates for a service like this?

I have been concerned about our ISP's DNS - they are redirecting to advertising pages, and showing other signs of questionable integrity. I was considering OpenDNS - but wasn't feeling that they were going to be much better - and heard mixed things about them.

Our operation is quite small, so I don't want anything too complicated. And I certainly don't want a bunch of extra headaches.

6 Answers6

24

Looks like Google will be a good fit when you want a DNS that conforms to RFC 1034, and when you aren't all tinfoil-hat about Google.

OpenDNS hijacks your unresolved DNS queries and redirects you to advertising. This breaks the NXDOMAIN response. However, their claim to fame is that they provide user-definable filtering at the DNS level.

Frankly, few things piss me off more than a DNS provider that hijacks NXDOMAIN, so I'll probably be switching over to Google for my personal stuff.

And hey, hard to get DNS IPs that are easier to remember! (8.8.8.8 and 8.8.4.4)

phoebus
  • 8,430
5

Situations where you're not a long way from a Google datacenter and where you're not heavily dependent upon Akamaized traffic.

Various big providers try to direct you to servers "near" you on the network, by looking at where the DNS query came from and doing some rough approximation from that. This kinda-sometimes-mostly works, as long as the DNS cache is sufficiently "near" you on the net. This is part of how Akamai works.

None of the open recursors currently provide a way to pass on location information for the querier to the authoritative servers, so using anything like OpenDNS or GoogleDNS will hurt the performance that you experience of services like Akamai. How much? That depends on your local network, how close you are to Google's caches, etc etc.

OTOH, if you're a small operation and have a local web cache (squid?) to lower the utilization of your uplinks, then the traffic which Akamai serves is more likely to hit the caches anyway. Whether or not that balances out, only you can determine based on trial and error and user reports.

As long as you have low ping times to the GoogleDNS servers, it's really a case of "suck it and see" and figure out if it works for you. If it does, great, you can use a free service to your advantage. If not, then you switch back and you're not out anything. It's not like this is a hard config change to revert.

[disclosure: my employer has a stance in this, I'm not an independent voice]

Phil P
  • 3,110
3

The main noticeable 'feature' of OpenDNS is an OpenDNS advertising-filled search page whenever you resolve a non-existent domain. If you're not worried about this, or about stats being collected on your DNS query history (read their privacy policy if you're worried) then it's a pretty quick DNS service.

TRiG
  • 1,193
  • 3
  • 14
  • 30
TrXuk
  • 81
2

I think a good solution is to run your own local resolver.

It's pretty easy to install and run PowerDNS's local resolver and there is a windows binary as well.

chris
  • 12,104
1

Consider any performance difference between

  • the two open free solutions that you mentioned and
  • the (hopefully) more local DNS service offered by your ISP.

Try a traceroute to 8.8.8.8 and your ISP's DNS server.

Perhaps your impetus for change is around:

  • reliability/stability - this will obviously depend on your ISP. Google widely gets high marks for its uptime. Its DNS service should follow that trend.
  • security - tin foiled hats will question your ISP and Google. Likely the contest is a wash.
  • get less spammy - if users are complaining that OpenDNS or your ISP is serving ads cleverly disguised as suggestions, then Google DNS might be a good choice.

Be sure to give the Google Public DNS Privacy article a read.

p.campbell
  • 4,447
1

The other useful feature of OpenDNS is that it's a quick way to provide (limited) filtering of websites by category. It's not foolproof, but if you configure it to block "Social Media" sites from your network then your users aren't going to be getting to Facebook unless they at least have a basic understanding of DNS and the ability to fiddle settings.

fencepost
  • 972