Knot Resolver vs unbound?

[BeachGuy]

Any thoughts on Knot Resolver (https://www.knot-resolver.cz/) vs unbound?

 

[sfx2000]

knot replaces BIND as a reference implementation...

unbound is still a very good choice, as many know the mechanics and work with it...

 

[Angus]

Any thoughts on Knot Resolver (https://www.knot-resolver.cz/) vs unbound?

I looked at these 2 recently, I found kresd doesn't recurse through certain records as you might expect.
For example, with a CNAME pointing to a record in different DNS domain, kresd only returns the CNAME, it doesn't then recursively lookup what that record resolves to on the next DNS server (at least when I last checked - a year or so back I suppose)

unbound is one of the 2 DNS software implementations documented for Red Hat 9 (bind being the other) - it's agood choice

 

[Angus]

knot replaces BIND as a reference implementation...

unbound is still a very good choice, as many know the mechanics and work with it...

knot DNS (knotd) is knot's authoritative DNS server.
Knot Recursor (kresd) is their recursor software.

 

[ColinTaylor]

Knot Recursor (kresd) is their recursor software.

That's resolver not recursor.

 

[BeachGuy]

unbound has been working great for me. Learned big lesson lately -- if it isn't broken don't fix it!

 

[Tech9]

if it isn't broken don't fix it!

The default Dnsmasq included in Asuswrt isn't broken. It does everything needed for a small home network.

 

[BeachGuy]

How do I use that? My understanding is it's just a caching forwarder, not a recursive resolver.

 

[Tech9]

Yes, forwarder and it does what is needed very well. Replacing it with resolver has pros and cons. Unbound is an available add-on for Asuswrt-Merlin firmware, but not necessarily better for the specific task. What was broken in Dnsmasq and needed fixing by replacing it with Unbound?

 

[BeachGuy]

I no longer rely on external resolver for DNS. My router is my resolver. Privacy

 

[Tech9]

Your ISP knows exactly where you connect by IP address and still has quite accurate browsing history of your account. This "privacy" is about the same as using their own DNS servers with the difference your local DNS resolution is actually much slower until your own cache is build up.

 

[Angus]

That's resolver not recursor.

Hi Colin, the terms are interchangeable really, I've just tended in that way over the years.

 

[heysoundude]

Your ISP knows exactly where you connect by IP address and still has quite accurate browsing history of your account.

unless and until pains are taken to prevent it. You may not agree with or see the point of using them at a home level, but they are available, if people should care to roll up their sleeves and dig into managing the result

 

[Tech9]

unless and until pains are taken to prevent it

All commonly discussed methods are ineffective for hiding activities. As you often say - education first. DNS encryption is for MITM and eventual DNS redirection, doesn't do much for privacy. Own resolver is splitting DNS queries to multiple servers, but the resolved IPs get to the ISP anyway. Commercial VPN is replacing physical ISP with virtual one. The VPN company gets the data, the physical ISP knows exactly what VPN is in use. Privacy is promises in advertisements, no guarantees. In case of illegal activities no VPN will protect a customer paying $4/month and who violates Terms and Conditions. No logs and allowed to operate in logs required jurisdictions? Sure. TOR is easily detectable and is equal to drawing attention to yourself. There is no guarantee TOR exit points are not run by someone who actually wants to see what's going on. Connected to Internet - someone knows what are you doing. Total Internet privacy and security - disconnect the service. Increased life privacy and security - cabin in the woods in no predators area, no cell phone.

 

[Kingp1n]

unless and until pains are taken to prevent it. You may not agree with or see the point of using them at a home level, but they are available, if people should care to roll up their sleeves and dig into managing the result

I 100% agree....it's always nice to have options available regardless of what your ISP knows or doesn't know.

 

[Tech9]

it's always nice to have options available

What options you guys have in mind? Let’s see what they can and cannot do.

 

[Kingp1n]

What options you guys have in mind? Let’s see what they can and cannot do.

The options available thru AMTM!

 

[Tech9]

None of them will prevent eventual logging of activities upstream. Read post #14 again.

 

[Kingp1n]

None of them will prevent eventual logging of activities upstream. Read post #14 again.

And that's fine too.