Algo: Consider using harddns over dnscrypt-proxy

Created on 19 Jul 2019  路  3Comments  路  Source: trailofbits/algo

https://github.com/stealth/harddns

It might be smaller and faster than dnscrypt-proxy

picture dguido

Most helpful comment

I'll pile on as well in support of dnscrypt-proxy. In terms of configuration options for customization, ease of use, performance, modern crypto primitive support, and safety (C vs Go), I think it beats the competition hands down. It's also frequently updated with features and maintained by devs who are clearly committed to the project.

picture kfken on 30 Jul 2019
👍3

All 3 comments

Some restrictions currently:

  • doesn't support blacklists
  • no pre-builds available for the supported systems

Benchmark:

  • 2 WireGuard servers (eu-west-1), the first one with dnscrypt-proxy, and the second with harddns
  • 1 WireGuard client (eu-west-1), namebench with 4 servers configured - 8.8.8.8, algo-harddns, algo-dnscrypt, system (provided by Amazon)

Overall dnscrypt-proxy is faster and no additional effort needed to get it running

Benchmark Results:

Fastest individual response (in milliseconds):
SYS-127.0.0.53 ###################### 0.51498
algo-harddns-net ################################### 0.84686
algo-dnscrypt-ne ####################################### 0.94891
Google Public DN ##################################################### 1.29795

Mean response (in milliseconds):
algo-dnscrypt-ne ############ 43.59
Google Public DN #################### 73.97
algo-harddns-net ##################### 77.08
SYS-127.0.0.53 ##################################################### 202.56

Response Distribution Chart for 200ms

Response Distribution Chart for 200ms

Response Distribution Chart Full

Response Distribution Chart Full

Namebench Output

```
namebench 1.3.1 - best source (automatic) on 2019-07-27 09:01:54.410446

threads=40/2 queries=250 runs=1 timeout=3.5 health_timeout=3.75 servers=4

  • Reading Top 2,000 Websites (Alexa): /usr/share/namebench/data/alexa-top-2000-domains.txt (0.7MB)
  • Reading Cache Latency Test (100% hit): /usr/share/namebench/data/cache-hit.txt (0.1MB)
  • Reading Cache Latency Test (100% miss): /usr/share/namebench/data/cache-miss.txt (0.1MB)
  • Reading Cache Latency Test (50% hit, 50% miss): /usr/share/namebench/data/cache-mix.txt (0.1MB)
  • Generating tests from Top 2,000 Websites (Alexa) (33575 records, selecting 250 automatic)

  • Selecting 250 out of 33542 sanitized records (weighted mode).

  • Checking query interception status...

  • Checking connection quality: 1/3...3/3
  • Congestion level is 0.26X (check duration: 10.49ms)
  • Checking latest sanity reference
  • Checking nameserver availability (4 threads): 0/4..4/4
  • 4 of 4 servers are available (duration: 0:00:00.502363)
  • Running initial health checks on 4 servers (4 threads): 0/4

  • SYS-127.0.0.53 [127.0.0.53] failed test #1/7: static.ak.fbcdn.net.: No answer (NXDOMAIN): static.ak.fbcdn.net.

  • Google Public DNS [8.8.8.8] failed test #1/5: static.ak.fbcdn.net.: No answer (NXDOMAIN): static.ak.fbcdn.net.

  • algo-dnscrypt-network [172.29.234.200] failed test #1/5: static.ak.fbcdn.net.: No answer (NXDOMAIN): static.ak.fbcdn.net.
    ..

  • algo-harddns-network [172.16.168.50] failed test #1/5: static.ak.fbcdn.net.: No answer (NXDOMAIN): static.ak.fbcdn.net.
    .4/4
  • 4 of 4 tested name servers are healthy
  • Waiting for wildcard cache queries from 4 servers (4 threads): 0/4..4/4
  • Waiting 4s for TTL's to decrement.
  • Running cache-sharing checks on 4 servers (12 threads): 0/12......12/12
  • Running final health checks on 4 servers (4 threads): 0/4....4/4
  • All nameservers have warning: No answer (NXDOMAIN): static.ak.fbcdn.net. (likely a false positive)
  • All nameservers have warning: www.paypal.com is hijacked: www.glb.paypal.com (likely a false positive)
  • All nameservers have warning: www.facebook.com appears incorrect: star-mini.c10r.facebook.com (likely a false positive)

Final list of nameservers considered:

172.29.234.200 algo-dnscrypt-netw 388 ms | windowsupdate.microsoft.com is hijacked: windowsupdate.redir.update.microsoft.com.nsatc.net, twitter.com appears incorrect: 104.244.42.65, www.google.com is hijacked: 74.125.193.104, 74.125.193.105, 74.125.193.106, 74.125.193.147, 74.125.193.99, 74.125.193.103
8.8.8.8 Google Public DNS 395 ms | twitter.com appears incorrect: 104.244.42.65, 104.244.42.129, windowsupdate.microsoft.com is hijacked: windowsupdate.redir.update.microsoft.com.nsatc.net, www.google.com is hijacked: 74.125.193.99, 74.125.193.147, 74.125.193.103, 74.125.193.104, 74.125.193.106, 74.125.193.105
127.0.0.53 SYS-127.0.0.53 514 ms | twitter.com appears incorrect: 104.244.42.65, 104.244.42.1, windowsupdate.microsoft.com is hijacked: windowsupdate.redir.update.microsoft.com.nsatc.net, www.google.com is hijacked: 74.125.193.106, 74.125.193.147, 74.125.193.99, 74.125.193.103, 74.125.193.104, 74.125.193.105
172.16.168.50 algo-harddns-netwo 1137ms | twitter.com appears incorrect: 104.244.42.193, windowsupdate.microsoft.com is hijacked: redir.update.microsoft.com.nsatc.net, www.google.com is hijacked: 74.125.193.99, 74.125.193.103, 74.125.193.104, 74.125.193.105, 74.125.193.106, 74.125.193.147

  • Sending 250 queries to 4 servers: 0/1000...........................................................................................................202........................................................................................................404..............................................................................................................613..........................................................................................................815................................................................................................1000/1000
  • Error querying SYS-127.0.0.53 [127.0.0.53]: zhidao.baidu.com.: Timeout The DNS operation timed out.
  • Error querying SYS-127.0.0.53 [127.0.0.53]: city.tianya.cn.: Timeout The DNS operation timed out.
  • Error querying SYS-127.0.0.53 [127.0.0.53]: www.orkut.co.in.: Timeout The DNS operation timed out.

Fastest individual response (in milliseconds):

SYS-127.0.0.53 ###################### 0.51498
algo-harddns-net ################################### 0.84686
algo-dnscrypt-ne ####################################### 0.94891
Google Public DN ##################################################### 1.29795

Mean response (in milliseconds):

algo-dnscrypt-ne ############ 43.59
Google Public DN #################### 73.97
algo-harddns-net ##################### 77.08
SYS-127.0.0.53 ##################################################### 202.56

Response Distribution Chart URL (200ms):

http://chart.apis.google.com/chart?cht=lxy&chs=720x415&chxt=x,y&chg=10,20&chxr=0,0,200|1,0,100&chd=t:0,0,1,2,2,5,8,9,11,14,15,17,21,25,29,37,48,63,82,109|0,0,14,19,24,28,32,36,40,44,48,52,55,59,63,66,70,74,77,81|0,1,1,9,10,12,13,13,15,16,18,20,28,82,164|0,0,5,33,40,46,54,60,66,70,78,82,86,89,93|0,0,1,8,9,10,14,18,25,55,131|0,0,37,54,69,75,81,85,88,92,96|0,0,1,3,3,4,9,12,17,22,53,67,116|0,0,14,46,57,62,67,71,75,80,83,87,91&chco=ff9900,1a00ff,ff00e6,80ff00&chxt=x,y,x,y&chxl=2:||Duration+in+ms||3:||%25|&chdl=SYS-127.0.0.53|Google+Public+DNS|algo-dnscrypt-network|algo-harddns-network

Response Distribution Chart URL (Full):

http://chart.apis.google.com/chart?cht=lxy&chs=720x415&chxt=x,y&chg=10,20&chxr=0,0,3500|1,0,100&chd=t:0,0,0,0,0,0,0,1,1,1,1,1,1,1,2,2,3,4,5,6,7,11,18,26,94,100|0,0,14,19,24,28,32,36,40,44,48,52,55,59,63,66,70,74,77,81,84,88,92,95,99,100|0,0,0,1,1,1,1,1,1,1,1,1,2,5,9,17,30|0,0,5,33,40,46,54,60,66,70,78,82,86,89,93,96,100|0,0,0,0,0,1,1,1,1,3,8,17,29|0,0,37,54,69,75,81,85,88,92,96,99,100|0,0,0,0,0,0,0,1,1,1,3,4,7,9,23,57|0,0,14,46,57,62,67,71,75,80,83,87,91,94,98,100&chco=ff9900,1a00ff,ff00e6,80ff00&chxt=x,y,x,y&chxl=2:||Duration+in+ms||3:||%25|&chdl=SYS-127.0.0.53|Google+Public+DNS|algo-dnscrypt-network|algo-harddns-network

Recommended configuration (fastest + nearest):

nameserver 172.29.234.200 # algo-dnscrypt-network
nameserver 127.0.0.53 # SYS-127.0.0.53
nameserver 172.16.168.50 # algo-harddns-network

In this test, algo-dnscrypt-network is 364.7%: Faster

jackivanov picture jackivanov on 27 Jul 2019
👍1

Hi
I'm super satisfied with the current dnscrypt-proxy implementation, which is far better than the previous dnsmasq implementation, especially for ad and tracker blocking. Hopefully the ad/tracker/malware site blocking ability won't be removed, as it enables Algo to be an excellent privacy and security tool.
I'm currently using the following host blacklists:
https://raw.githubusercontent.com/mitchellkrogza/Ultimate.Hosts.Blacklist/master/hosts/hosts0
https://hblock.molinero.dev/hosts
Despite the size of these blacklists, Algo is very responsive.

Please don't remove this ability...

macuser666 picture macuser666 on 30 Jul 2019
👍1

I'll pile on as well in support of dnscrypt-proxy. In terms of configuration options for customization, ease of use, performance, modern crypto primitive support, and safety (C vs Go), I think it beats the competition hands down. It's also frequently updated with features and maintained by devs who are clearly committed to the project.

kfken picture kfken on 30 Jul 2019
👍3
Was this page helpful?
0 / 5 - 0 ratings

Related issues

dguido picture dguido  路  4Comments
jwebbstevens picture jwebbstevens  路  4Comments
mosesrenegade picture mosesrenegade  路  5Comments
dsecareanu picture dsecareanu  路  5Comments
mikaelf picture mikaelf  路  5Comments