Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was told it's a good idea not to use your ISP to resolve DNS, both for privacy issues and because it can be slow. So I wanted to change, but I've read criticism on using OpenDNS (who makes money on your mistyped domains) or Google (privacy).

So I wonder: are there better alternatives? Something with less privacy concerns, maybe a non-profit?

share|improve this question
host file.... :-) – Ormis Oct 16 '11 at 2:26
up vote 5 down vote accepted

Some thoughts:

  • OpenDNS do not make any money from you if you mistype, in fact all that happens is you get sent to an OpenDNS search page. If they get advertising fees from organisations, who cares?
  • Many DNS providers do this, not just OpenDNS
  • I moved to OpenDNS 18 months or so ago and thus far they have been much more stable than my ISP, response is fast, and it just works
share|improve this answer
The one criticism I have of OpenDNS is that they return the IP address of their own webserver instead of the NXDOMAIN response they should return when a domain has no IP. I think they do the same for SERVFAIL. You can "opt-out" of this for any given source IP address (say, your home or your office) but as a sysadmin who deals with DNS every day, this is enough to make me use a different service. – Ladadadada May 29 '12 at 15:17

It's not that hard to set up your own local caching resolver and point it to the root servers. See this question for some pros and cons of running a local cache.

But your DNS traffic is still going to transit your ISP's network, so if it isn't encrypted, you've only helped privacy a little. (They would have to actively sniff now instead of just logging at the DNS resolver.) It's also possible for your ISP to filter DNS requests that aren't going to their server.

share|improve this answer
By privacy it is meant that you have a company record all domains your IP is accessing, so the question is if this company is your ISP or some other, like OpenDNS. Is that right? – Strapakowsky Jun 5 '12 at 14:34

Why do you care if they make money? How would they otherwise pay for that infrastructure?

At any rate duckduckgo has a public DNS plugin - so if you search for it gives you a list before the results.

share|improve this answer

I see nothing wrong with using your ISP's DNS servers.

OK, I guess if your ISP is snoopy, they could see what domain names you are resolving, and thus infer things about what web sites you are visiting and such. But, look, you already have to place a lot of trust in your ISP. If they are snoopy, they could also just spy on all your traffic. So, unless you have some particular reason to believe your ISP is targeting DNS traffic to its own DNS servers especially, I see no particular reason to avoid your ISP's DNS servers.

You could set up your own local caching DNS server, if you want. I don't think it'll make any appreciable difference to your privacy. It might improve performance, if your cache is more effective than your ISP's cache. On the other hand, it is also possible it could hurt performance, because of the increased number of recursive queries that will be triggered.

share|improve this answer

check out and

share|improve this answer
welcome to Information Security, and thanks for the links - can you add some info around those links? Some context, quotes, content, etc instead of just pasting a link. See FAQ and How to Answer. – AviD Oct 15 '11 at 16:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.