DNS Providers - Who to trust?

[bbunge]

I know that network security is a moving target and it is important to feel comfortable with the services offered by providers. But, when I read the article about Cloudflare and the mis-issued certificates, I began to question the faith I had put in their DNS service. There are a couple of DNS providers I will not use because of their country associations or their questionable business practice. I also feel it is a good idea to use a DNS provider that filters malware sites and etc.
But what provider to use? Is it better to do my own filtering with a self hosted DNS sink hole? Is it better to use my own recursive DNS server?
The questions keep coming and it gets no easier!

 

[dave14305]

It seems the only answer is to trust none of them and run a local Pi-Hole or AdguardHome instance forwarding to Unbound as a recursive resolver. Then you’re only trusting the curators of the blocking lists used.

EDIT: That said, I gave up on fancy DNS ideas a few years ago. I use a minimal blocking list (Hagezi Multi-light) and forward plain DNS to my ISP DNS servers (Comcast/Xfinity).

 

[OzarkEdge]

I know that network security is a moving target and it is important to feel comfortable with the services offered by providers. But, when I read the article about Cloudflare and the mis-issued certificates, I began to question the faith I had put in their DNS service. There are a couple of DNS providers I will not use because of their country associations or their questionable business practice. I also feel it is a good idea to use a DNS provider that filters malware sites and etc.
But what provider to use? Is it better to do my own filtering with a self hosted DNS sink hole? Is it better to use my own recursive DNS server?
The questions keep coming and it gets no easier!

Me, too.

I want a free, reputable/regulated, public DNS/DoT solution (no account required) that filter ads and malware... I'm not worried about adult content unless it becomes an issue with young guests, so I also want the option to filter adult content.

I want plug and play... like you say, network security is a moving target so I don't want the overhead of maintaining a local solution... plus I want a non-technical solution that can be easily implemented on related home networks that have the typical network admin skill set (not capable and/or not interested/too busy).

There are a couple of DNS providers I will not use because of their country associations or their questionable business practice.

Which ones?

AdGuard has the Russia background... I notice ASUSWRT offers AdGuard as a DNS option, but it doesn't mention malware filtering, just ads. The AdGuard docs are a bit similarly unclear but do imply that their DNS filters malicious sites. So, I remain unsure if AdGuard Public DNS is also filtering malware, and if so, how does it compare.

Given the US is poor about regulating the Internet, particularly big data (now fast becoming big AI), and the EU is at least trying to protect users, I'm not opposed to using non-US providers/software, especially when it is subject to EU oversight. Because of this point, I tend to trust Quad9 DNS the most but I'm not currently using it since it does not block ads. Given that ads are out of control, imo, I tend to view them as also being a malware threat.

I currently use AdGuard Public DNS (94.140.14.14, 94.140.15.15, dns.adguard-dns.com) and ASUSWRT AiProtection. AiProtection has not had any hits here for quite awhile... maybe because of ad blocking!

Perhaps paying for a reputable DNS provider (account required) that does it all will be our ultimate destination.

OE

 

[bbunge]

Which ones?

I am currently using Quad9 and a Pi-Hole with the Steven Black block listfor the DHCP clients. Client with static IP addresses use the router which uses Quad9. That block list may change later in the day depending upon my mood and continually being told to disable the block list.

I have use Cloudflare Security for quite a while. Tested ControlD. Will not use AdGuard, Comodo, Google, Comcast or Level3.

 

[NoLight]

Public DNS malware filters to be tested in 2025

How well do the largest public DNS resolvers that protect you against malware domains perform in June 2025? We put them to the test!

techblog.nexxwave.eu

I use 1.1.1.2 with DoT strict profile, rebind protection, and validate unsigned DNSSEC.