0

When I configure the interface's DNS, we often configure 8.8.8.8 and 8.8.4.4,

but I have a question, because the 8.8.8.8 and 8.8.4.4 all are belong to google.

will the bellow be better than the former?

8.8.8.8
208.67.222.222

EDIT-01

My 'better' means analysis more domains and more steadier, because the 8.8.8.8 and 8.8.4.4 all are belong to google, if there gives the DNS2 to another company's DNS address will it be better?

  • Please define better. In what way better? And what it at 208.67.222.222? – ctrl-alt-delor Apr 6 at 10:22
1

First, if you have multiple IP addresses in /etc/resolv.conf, only the first one will be used until it stops responding, then only the second one will be used, and only for that specific query (next one will start again with first one). Note that failed to respond is not the same as responded with a failure.

So some recommendations:

  1. Do not mix external (like public DNS resolvers) with internal ones; this most of the times makes no sense as it is based on the false beliefs that if the external one replies with domain not found then the internal one will be used for further query (this is false as explained in preambule); on the contrary it can lead to leaking internal sensitive information to external entities
  2. Do not put blindly 8.8.8.8, or in fact any other public open resolver; first think about it. Did you really think about the consequences (you are giving all your data to Google in this case, or any other organization; Are you happy with that?) and did you balance the pros and the cons? What prompted you not to use your ISP's recursive nameservers and/or installing some locally on your box or your network? There may be valid reasons to use public DNS resolvers, but it is always better to think about it a little before just putting some numbers
  3. There are a lot of public DNS resolvers, and I find particularly troubling that in 99% of the cases people seem to think only about Google. Why not using instead 9.9.9.9 or 1.1.1.1 or 80.80.80.80 or any listed at https://www.publicdns.xyz/ for example (without any guarantee that this list is correct or up to date)? Of course this does not change anything above previous point, whichever you choose should happen only after questioning why you need to do that.

Please have a look at this other answer of mine: https://superuser.com/a/1318861/693623 that deal with the notion of trust, and what features you may want to have (QNAME minimization, data confidentiality, DNSSEC validation, etc.)

  • Agreed. I would set up my own internal servers and not use either my ISP's nor these global free servers. This also adds the benefit of local caching and "better performance", should that still be the case in this lightning-fast world. – Tommiie Apr 15 at 14:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.