@David:
Yes, absolutely fair trade. And you have done a great job with OpenDNS.
I am impressed that you are not doing it for a commercial gain but for the community. Keep up the good work.

I did give some stickers to Paul when I met him (long after this post was written) but I got some PaulStamatiou.com buttons from him so that was probably a fair trade. :-)

-david ulevitch

Good comment about privacy issues. One comment, two questions:

Comment: You know we have no idea what URLs you visit right? We know the hostname but not the URL, not a huge privacy violation there. Plus, we make our privacy policy quite clear and at the end of the day, I’m not going to tell some kids mom that their kid is looking at porno. I use OpenDNS too. ;-)

1) Who does your DNS now are what makes you think they aren’t logging it? (Particularly if your ISP is ATT)
2) What makes you think the root-servers and GTLD-roots aren’t logging everything already (and I know a few TLD and GTLD operators who are, for the record).

-david

Sorry for the late reply, there’s got to be a better way to keep track of comments I leave on blogs that I mean to come back and check up on… I got busy this weekend with the SRL festivities in San Jose. :-)

In response to your question about how bad ISPs can really be? Well, you might be lucky in Europe by having good ISPs (like XS4ALL) and others but when we bring up our London location (As soon as AS701 and AS2914 quit being lame and bring us circuits) I invite you to test it out and see. If we come up at the AMS-IX later in the year or early 2007 we’ll be fully populated for Europe. :-)

In response to the browser cache issue, when you load a page like http://www.myspace.com you do like ten requests from your browser including things for image servers, ad servers, etc. Those all often have low or zero TTLs which expire super quick. You also don’t carry the glue for any of those records and your ISPs is likely churning through them at a quick rate making it leg work for your lookups. End result, slowness, regardless of DNS caching on your side.

In response to the part of about public DNS servers. There aren’t any that are focused on performance. In fact, most people are running open servers by accident (contributing to the DNS amplification attack) or are otherwise unable to shut it down due to internet reliance on them (4.2.2.1 comes to mind, which is NOT a high-performing nameserver, although it does appear anycasted within Level3)

We’ll deal with Dynamic IPs and more when we roll out a full blown account management system.

As for the rest of your questions, those are best had on the dns-operations mailing list where we can discuss them in a better forum, where it’s already been discussed and will likely be discussed quite a bit more. To be brief though, the notion that there is “one true DNS tree” has long since been dead (thanks to split horizon, views, CDNs, internal DNS, etc) and I believe acknowledging that and starting to secure and enhance the recursive DNS layer is an important step for the Internet. You’ll find most others agree though I welcome an open discussion (as you can see). :-)

-david

The only worry I have is if OpenDNS consider a site to be evil, what if I want/need to get there for research, this there no wany to override it short of changing my DNS back?

Nice call on this one Paul

I’m going to reply later tonight. I’m currently at Cisco waiting to talk about DNS (of course).

http://isotf.org/isoi.html

Your questions are good and deserve the time it takes to write a clear answer. I’ll have that time later tonight. :-)

-david

You’d be surprised at how bad some ISPs like Comcast are at providing DNS. Their caches actually cause more harm than you’d imagine.
So it will be more than a whole second to get a DNS result? If that’s the case, I agree it’s terrible, and they have a big problem. But I also think their customers should yell at them, not go elsewhere, because DNS actually IS a big part of what an ISP offers.
Though that’s not an option if there are people who don’t really have an alternative. I’m not familiar with the US ISP market well enough.

I certainly agree that a good DNS can work better than a bad DNS, and provide faster name resolution. What I don’t quite get, as I wrote, is the people who not only say they feel some improvement, but who feel drastic improvement. Most people don’t run so many DNS queries as a part of normal computer usage and browsing. A site will load faster once, but then it will be cached by the browser. And the browser cache does work immediately, regardless of how the DNS server is set.
So I wanted to hear from them how a normal browsing session for them looks like. Why is it not a “yes, it’s good” but a “yes, it’s much much better and I feel it all the time” sort of thing?

most public DNS servers suffer the same problems as your ISPs.
Why?
For the ISPs you said it’s not their core competency. I think it should be a part of the basic ISP service, but I can agree many ISPs may not consider it like that.
But public DNS servers? I have a feeling that if someone is providing a DNS server, then their core competency will certainly be DNS. It’s not like they have anything else to focus on. No?

Additionally, no ISPs provide their users with any choice in managing their DNS.
That’s true, and is indeed something ISPs don’t provide. This is why I only asked about the speed issue, not this.

On the other hand, aren’t most people using *dynamic* IPs? A very large majority of people, even? And while dynamic IPs on broadband connections may last a long time, they still do change…

This is also something that should be very seriously considered. Certainly catching requests for known phishing domains, and passing them to the correct one, or to a warning page, is a good thing. But it’s also breaking the DNS protocol, because there is a registered domain, and yet your DNS server will not resolve to it. This is a problem even before you start to consider who makes the decisions, and how mistakes are handled.
It’s worse for trying to correct common typos. Because the typo domain may be registered to someone, in which case just ignoring it at the DNS level, because probably that’s not what the user wanted, is a big deal.
So yes, this is why you make it optional. But DNS is usually a set and forget sort of thing, people may change the DNS address and then leave it alone and forget about it. And then not understand why different computers get them to different sites for the exact same addresses.

Basically, if a DNS server doesn’t resolve names according to the actual registered domains, doesn’t it it breaks DNS as a uniform naming and addressing system?

Most ISPs do a poor job of running DNS. It’s not their core competency and they don’t realize its importance to the user-experience. You’d be surprised at how bad some ISPs like Comcast are at providing DNS. Their caches actually cause more harm than you’d imagine.

Additionally, no ISPs provide their users with any choice in managing their DNS. The fact that we’re faster and more reliable is just the cornerstone of our company. Never before has anyone provided management and control of the DNS from the end-user and end-network perspective.

You have anti-virus software, anti-spam services, etc. but DNS is just a firehose. Not any more. People can claim that DNS can’t fix everything, but it can fix a lot and having insight and intelligence into recursive DNS is important. Issues like phishing, botnets, keyloggers, malware distributers, spamsites and tons of other “crap” all use DNS. Let’s secure the DNS and then move our way up the stack.

And Andrew — most public DNS servers suffer the same problems as your ISPs. I guess we just need to prove it better. :-)

The only caveat would be an ISP who wanted to use OpenDNS and let their users manage the preferences, that’d be an ISP that had a clue.

Oh, and to be totally upfront, Speakeasy actually runs pretty good DNS servers but everyone already knows they are awesome, so no surprise there.

Thanks for the write up Paul and I’m glad you like the service. I’m sorry I didn’t get to meet you last night, I saw your name on the RSVP list for STIRR. Next time…

-david