Strange DNS issue?

[tundrwd]

Ok - I'm on a Mac, and occasionally run the Google namebench utility to test various DNS servers to see which are faster, etc., and sometimes change the DNS servers (maybe twice a year), depending on results, etc.

All systems within my LAN are running DHCP, most with leased addresses (and my iMac is too). I'm running with the two main addresses of OpenDNS as my DNS server, and all my systems within the LAN are using the router (RT-N66U), as the DNS server (192.168.1.1). That way, I don't have to change the lease, etc., I just change the DNS at the server, reboot server, and everyone now changes the DNS they were using - if I ever change it.

Lately, I've been getting a message from namebench that my DNS server is highjacked and being redirected ("Outgoing requests were intercepted!"). After research, I now several ISPs are doing this to "improve" their networks, etc. When I get this, I can sometimes re-run namebench, and the message does NOT appear, and then turn right around within a minute or two of completing one run, and get the message again, etc.

So - the question is - does anyone know if namebench is being faulty here? Is it because I'm using my router as the DNS "go-between"? Do I need to go so far as setting up a DNS-caching name server? And if there's an issue with DNS requests actually being re-directed, I've read OpenDNS is using port 5353, so could forward requests to them - is there a WebGUI option to do this, or must I drop down to the command line and use iptables to do this (I'm assuming iptables is used). If iptables - is there a hint of how to configure? (I've just never delved deep into iptables config for firewalling, etc.)

Thanks!

Edit - I have just found that by selecting a different "Query Data Source" (which is either Chrome, Safari or Firefox), I can either get the message or not. Appears that using Safari as the data source ALWAYS gives this message, using Chrome or Firefox generally doesn't - but can still get the message sometimes using those as well.

 

[PrivateJoker]

Thank you for the tip on "query data source," that's interesting - I've had that same question myself.

It's been awhile since I've compared namebench to this back to back, but if you have a PC GRC's benchmark utility also has a lot of useful info.

https://www.grc.com/dns/benchmark.htm


I just tend to use my isp's (Comcast) DNS since it's pretty fast and because they're giving me IPV6 it's just easier to tell the router to get them both from the ISP, at least for my IPV6 to behave consistently.

 

[tundrwd]

Thank you for the tip on "query data source," that's interesting - I've had that same question myself.

That's supposed to use your browser history to test the DNS sites (assumes those are the sites you use most often, etc.) However, I always kill history and cache each time I quit the browser - so not sure how useful it is. I used a couple of the other selections ("top 2000", etc.), and it went through without a message. Wondering if something left over in browser cache is giving a false positive.