OpenDNS

[JAS]

Is there any advantage to using OpenDNS on a Windows XP PRO computer. I
see it mentioned at times and have wondered if it was worth a try. I use
my ISP DNS that is changed off and on every few days.

JAS

 

[Mayayana]

| Is there any advantage to using OpenDNS on a Windows XP PRO computer. I
| see it mentioned at times and have wondered if it was worth a try. I use
| my ISP DNS that is changed off and on every few days.
|

My understanding is that OpenDNS is just supposed to
be an honest operation, while an increasing number of
ISPs are doing things like showing an ad instead of a
404 page. If you use your ISP DNS that also reports
all of your destinations to them.

I've been using AcrylicDNS, which defaults to OpenDNS
but can use any service. AcrylicDNS is a proxy. It runs as
a service. I like it because it has its own HOSTS file that
allows me to use wildcards. For instance, I can block
*.doubleclick.net. I don't have to list all possible subdomains.

One caveat, though: AcrylicDNS is slightly buggy. Every
few weeks the service fails to start and I have to reinstall
it. That only takes a minute, but still...

Other options: If you don't care about privacy with your
ISP you can research other DNS servers. There are sites
online that report the speed of various servers.

 

[VanguardLH]

...


My understanding is that OpenDNS is just supposed to be an honest
operation, while an increasing number of ISPs are doing things like
showing an ad instead of a 404 page. If you use your ISP DNS that
also reports all of your destinations to them.

Wrong. OpenDNS also corrupts DNS by not reporting failures and instead
redirects you to their "help" (ad/search) page.

Unless you create an account at OpenDNS, and unless you install their
DNS client on your host (so it can connect to your online account to
update it so your online account knows your current IP address to apply
your settings), you will get a "help" page on failed DNS lookups at
OpenDNS. Only if you have an account can you configure OpenDNS not to
show its ad/search page on failed DNS lookups; however, you lose other
features if you disable their ad/search interception on DNS fail, like
letting you select categories of sites to block and your own
personalized list of domains to block (max of 50 but you can block on
domains instead of hosts which is what the hosts file does).

If you don't have an account and just use their DNS service, they will
shove their ad/search page to your web browser instead of issuing the
DNS fail. If you do have an account (which requires their DNS client
installed on your host) but configure it to disable their ad/search page
on DNS failure then you also disable other features in that account.
Because they're showing you a page means the lookup did not fail and why
this behavior screws up some programs that expect to actually get an
error if the page actually specified cannot be reached.

My ISP (Comcast) also decided to provide this, um, "help" page on a DNS
failure; however, upon request (which you have to do via chat or phone
call, not as an online configurable option) you can have them disable it
for your account which I did.

Comodo DNS and Symantec's (Norton) DNS also shove this "help"
(ad/search) page to your web browser on a DNS fail. My ISP (Comcast)
does not only because I requested them to remove their "helper" service.
Google does not so I'm using them (with fallback to my ISP's DNS server
by configuring TCP/IP to first use Google DNS and have my ISP DNS listed
second). You can easily see which of the big DNS providers are screwing
up the DNS fail (by not failing and instead sending their "help" page)
by getting Steve Gibson's DNS Benchmark utility:
https://www.grc.com/dns/benchmark.htm. It does not require
installation. Just download and run.

It will show which of the pre-defined DNS servers (and any that you add)
are corrupting the DNS fail by not failing and showing you their "help"
page. The following were shown by the benchmark tool in brown where
"Bad domain names are intercepted by provider", which were: OpenDNS,
UltraDNS, Cox, Sunbelt ThreatTrack, and AnyCast. Although the tool
comes with (downloads) its own preset list of DNS servers, you can add
more DNS servers. Typically I delete a ton of them from the preset list
since I'll never use them so I can just focus on the candidates.

Alas, probably to keep his program small, you have to visit the web page
(https://www.grc.com/dns/operation.htm) to understand the meaning of the
various icons, like colors and what means a partial or whole circle.

I've been using AcrylicDNS, which defaults to OpenDNS but can use any
service. AcrylicDNS is a proxy. It runs as a service.

If you are not getting the "help" page on DNS fails with Acrylic, and if
they are using OpenDNS, then they have a special or business account
with OpenDNS to avoid corrupting the DNS operation (by showing a web
page and DNS succeed when it should've been a DNS fail), or they
configured their OpenDNS account to disable the "help" redirection which
may lose the other features at OpenDNS but then Acrylic replaces some
with their own features (you don't mention if Acrylic also provides
domain blocking by category, like hate, sex, alcohol, gambling, as is
available at OpenDNS).

I like it because it has its own HOSTS file that allows me to use
wildcards. For instance, I can block *.doubleclick.net. I don't have
to list all possible subdomains.

So it is not a hosts file. A hosts file can only block on hostnames
(host.domain.tld). That's why, for example, in the pre-compiled hosts
file, like from MVPS, there are over 50 entries just for Doubleclick.
Plus a nameserver can respond to any host to reply with an IP address to
ensure you will visit their page there which obviates the hosts file
because you'll never be able to define every possible hostname that
could be used.

What you describe is a URL block filter (not by IP address which is
pretty much worthless to end users but a URL string filter). Avast
anti-virus has one. OpenDNS lets you define up to 50 URLs in a free
account.

One caveat, though: AcrylicDNS is slightly buggy. Every few weeks the
service fails to start and I have to reinstall it. That only takes a
minute, but still...

Don't you have your TCP/IP setup regarding DNS specify multiple DNS
servers? If one cannot be reached then the next gets used. Or are you
stuck with all DNS requests going through the Acrylic service?

Sounds like you'd be smarter to use a local security utility
(anti-virus, firewall) that has its own URL filtering and specify
OpenDNS (unless you want one that does NOT corrupt DNS with their
redirection to a "helper" page) as your primary DNS server and your ISP
as your secondary DNS server in your TCP config.

Other options: If you don't care about privacy with your ISP you can
research other DNS servers. There are sites online that report the
speed of various servers.

Besides showing you which DNS servers are corrupting DNS with their
redirection to a "help" page (i.e., they NEVER report a failed DNS
lookup), the GRC benchmark tool can also indicate which DNS servers are
better than other; however, you need to do this test over many days to
get an idea of which is faster since a single test at just one time of
the day won't tell you how they respond to load over time. Go to the
Nameservers tab and click on the "Run benchmark" button. It's free and
doesn't install (just run it).

 

[Jon Danniken]

My ISP (Comcast) also decided to provide this, um, "help" page on a DNS
failure; however, upon request (which you have to do via chat or phone
call, not as an online configurable option) you can have them disable it
for your account which I did.

Interesting; when I had Comcast several years ago, I was able to just
enter a different IP to get regular (non "value added") DNS. My current
IP, Centurylink, also has this feature, so I just enter the "standard"
IP to get regular DNS.


Jon

 

[VanguardLH]

Interesting; when I had Comcast several years ago, I was able to just
enter a different IP to get regular (non "value added") DNS.

That meant you had to find an IP address for a DNS server different than
the one notified via DHCP. Comcast needs to distribute their load
across many DNS servers so they have their regional hubs assign
different DNS servers to that region. They really don't want all their
users slamming their main DNS server (I forgot its geographic location).
For you to pick a different DNS server than what their regional DHCP
server wants to assign to you means you are fouling up albeit miniscule
their load balancing.

My current IP, Centurylink, also has this feature, so I just enter the
"standard" IP to get regular DNS.

They called their dns fail redirection "Domain Helper".

http://dns.comcast.net/index.php/help

They say back in January 2012 that they were forced to discontinue their
redirection when they implement DNSSEC. That is, they could no longer
lie about a DNS fail. See:

http://dns.comcast.net/index.php/help#faq2

OpenDNS adopted DNSCurve instead of DNSSEC with their own excuses; see
http://blog.opendns.com/2010/02/23/opendns-dnscurve/. That lets them
continue their practice of redirection on their users for what should've
be a DNS fail and instead give then a DNS succeed but to a destination
other than what the client specified. OpenDNS wants to continue
collecting revenue on the hits from search results. Besides my ISP
(Comcast), the Google's DNS service also uses DNSSEC; see
https://developers.google.com/speed/public-dns/faq. From what I've read
so far, a DNS service that employs DNSSEC cannot do this redirection
lying to the client regarding DNS failures. I'm sure Google didn't
support DNSSEC the moment they announced availability of their publicly
accessible DNS servers; however, from the start they didn't lie to
clients by redirecting them to an inaccurate list (i.e., search page).

I looked at the DNS servers that my regional Comcast DHCP server told my
router to use, which were:

DNS1: 75.75.76.76
DNS2: 75.75.75.75

When I added those to GRC's DNS benchmark tool and had it test these DNS
servers for features and speeds, they tested okay. That is, they did
not redirect to a helper page.

"Domain Helper Service: Here to Help You"
http://corporate.comcast.com/comcast-voices/domain-helper-service-here-to-help-you

That is dated back in 2009. The instant they announced it via e-mail
notification to their customers was when I called in to have them
disable this "feature". So back in 2009 I had Comcast disable their
redirect on DNS fail. Eventually they had to drop it, anyway, because
DNSSEC won't allow this false response. So that they had to drop the
redirection was transparent to me because I had earlier already disabled
the redirection.

They provided a link to the following IETF article that describes
(belatedly) what ISPs and DNS services were doing with redirection on
DNS fails. The first I heard of this was a decade ago when Verisign
screwed up the .com lookups by redirecting to their site helper page;
see http://en.wikipedia.org/wiki/Verisign#2003_Site_Finder_legal_case.
This infuriated the network community, especially corporate entities and
other Internet providers, because recovery was based on getting a bad
status on a failed DNS lookup. This redirection returned a good status
but on a different site than was originally specified; i.e., they lied.

Eventually other DNS services, like Open DNS, started to add their own
helper redirection on DNS fail. ISPs started adding it. They thought
they were providing a helpful service to their customers. Guess they
don't know how search engines work. Any entity can strive to get
keywords elevated in the search engines so a user searching on companyA
would instead up see search results for companyB and going there
instead. A search page is hardly an accurate reference for finding the
domain that was inititally attempted for the destination. As with
Firefox that gains revenue from defaulting to Google as its online
search engine, these "helper" redirection pages also generated revenue
to the DNS service that showed the "helper" search page.

 

[Mayayana]

| Wrong. OpenDNS also corrupts DNS by not reporting failures and instead
| redirects you to their "help" (ad/search) page.
|
I see you're right. That's odd, because it was directing
me to a blank page at something like websitedoesntexist.com
before, but now it's trying to send me to openDNS. I used
to use Level3, which doesn't hijack 404s, but I wondered about
tracking from them.

|
| > I've been using AcrylicDNS, which defaults to OpenDNS but can use any
| > service. AcrylicDNS is a proxy. It runs as a service.
|
|
| > I like it because it has its own HOSTS file that allows me to use
| > wildcards. For instance, I can block *.doubleclick.net. I don't have
| > to list all possible subdomains.
|
| So it is not a hosts file. A hosts file can only block on hostnames
| (host.domain.tld).

It is a HOSTS file, but it's not *the* HOSTS file. The way it
works is that AcrylicDNS acts as a proxy DNS server. One
sets the DNS IP to 127.0.0.1 and then Acrylic can be set to
use any DNS server one wants. It just defaults to OpenDNS.
The functionality of a HOSTS file works the same way, but
the Acrylic HOSTS file allows wildcards.

| > One caveat, though: AcrylicDNS is slightly buggy. Every few weeks the
| > service fails to start and I have to reinstall it. That only takes a
| > minute, but still...
|
| Don't you have your TCP/IP setup regarding DNS specify multiple DNS
| servers? If one cannot be reached then the next gets used. Or are you
| stuck with all DNS requests going through the Acrylic service?
|

Explained above.

 

[JAS]

| Wrong. OpenDNS also corrupts DNS by not reporting failures and instead
| redirects you to their "help" (ad/search) page.
|
I see you're right. That's odd, because it was directing
me to a blank page at something like websitedoesntexist.com
before, but now it's trying to send me to openDNS. I used
to use Level3, which doesn't hijack 404s, but I wondered about
tracking from them.

|
| > I've been using AcrylicDNS, which defaults to OpenDNS but can use any
| > service. AcrylicDNS is a proxy. It runs as a service.
|
|
| > I like it because it has its own HOSTS file that allows me to use
| > wildcards. For instance, I can block *.doubleclick.net. I don't have
| > to list all possible subdomains.
|
| So it is not a hosts file. A hosts file can only block on hostnames
| (host.domain.tld).

It is a HOSTS file, but it's not *the* HOSTS file. The way it
works is that AcrylicDNS acts as a proxy DNS server. One
sets the DNS IP to 127.0.0.1 and then Acrylic can be set to
use any DNS server one wants. It just defaults to OpenDNS.
The functionality of a HOSTS file works the same way, but
the Acrylic HOSTS file allows wildcards.

| > One caveat, though: AcrylicDNS is slightly buggy. Every few weeks the
| > service fails to start and I have to reinstall it. That only takes a
| > minute, but still...
|
| Don't you have your TCP/IP setup regarding DNS specify multiple DNS
| servers? If one cannot be reached then the next gets used. Or are you
| stuck with all DNS requests going through the Acrylic service?
|

Explained above.

Thanks to everyone for their input. My connection to eternal-sept has
been unavailable but is now back. I may give it a try but now I
understand it more. I know that when I first tried to use it it disabled
my Spyware Blaster,I think. I had installed their update service. I
uninstalled and went back to my ISP's DNS.

JAS

 

[VanguardLH]

Thanks to everyone for their input. My connection to eternal-sept has
been unavailable but is now back.

ES has been having server problems. One died so he moved to another.
He has had problems working with his webhoster, too. You can see his
report in a reply he made to the "Thank you, Ray" thread in the
eternal-september.support newsgroup.

Over the last couple of weeks, ES has had about 4 outages (that I've
experience so there may be more). Often they are corrected in a 4-6
hours but sometimes much longer (because, I'm sure, he has a life
outside of Usenet and needs to sleep, too). He also has problems
keeping his web site up or responsive. In the past, ES has had outages
and they seem to come in bunches. I decided I wasn't going to wait this
time and get hit by more outages so I moved back to Albasani.

I may give it a try but now I understand it more. I know that when I
first tried to use it it disabled my Spyware Blaster,I think.

You don't need to install anything to use OpenDNS, Comodo DNS, Norton
DNS, Google DNS, or any public DNS service. You just configure your
TCP/IP in your OS to point at their DNS server instead of get whatever
one your ISP's DHCP server assigns to you. No software is involved.
There is no way that just using their DNS server caused any problem with
SpywareBlaster or other software on your host.

I had installed their update service. I uninstalled and went back to
my ISP's DNS.

You only need to install their DNS updater client (or another that lets
you specify OpenDNS) if you want to eliminate them redirecting you to
their ad/search "helper" page on what would normally be a DNS lookup
failure. Because they redirect to an existing and reachable page means
you don't get a DNS fail but instead a DNS success. If you use their
DNS service (no client needed) then you get blessed with their redirect
to helper page on DNS fails.

Only if you want to create an account with OpenDNS to make use of its
configuration options do you need either their DNS updater client
(because you are assigned a dynamic IP address by your ISP) or you have
a static IP address (from your ISP) so you only have to specify it once
in your OpenDNS account. They need to know what is your current IP
address so they can associate your account's settings with a current
connection to their DNS server; else, they have no way to know which
settings to apply to your connection to them.

By either using their DNS updater client (that will notify them what is
your current IP address) or telling them what is your static IP address,
they can apply the settings in your account, like domain blocking in
your own list (up to 50 in a free account), what categories of web sites
you want to block, and who is mentioned in the block page sent to you or
your family as a contact regarding the block (i.e., you can identify
yourself and contact info if someone wants to request a change in
category or URL blocking). Of course, if you're going to use OpenDNS
for blocking categories of sites to protect your family then you need to
configure your router to use OpenDNS and not your PCs (since the kids or
anyone with physical access to the PCs can change their TCP/IP config).

If you have an account at OpenDNS and use their updater client (or
specify a static IP address), you can disable the redirect "helper" page
they show on what should've been a DNS fail. Alas, they disable other
features to punish you if you disable their redirection on DNS fail.
This is for their free account. I've never had a paid account to know
if they allow disabling DNS fail redirection while retaining use of all
the other features.

So you can use OpenDNS just like you can use Google DNS, Comodo DNS,
Norton DNS, UltraDNS, and other DNS providers that have public DNS
servers: just configure your TCP/IP settings to use their DNS server(s).
I specify their primary DNS server as my primary but specify my ISP as
my secondary for fallback. You don't need any software to do it that
way. You get whatever default features that DNS provider decides to
include in their service, like redirection to a helper page on what
would've been a DNS fail. Google DNS doesn't have redirection (didn't
have it before they used DNSSEC and can't have it after employing
DNSSEC). If your ISP has also moved to DNSSEC then they can't employ
redirection, either. With OpenDNS, and if you want their other features
(block by category, block by URL string you specify, etc) only then do
you need an account at OpenDNS along with installing their updater
client.

 

[JAS]

ES has been having server problems. One died so he moved to another.
He has had problems working with his webhoster, too. You can see his
report in a reply he made to the "Thank you, Ray" thread in the
eternal-september.support newsgroup.

Over the last couple of weeks, ES has had about 4 outages (that I've
experience so there may be more). Often they are corrected in a 4-6
hours but sometimes much longer (because, I'm sure, he has a life
outside of Usenet and needs to sleep, too). He also has problems
keeping his web site up or responsive. In the past, ES has had outages
and they seem to come in bunches. I decided I wasn't going to wait this
time and get hit by more outages so I moved back to Albasani.


You don't need to install anything to use OpenDNS, Comodo DNS, Norton
DNS, Google DNS, or any public DNS service. You just configure your
TCP/IP in your OS to point at their DNS server instead of get whatever
one your ISP's DHCP server assigns to you. No software is involved.
There is no way that just using their DNS server caused any problem with
SpywareBlaster or other software on your host.


You only need to install their DNS updater client (or another that lets
you specify OpenDNS) if you want to eliminate them redirecting you to
their ad/search "helper" page on what would normally be a DNS lookup
failure. Because they redirect to an existing and reachable page means
you don't get a DNS fail but instead a DNS success. If you use their
DNS service (no client needed) then you get blessed with their redirect
to helper page on DNS fails.

Only if you want to create an account with OpenDNS to make use of its
configuration options do you need either their DNS updater client
(because you are assigned a dynamic IP address by your ISP) or you have
a static IP address (from your ISP) so you only have to specify it once
in your OpenDNS account. They need to know what is your current IP
address so they can associate your account's settings with a current
connection to their DNS server; else, they have no way to know which
settings to apply to your connection to them.

By either using their DNS updater client (that will notify them what is
your current IP address) or telling them what is your static IP address,
they can apply the settings in your account, like domain blocking in
your own list (up to 50 in a free account), what categories of web sites
you want to block, and who is mentioned in the block page sent to you or
your family as a contact regarding the block (i.e., you can identify
yourself and contact info if someone wants to request a change in
category or URL blocking). Of course, if you're going to use OpenDNS
for blocking categories of sites to protect your family then you need to
configure your router to use OpenDNS and not your PCs (since the kids or
anyone with physical access to the PCs can change their TCP/IP config).

If you have an account at OpenDNS and use their updater client (or
specify a static IP address), you can disable the redirect "helper" page
they show on what should've been a DNS fail. Alas, they disable other
features to punish you if you disable their redirection on DNS fail.
This is for their free account. I've never had a paid account to know
if they allow disabling DNS fail redirection while retaining use of all
the other features.

So you can use OpenDNS just like you can use Google DNS, Comodo DNS,
Norton DNS, UltraDNS, and other DNS providers that have public DNS
servers: just configure your TCP/IP settings to use their DNS server(s).
I specify their primary DNS server as my primary but specify my ISP as
my secondary for fallback. You don't need any software to do it that
way. You get whatever default features that DNS provider decides to
include in their service, like redirection to a helper page on what
would've been a DNS fail. Google DNS doesn't have redirection (didn't
have it before they used DNSSEC and can't have it after employing
DNSSEC). If your ISP has also moved to DNSSEC then they can't employ
redirection, either. With OpenDNS, and if you want their other features
(block by category, block by URL string you specify, etc) only then do
you need an account at OpenDNS along with installing their updater
client.

Thanks for the explanation, it has cleared up alot for me.