I noticed that Quad 9 is not able to respond to the spy.pet query:

$ dig spy.pet @9.9.9.9 +short
;; communications error to 9.9.9.9#53: timed out

But Cloudflare DNS is able to do it:

$ dig spy.pet @1.1.1.1 +short
104.26.0.165
104.26.1.165
172.67.74.73

And to be sure, I checked another domain with the same TLD to rule out the option that Quad9 is unable to handle the .pet TLD, but I received a correct answer…

$ dig hello.pet @9.9.9.9 +short
3.64.163.50

Does Quad9 censor DNS queries?

  • AmbiguousProps@lemmy.todayEnglish
    4·
    7 months ago

    That is not what they do, though. Just because a non standard configuration is possible doesn’t mean that’s the best thing to use. DNS, by design, uses authoritative nameservers, which is what cloudflare and quad9 host. These authoritative hosts distribute their records to caches (usually just recursive DNS resolvers) to ease and distribute the load. It’s literally in all of their documentation, and explained in pretty plain english on their pages.

    https://www.cloudflare.com/learning/dns/what-is-dns/ https://www.quad9.net/about/

    Much of the Quad9 platform is hosted on infrastructure that supports authoritative DNS for approximately one-fifth of the world’s top-level domains, two root nameservers, and which sees billions of requests per day.

    When a record is updated in your domain (or cloud) provider, it is distributed via an authoritative nameserver hosted by that company. These get distributed to the root name servers, which then distribute the records to other authoritative nameservers.

    I don’t know why you’re arguing over this, when it’s one of the first things you learn in information systems and networking. Sure, there’s a lot of stuff for the infrastructure. But the way DNS works on these hosts is still the same, and blocking a single record is not difficult and does not take extra engineering effort. The authoratative hosts simply change their records and it’s done. DNS takes care of the rest.

    There’s an entire wikipedia page on this: https://en.wikipedia.org/wiki/DNS_blocking

    • TCB13@lemmy.world
      13·
      7 months ago

      The thing is, everything you said is correct. But if you think they can just solve this globally for everyone and everything without delays by just pushing things their root servers or the first line of authoritative ones then what else can I say.

      • AmbiguousProps@lemmy.todayEnglish
        1·
        7 months ago

        They can, because that’s how DNS works. This is why when you update a record for your domain it’s updated globally in near real time with multiple providers. I don’t know how else to tell you that it already works this way. I work in the cloud, and deal with this stuff on a daily basis.

        • lemmyreader@lemmy.mlEnglish
          1·
          7 months ago

          This is why when you update a record for your domain it’s updated globally in near real time with multiple providers.

          Depending on the TTL, right ?

        • TCB13@lemmy.worldEnglish
          13·
          7 months ago

          This is why when you update a record for your domain it’s updated globally in near real time with multiple provider

          So, you know that “near real time” is different from actual real time.

          • AmbiguousProps@lemmy.todayEnglish
            11·
            7 months ago

            You’re clearly going keep nitpicking and changing the subject to things that don’t matter and you’re not willing to learn. Your misunderstanding of the fundamentals of DNS is no longer my issue.

            • TCB13@lemmy.worldEnglish
              12·
              7 months ago

              Okay, so tell me something, in your “ideal world” replication-based only scenario, what happens if they’re ordered to take down a specific A record that has a very large TTL, more than a govt would like?