ControlD with Merlin

[tnpapa]

I have been testing ControlD DNS with encryption. I have been entering the server settings directly into the Merlin interface for DOT. Results have been unstable. One of the developers at ControlD says I should use DOH by installing their daemon onto the router. Their reasoning for wanting me to use DOH is and I qoute:

"DOH is prone to fewer issues than DOT, and native DOT performance on Asus is pretty wonky to begin with"

Seems like a pretty bold and unqualified statement. I prefer DOT because I can see its presence and activity on my network.

So any validity to their statement?

 

[L&LD]

Not to me. What are they smoking?

 

[dave14305]

DoT is easy to identify and block by network operators due to its unique port 853/tcp. DoH blends in with other HTTPS traffic. However, I would not race to install a bloated app written in Go on an embedded device (e.g. NextDNS, AGH, ControlD).

 

[Treadler]

FWIW, both Controld & Quad9 are 1600+ km from me.

I’ve used Controld in both DoH + DoT modes, no difference here in apparent speed/stability. Quad9 ‘feels’ much quicker/snappier to me, works well.

I think your issue might be Controld, rather than the encryption used?

 

[tnpapa]

Same thing I noticed. Even though ControlD is only 25ms ping away, page loads seem slow and do stall sometimes. Cloudflare and OpenDNS are much much faster but they don't support ECS and my streaming apps and my Channels DVR system really work much better when routed to the proper CDN.

 

[Tech9]

I have one AIO router in use and it's set to local ISP DNS. It's not only fast as latency, but also send to right places. Google and OpenDNS show the same latency, but page loading is noticeably slower. Exactly the same experience as @tnpapa above. If you trust your ISP - better use their DNS for best Internet experience.

 

[tnpapa]

ISP has two DNS servers, one is flaking out and only responds to about 30% of the pings sent to it. Neither supports ECS. Google DNS does support ECS and page loads are very fast. Only problem is, well it's Google. To some ECS might not matter, but I get most of my TV channels as TVE feeds on Channels DVR servers, and without ECS it takes forever for the various TVE feeds to authorize.

 

[sfx2000]

Try Cloudflare - they're pretty good... and they're not google...

They do both DoT and DoH, and support DNSSEC

 

[tnpapa]

Try Cloudflare - they're pretty good... and they're not google...

They do both DoT and DoH, and support DNSSEC

but not ECS

 

[sfx2000]

but not ECS

ECS can be problematic if one is concerned about privacy...

 

[tnpapa]

nope not concerned. When security is needed I have a VPN.

 

[bbunge]

I have one AIO router in use and it's set to local ISP DNS. It's not only fast as latency, but also send to right places. Google and OpenDNS show the same latency, but page loading is noticeably slower. Exactly the same experience as @tnpapa above. If you trust your ISP - better use their DNS for best Internet experience.

My ISP does not run their own DNS resolvers or email servers for that matter. The resolvers they assign are three times farther away than Cloudflare or Quad9 and have lousy latency. My neighbors with the same FIOS service plan complain about slow page loading. Could be their ISP provided router as well as the DHCP assigned DNS.

 

[RMerlin]

ECS can be problematic if one is concerned about privacy...

But lack of ECS can also be problematic to performance as you will end up using the wrong CDN POPs.

Typical ECS will be a /24, which will only point at the ISP, not at the end user.

Personally I prefer to have working ECS.

 

[Tech9]

My ISP does not run their own DNS resolvers

Interesting. What DNS servers is your ISP offering in Automatic IP by DHCP configuration?

 

[sfx2000]

But lack of ECS can also be problematic to performance as you will end up using the wrong CDN POPs.

I agree that this could be a contentious topic - that being said, the major CDN's (Google, Amazon, Akamai, Cloudflare) typically have POP's inside the carrier network, so ECS and CDN POP selection may not be an issue.

A couple of the concerns raised about ECS, and Cloudflare's CEO specically stated this is that ECS can expose network topology that is behind the IPV4 NAT, and the risk of DNS cache poisoning by bad actors - that alone was enough to keep Cloudflare from implementing ECS on their platform.

Google, while supporting ECS, it pretty clear on the risks of a misconfigured resolver upstream that can cause issues...

EDNS Client Subnet (ECS) Guidelines | Public DNS | Google for Developers

developers.google.com

ECS can be a boon for some - and a bane for others - one of the risks is potential VPN leakage for those that want privacy (either as a want or a need)...

pfSense handles this well, as they have a number of options within both DNSMASQ and unbound configurations that can enable/disable based on the admin's decision.

I'm with you - if ECS is desired and implemented correctly, it can help...

 

[tnpapa]

I do see an immediate performance improvement with streaming services(Netflix etc) when ECS is on and using DNS servers not provided by my ISP. My ISP (ATT Fiber) has the fastest DNS servers(expected) but they are not the most stable. I am sure that ATT has many CDN providers servers inside their network. So the quandary of sharing all my DNS records with ATT, or using encrypted DNS with ECS to off network servers.

 

[sfx2000]

So the quandary of sharing all my DNS records with ATT, or using encrypted DNS with ECS to off network servers.

ECS and ENDS have nothing to do with encryption...

Let's not go down the rat-hole of DNSCrypt, that discussion won't end well...

 

[tnpapa]

ECS and ENDS have nothing to do with encryption...

Let's not go down the rat-hole of DNSCrypt, that discussion won't end well...

I know but the only way I will connect to off network DNS servers is using DOT or DOH.

 

[sfx2000]

I know but the only way I will connect to off network DNS servers is using DOT or DOH.

DoT or DoH is fine - I know some have concerns with DoH due to malware concerns, but there's little one can do except whitelist known/good servers there.

Something to note - just because one sets the DNS to 8.8.8.8 (google) or 1.1.1.1 (cloudflare) - the DNS server that provides the response likely won't come from that server...

Fun/Informative Link...

dnscheck.tools - check your dns resolvers

A tool to test for DNS leaks, DNSSEC validation, and more

dnscheck.tools

 

[Tech9]

I know but the only way I will connect to off network DNS servers is using DOT or DOH.

AT&T is redirecting port 53 to own servers?