Upstream DNS provider?

VPN
1

Hello,

I am currently installing a pi-hole for the first time. Just after the installation, the installer ask me to select an upstream DNS provider.

I have found some explanation (https://github.com/pi-hole/pi-hole/wiki/Upstream-DNS-Providers), but it is not really clear what an upstream DNS provider is and what my choice is implying here in term of advertising removal. As I install a Pi-hole as a general movement out of the GAFAM hands, I am quite surprised that google is the default choice.

​

What is an upstream DNS Provider and why do I care ?

What are the long terms consequences of the choice of an Upstream DNS Provider (could they change ? could they block something … ? etc.)

What Upstream DNS do you use ?

What would be your advised DNS Upstream Provider to a noob like me that just want to remove advertising ?

​

​

​

2

Your PiHole doesn’t by default know much about DNS. All it really does is this:

Systems on your network ask it about a domain.

It checks the block list, and of it finds the domain there, blocks the request.

If the domain isn’t on the block list, it goes to your upstream provider and asks them, and passes the response along to your machine.

Google generally provides a fast DNS service that’s reasonably good and relabile and crucially accessible to everyone. Most of the included DNS services are like this.

It is possible that any upstream provider you choose could track you, or issue you bad responses for their own gain. For what it’s worth none of the default providers are known for doing this and I’d choose based on speed.

I think I’m using quad9, as I did a DNS speed test when I set up my pi hole and it came out fastest, that’s it.

A different solution is to use unbound. This is a service that you run alongside pihole that will go directly to the authoritative name server for the domain you request, removing Google and cloudflare and the like from the loop. It’s not a setup I’m using so I can’t comment on how difficult it is to set up, or what the performance is like.

3

Google, Cloudflare, Quad9, Opendns, Level3 … These are upstream dns servers.
Cloudflare’s 1.1.1.1 is fastest dns server and you can use it.
Or the easiest way is Adguards dns server that blocks ads. Set Adguard’s dns server ip as dns1 and dns2 in your routers dhcp/dns settings.

4

For privacy reasons you could be your own upstream provider and query directly from ur machine to the authorityDNS servers with unbound.

5

I use OpenDNS as my upstream resolver, their filtered servers for IP v4 and v6. I want their rapid-response malware blocking and easy to add/remove category blocks (v4 only) if the grand kids are visiting.

v6 addresses: https://support.opendns.com/hc/en-us/articles/227986667-Does-OpenDNS-support-IPv6-

​

Aside from ones that offer response filtering they are pretty much all the same. Some may snoop on your queries, some may be faster for you but for the most part it isn’t a big deal.

6

i prefer to use nextdns as upsteam dns provider. i’ve written a blog about dns provider （国内外DNS推荐列表 | Deep Router）

7

Hi. I’ve set my router to hand out the Pihole IP for DNS as part of DHCP. Pihole then handles the DNS requests. Upstream on the Pihole for me is set to the router IP. So Pihole does the blocking according to the blacklist then hands all other requests back to the router (which I set to whatever external DNS provider I choose).

8

A different solution is to use unbound. This is a service that you run alongside pihole that will go directly to the authoritative name server for the domain you request, removing Google and cloudflare and the like from the loop. It’s not a setup I’m using so I can’t comment on how difficult it is to set up, or what the performance is like.

Performance can be a little slow at first while it caches your queries and then outperforms other DNS providers after its cached your queries

9

What is the difference in unbound and DNS over https?

10

Using with office and home lan, works very smooth and very easy to setup ( following the pihole guide ). Definitely recommended duo with pihole

11

ok. What is the advantage of that cmpared to others solutions ?
How would I achive that ?

12

This started using it today after being the fastest in my location. Working well.

13

Caching isn’t permanent and doesn’t last long since many sites use low TTL these days in case an IP address changes.

14

I’ve been redoing a lot of my home network recently. I’ve actually got my pi-hole currently turned off, as ive been trying a new router and getting IPv6 working, and I like to start with a small number of moving parts and work my way up.

​

I’m not sure whether I’m going to run Unbound, or DNSoHTTPS yet. But I’m very keen to try Unbound.

15

Advantage? Not sure, just that this works for my set up.

16

I used pfsense as a router so I set up DHCP to hand out the IP of the Pihole (or in my case Piholes - I have 2) for the DNS for all connected devices. If I want to exclude a device I set up a static assignment for that device (via the MAC address) and specify a different DNS i.e. Google, Cloudflare etc. End result is all devices are sent to to the Pihole unless I choose to exclude one and send it external without ad blocking.

​

​

17

You will find that TTL’s for unbound are typically quite a bit longer than what is provided by a commercial upstream resolver. Examples:

dig bloomberg.com through the following and get the following TTL’s:

unbound - 3600
1.1.1.1 - 418
8.8.8.8 - 428
9.9.9.9 - 600