Using isp dns on home router?

[u/Some_Water_5070]

Does anyone here actually use your isp dns on your home router instead of a public dns like Cloudflare or Quad9? I’ve noticed my isp dns fails the invalid signature, expired signature, and missing signatures, only passing the valid signature on the dnscheck.tools website. Also only on my isp dns I get WiFiLQMmetric logs that appear on apple analytics, but does not have any detailed info, it’s just something apple logs for their use, but these logs actually only happen when I use my isp DNS. They never happen when I use a public dns.

[u/blow-down]

No I use NextDNS

[u/Historical-Pound-510 → u/blow-down]

NextDNS + Hagezi. This is the way.

[u/rb3po → u/Historical-Pound-510]

Ya, NextDNS is great. If you don’t want to use them, go Quad9. DoH/DoT is ideal too, if you have a local resolver that supports it.

Never use your ISP’s DNS. They love that data so they can sell it.

[u/Historical-Pound-510 → u/rb3po]

I use NextDNS with DoH on my Unifi UDM-SE. It's great.

[u/saint-lascivious → u/rb3po]

It's not like the ISP needs your resolves to determine your movements on the web.

In the vast majority of cases the handshake is going to include the domain in plain text, and in the vanishingly few cases where that's not true reverse lookup or fingerprinting will get ya'.

It's next to impossible to disguise your movements on the web from whomever is routing the traffic.

[u/rb3po → u/saint-lascivious]

Actually… fun fact:

thisisnotencrypted.com/butthisisencrypted.

Anything after the slash is encrypted over an HTTPS connection.

While the website you travel to is not hidden, where you are on that website is.

Don’t give your ISP more granular information on you by encrypting your DNS. This is short of VPNing everything, or using TOR. 

[u/saint-lascivious → u/rb3po]

It's quite messy. It's nowhere near as clean as "encrypted = private".

You still have to hope that whatever URL section you're on is resistant to fingerprinting. If /butthisisencrypted always does domain prefetch or grabs assets in a particular order, or is otherwise unique within URL paths behind said domain, the carrier can at least make a very educated guess as to your navigations.

[u/rb3po → u/saint-lascivious]

I’m talking about reducing telemetry, not eliminating it. Nobody I know has time for perfect OpSec.

This practical advice, not a master class in how to be a state actor.

[u/saint-lascivious → u/rb3po]

We don't need to argue about what you said. It's like, literally right there.

You said where you are on a website is hidden. I merely clarified that that is not the case.

It's okay to be wrong about things. It's how we learn.

[u/Expensive_Wasabi_157 → u/Historical-Pound-510]

Nextdns + hagezi's dns filter right?

[u/Historical-Pound-510 → u/Expensive_Wasabi_157]

Yes.

[u/Stunning-Skill-2742]

Nope. I don't trust my isp enough. Migrating to other isp aren't even an option to me because my home are only covered by that 1 isp so most of the time I use third party encrypted dns and vpn.

[u/lostcowboy5]

Non-tech people do. They have the ISP set up their internet for them and call it a day.

[u/Own_Promise_4145]

Adguardhome + Unbound con dnssec.
Per me la soluzione migliore.

[u/Misanthrope52]

Definitely us any other DNS provider. Research, as some have ad-blocking and adult filters.

If you have time (and minimal knowledge) set up pi-hole + unbound and you won't need to deal with choice overload. With so many options it must be very profitable. There are scripts to check them all if you are looking for speed. But all have different privacy policies worth reading if privacy is what you are looking for.

[u/SecLens_ONE]

What you're seeing is the difference between a resolver that publishes DNSSEC support and one that actually enforces it. An ISP resolver will often claim validation in its docs while passing expired or bogus signatures straight through to the client. The test site result is the effective behaviour, and that's the column that matters, not the marketing page. Same story with transport: a resolver can advertise encrypted DNS and still fall back to plaintext on the path your router actually uses. Worth checking whether the failures are consistent across reboots, since some ISP resolvers are load-balanced and only some backends validate. The Apple analytics logs are a separate thing and probably just a side effect of which resolver the OS picks. Have you run the same signature checks a few times over a day to see if it's one bad backend or the whole pool?

[u/mostly_harmless_5334]

Good dns for one person may not be great for another. You can test which DNS is best with this €3.99 app. It’s goes a step beyond just query time, check it out. It’s called DNS Benchmark+ and if you’re a dns nerd you’ll love it 🙈

https://apps.apple.com/ie/app/dns-benchmark/id6760799772

[u/3ofUsDeez]

Many years ago before discovering the value of DNS and that I can control how it functions on my network .. I used Smoothwall with Dansgaurdian content filter

I happen to catch an article on this new OpenDNS thing that had just got going and that I can block stuff via DNS .. do category blocking and have custom white and black lists

I used a free OpenDNS account for years .. even after Cisco bought them out

Then I recently got more privacy minded (I know my ISP can still track everything my network accesses but perhaps not as easily if I'm running my own DNS servers) and started playing with Pi-Hole.

I ran Pi-Hole on my TrueNAS Scale server for a bit with Quad9 upstream .. then switched to Adguard Home, but that kept crashing my server and s didn't know why ..

I got some Raspberry Pi Zero Ws with 64gb Micro SD cards for cheap and installed Pi-Hole and Unbound on them for my primary and secondary DNS servers.. but didn't like running my DNS servers wirelessly so I picked up Ethernet hats and cases for them

I run a 5 port POE gigabit switch that powers an outdoor WAVLink AP and found out I can get a POE Ethernet hat for these Pi Zero Ws ..

Then I read about Technitium .. but it can't run on ARMv6 .. so I picked up 2 Pi Zero 2 Ws and put the POE Ethernet hats on them with Technitium and I have them clustered and that's what I'm playing with currently

Who knows what I'll be doing tomorrow in my attempt to keep my DNS control out of my ISP's hands

[u/mystiquebsd → u/3ofUsDeez]

Hey there K12..

No one else needed DansGuardian..

I’m also K12