I responded to someone in comments on a post that may not get as much visibility, and wanted to share something that might help some others who are newer to this.
I referenced Quad9 DNS as probably one of the best private DNS you can use, Swiss based, no log, no tracking, no data to sell, etc. They also implement DNSSEC, DoH, DoT, QUIC, ECS (which you may or may bot want), malware blocking, content filtering, and maybe something else I’m forgetting.
Many DNS sinkhole apps, OSes, or systems can actually utilize Quad9 for your resolver while those systems also block ads. Below is my functional list of systems that I’m aware of, though I haven’t tested everything. I believe all are considered FOSS, too. If you don’t have a spare Raspberry Pi laying around, try running in HomeAssistant, Yunohost, ZimaOS (previously CasaOS), or others.
DNS sinkhole (Adblocking) apps:
Feel free to comment and add your own I’m maybe not aware of. I’m no software engineer, but I can read through some code, though not an expert, nor have combed through these personally. Usually I’ve tested/run at the recommendation of others over the years before my ban on Reddit (for shitting on AI).
Hope this helps!!
Firefox with uBO behind a pihole pointing to Quad9 and on a router-level VPN is sufficient for 99% of users. And the 1% know exactly who they are and will harden further.
Good point, but if I can help anyone with privacy or security, it’s a good starring point. Maybe a few more will get curious and go further down the rabbit hole lol.
- AdGuard
Adguard’s dnsproxy also works well on its own. And it can very well spare you much of the overhead. Just pick a few dns providers you trust, query them in parallel and add whatever ad-blocking list you want to use locally. All with such on not that complicated command…
Example: dnsproxy --listen=127.0.0.1 --port=53 --bootstrap=9.9.9.9 \
–hosts-file-enabled --hosts-files=/etc/dnsproxy/blocklist \
–upstream=https://unfiltered.joindns4.eu/dns-query --http3 \
–upstream tls://dot.libredns.gr \
–upstream tls://dns3.digitalcourage.de \
–upstream tls://dns.digitale-gesellschaft.ch \
–upstream tls://anycast.uncensoreddns.org \
–upstream=quic://dns10.quad9.net \
–upstream=h3://cloudflare-dns.com/dns-query \
–upstream-mode=parallel \
–cache
Yes, that’s an unreasonable amount of dns’ queried but I just wanted to get a few useful ones listed, also a wide spread from https (http2 and 3), tls and quic.
Regarding your original comment, since it regards DNS censorship, pointing people to Quad9 does not solve anything, as it is not more immune to censorship than others. You want a DNS resolver that cannot be censored as an upstream to Pi-hole and co? Set up unbound
I never understood the point in setting up unbound and pi-hole. Unbound is perfectly able to use all the filter lists you use with pi-hole, so at this point it’s nothing but an additional layer for some fancy webui with stats you never actually look at.
I’m interested as to how you’d setup unbound to use block lists. But I suppose you’d have to set a timer or cron to update them, whereas Pi-Hole does it by itself.
Just pick a blocklist (usually via
curl, coming in a “0.0.0.0 <host>” format), reformat it to “local-zone: <host> always_refuse” (sedis your friend) then add an include-line to the unbound config.And yes, you would need to set some timer to update it from time to time.
PS: I stopped using unbound and went with dnsproxy (see my other comment here) because it was less cumbersome (just a few command line parameters instead of an extensive config) to serve at the same time as my local dns while also providing it via DoQ (and DoH for those stupidly restrictive networks) for me when I’m not at home. Also proper parallel querying is -iirc; I didn’t look at it for quite a while- still missing from unbound and it can work with DoQ upstream but not serve it yet.
