Why is no one using Quad9 instead of Cloudfare?

Why is no one using Quad9 instead of Cloudfare?
from LavenderBreton@lemmy.zip to privacy@lemmy.ml on 12 Aug 22:48
https://lemmy.zip/post/69593825

Seems a little odd that the fediverse uses Cloudfare.

#privacy

threaded - newest

warmaster@lemmy.world on 12 Aug 23:14 next collapse

Is Q9 as easy to use?

Admirable_Bagel_0989@lemmy.ml on 12 Aug 23:55 collapse

Yes, quad9 is a DNS provider, meaning the way to configure quad9 as your DNS provider is the same as configuring cloudflare but instead of 1.1.1.1 it’s 9.9.9.9 (hence the name quad9)

edit: if you’re using android or a browser (or really anything that uses DNS over https), the URLs are different, but you can find more info at quad9.net

SnotFlickerman@lemmy.blahaj.zone on 12 Aug 23:20 next collapse

…for what, specifically?

Monkey@piefed.social on 12 Aug 23:35 collapse

I think they mean Cloudflare captcha but I don’t know that Quad9 has something like that

Sanctus@anarchist.nexus on 12 Aug 23:23 next collapse

I use it for dns

DarkCloud@lemmy.world on 12 Aug 23:34 next collapse

Four 9s? How is anyone going to remember that?

pixeldaemon@sh.itjust.works on 12 Aug 23:45 next collapse

Quad9 for Quadruple Nine

WhoIzDisIz@lemmy.today on 13 Aug 01:41 collapse

Zoom. (Or whoosh.)

hneerqe@lemmy.world on 13 Aug 13:56 collapse

it’s 1 more after 8! Is there no mercy?

xxxb@feddit.org on 14 Aug 21:36 collapse

r/unexpectedfactorial and before you tell me: I know that this is not reddit. But 8! is a very large number and you probably didn’t mean it like that.

unitedwithme@lemmy.today on 13 Aug 01:54 next collapse

IPv4:

9.9.9.9
149.112.112.112

IPv6:

2620:fe::fe
2620:fe::9

All from memory lol. I set it up a lot for people at home and businesses. That’s for DNSSEC, filtered, non ECS.

Edit: you can also use dns.quad9.net/dns-query for mobile iirc.

adarza@lemmy.ca on 19 Aug 18:58 collapse

same. but i also use mullvad because it adds to encrypted dns (doh or dot only), several levels of filtering to choose from. this allows you to have some basic (can’t edit filter lists yourself) ‘pi-hole’ functionality without having to have a pi-hole available.

ohshit604@lemmy.halstead.host on 12 Aug 23:40 next collapse

Seems a little odd that the fediverse uses Cloudfare.

You need to be more descriptive, use in what regard? Both are capable DNS providers but as far as I’m aware, Cloudflare is also a domain registrar.

Also each instance of Lemmy is configured differently, perhaps Lemmy.zip uses cloudflare but that isn’t the case for every instance of Lemmy.

4am@lemmy.zip on 13 Aug 02:13 collapse

Yeah the mentioned capcha features of CloudFlare are a reverse proxy & caching CDN they provide; Quad9 is a DNS resolver only AFAIK.

Cloudflare also provides DNS resolving, but this isn’t something that a fediverse instance can put between itself and the user (that’s DNS hosting, which would probably be set up in connection with the aforementioned reverse proxy and CDN services)

Some folks are commenting here that they have had Quad9 issues with reliability; if true that’s a recent occurrence as I used them for years as a resolver without issue (been using my ISP as a DNS resolver for about 2 years now as I’ve moved and haven’t had the ability to set up my old servers in my new location. Soon, I hope!)

Brujones@lemmy.world on 12 Aug 23:43 next collapse

I’ve never been able to chase it down, but Apple devices on my network always seem to have issues accessing some sites when using quad 9 for DNS. No problems with cloudflare, though. 🤷‍♂️

twkm@programming.dev on 13 Aug 01:01 collapse

1.1.1.1 does no filtering. 9.9.9.9 does, similar to 1.1.1.2. To skip filtering use 9.9.9.10.

Brujones@lemmy.world on 13 Aug 02:25 collapse

Thanks! I’ll give that a shot. I didn’t do much troubleshooting because other devices could access those sites just fine using 9.9.9.9, so I figured it was something weird in Apple’s system.

yaroto98@lemmy.world on 13 Aug 00:59 next collapse

I use it as my upstream DNS setup on my two piholes.

veniasilente@lemmy.dbzer0.com on 13 Aug 01:30 next collapse

A lot of fediverse instances for some weird reason use Cloudflare for captchas and espionage. I assume it’s a sort of “genre-blind” offloading hardware work moment, if not something like being Class Traitors, because one of the big reasons people come to the Fediverse is precisely to escape the grip and decision power of giants like CF.

zombiebikini@lemmy.zip on 13 Aug 05:15 collapse

I guess if you have to defend against DDOS attacks going big is the only way.

moldy_rice@piefed.keyboardvagabond.com on 13 Aug 14:17 next collapse

It’s not.

zombiebikini@lemmy.zip on 13 Aug 15:26 collapse

Care to elaborate?

moldy_rice@piefed.keyboardvagabond.com on 14 Aug 02:07 collapse

There’s loads of DDoS alternatives.

It’s a national security threat to give your httpa private keys to a US company. As a result, loads of alternatives exist for real DDoS attacks.

But also, almost any nonprofit social media site can just get away with a self hosted pow solution.

zombiebikini@lemmy.zip on 14 Aug 05:46 collapse

Ok, seems we have different ideas of what a real ddos attack is. I was thinking level 3 attacks.

melroy@kbin.melroy.org on 13 Aug 14:26 collapse

No, that is why I created https://angieguardian.org

ohshit604@lemmy.halstead.host on 13 Aug 15:21 next collapse

Yeah something ain’t right here chief. Now I have to ask, what was the LLM policy in regards to the development of this software?

melroy@kbin.melroy.org on 13 Aug 18:24 collapse

Uhm that is interesting. Are you using a VPN or some browser without cookie support maybe? I would like to debug this specific issue.

I'm using let's encrypt certificates. Please I would really like to debug this problem, I can't reproduce it.

ohshit604@lemmy.halstead.host on 13 Aug 19:26 collapse

iPhone > Safari webkit > WireGuard tunnel home network > PiHole DNS (Quad9 upstream) > WireGuard tunnel ProtonVPN endpoint

That is the flow of my current network.

Edit: I ran curl from my server

┌─[user@debian] - [~/compose] - [Thu Aug 13, 12:26]
└─[$]> curl -v https://angieguardian.org/
* Host angieguardian.org:443 was resolved.
* IPv6: (none)
* IPv4: 77.61.56.117
*   Trying 77.61.56.117:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* Recv failure: Connection reset by peer
* TLS connect error: error:00000000:lib(0)::reason(0)
* OpenSSL SSL_connect: Connection reset by peer in connection to angieguardian.org:443 
* closing connection #0
curl: (35) Recv failure: Connection reset by peer

┌─[user@debian] - [~/compose] - [Thu Aug 13, 12:27]
└─[$]> curl -v angieguardian.org 
* Host angieguardian.org:80 was resolved.
* IPv6: (none)
* IPv4: 77.61.56.117
*   Trying 77.61.56.117:80...
* Connected to angieguardian.org (77.61.56.117) port 80
* using HTTP/1.x
> GET / HTTP/1.1
> Host: angieguardian.org
> User-Agent: curl/8.14.1
> Accept: */*
> 
* Request completely sent off
* Recv failure: Connection reset by peer
* closing connection #0
curl: (56) Recv failure: Connection reset by peer

Can confirm my PiHole is resolving the requests and forwarding the requests to Quad9.

melroy@kbin.melroy.org on 13 Aug 20:24 collapse

wow. uh okey, quite a complex setup. But in this specific case it's not even reaching Angie Guardian.. Let alone Angie/Nginx.. It fails clearly at TLS handshaking and the non-TLS is unclear why it fails.

Here is an example if what I would have expected using curl via httpS:

curl -v https://angieguardian.org/
* Host angieguardian.org:443 was resolved.
* IPv6: (none)
* IPv4: 77.61.56.117
*   Trying 77.61.56.117:443...
* Connected to angieguardian.org (77.61.56.117) port 443
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519 / id-ecPublicKey
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=angieguardian.org
*  start date: Jul 25 12:33:40 2026 GMT
*  expire date: Oct 23 12:33:39 2026 GMT
*  subjectAltName: host "angieguardian.org" matched cert's "angieguardian.org"
*  issuer: C=US; O=Let's Encrypt; CN=YE2
*  SSL certificate verify ok.
*   Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 2: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 3: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://angieguardian.org/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: angieguardian.org]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.5.0]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: angieguardian.org
> User-Agent: curl/8.5.0
> Accept: */*
> 
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
< HTTP/2 403 
< server: Angie
< date: Thu, 13 Aug 2026 20:17:31 GMT
< content-type: text/plain; charset=utf-8
< content-length: 93
< cache-control: no-store
< referrer-policy: no-referrer
< x-content-type-options: nosniff
< content-security-policy: default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; worker-src blob:; connect-src 'self'; base-uri 'none'
< 
proof-of-work challenge requires a document navigation: Accept must list text/html or text/*
* Connection #0 to host angieguardian.org left intact

But your non SSL is maybe even more interesting.. since that is also failing (port 80 has NO angie guardian protection btw), here I would expected the following:

curl -v http://angieguardian.org/
* Host angieguardian.org:80 was resolved.
* IPv6: (none)
* IPv4: 77.61.56.117
*   Trying 77.61.56.117:80...
* Connected to angieguardian.org (77.61.56.117) port 80
> GET / HTTP/1.1
> Host: angieguardian.org
> User-Agent: curl/8.5.0
> Accept: */*
> 
< HTTP/1.1 301 Moved Permanently
< Server: Angie
< Date: Thu, 13 Aug 2026 20:22:16 GMT
< Content-Type: text/html
< Content-Length: 205
< Connection: keep-alive
< Location: https://angieguardian.org/
< 
<html>
<title>301 Moved Permanently</title>
<style>html{color-scheme:light dark;}</style>
</head>
<body>
<center><h1>301 Moved Permanently</h1></center>
<hr><center>Angie</center>
</body>
</html>
* Connection #0 to host angieguardian.org left intact

TDLR; clearly something else goes wrong with this setup.

zombiebikini@lemmy.zip on 13 Aug 15:30 collapse

But this only covers layer 7, doesn’t it?

melroy@kbin.melroy.org on 13 Aug 18:27 collapse

That is right. I tried to be transparent what is it NOT: https://angieguardian.org/guide/threat-model#what-guardian-does-not-defend-against

normonator@lemmy.ml on 13 Aug 01:57 next collapse

I used to use quad 9 but stopped using it after running into too many issues where it provided completely wrong results. Like not even outdated results just straight up wrong values that never existed, with both public websites as well as customer dns entries that I have managed for over a decade.

irotsoma@piefed.blahaj.zone on 13 Aug 04:57 next collapse

That’s odd, never had that issue and I’ve used it a long time. Even for my own domains changes propagate as quickly as any other DNS server I’ve used. Were your changes propagated to google, cloud flare, and the rest? Anyway, very weird since DNS propagation is pretty automated usually unless something is not propagating to any DNS server.

normonator@lemmy.ml on 13 Aug 21:23 collapse

Everything else has correct results except for them. Some of the entries were years since being changed, then all of a sudden pointed elsewhere. Quick to troubleshoot but quite annoying.

I haven’t used them since. Troubleshooting that kind of shit is not what I want to be spending my time on.

MonkderVierte@lemmy.zip on 13 Aug 09:17 collapse

What, cloudflare is a registrar?

Agent641@lemmy.world on 13 Aug 15:40 next collapse

Registrar, nameserver, hosting provider, reverse proxy, authentication provider, they do lots of things now.

normonator@lemmy.ml on 13 Aug 21:14 collapse

Yes but I wasn’t using CloudFlare at all. The domains were registered with Tucows and only quad9 had incorrect DNS lookups.

irotsoma@piefed.blahaj.zone on 13 Aug 04:54 next collapse

Quad9 is only a DNS server and I do use that for all of my servers as do many others. It doesn’t provide domain registration, domain dns configuration, proxies, tunnels, etc, that Cloudflare does.

Undertaker@feddit.org on 13 Aug 05:00 next collapse

I don’t think, that many people use Cloudflare. Why not Quad9? There are Vetter options

[deleted] on 13 Aug 07:31 next collapse

sudoer777@lemmy.ml on 14 Aug 06:41 next collapse

IDK but Cloudflare has an ODoH endpoint

Eggman@thelemmy.club on 14 Aug 23:49 next collapse

Cloudfare have many service a dns resolver is one of them. Quad9 only provide a dns resolver. When you visit a website and see Cloudfare thats has nothing to do with their dns resolver that is a complitly different service they provide to protect against ddos attacks.

Zoma@sh.itjust.works on 16 Aug 02:27 next collapse

Used to use it buts it doesn’t feel a good idea to change your vpn’s default dns

ratatouille@feddit.org on 17 Aug 19:32 next collapse

I had several cases where suddenly Websites not work. after a lot of tests. I was only able to solve it because I changed the DNS back to the provider DNS. I never found what it caused. Then I changed it back. that worked some Weeks, then i had again Problems. Now I use again and permanent the provider dns.

MangoPenguin@lemmy.blahaj.zone on 17 Aug 19:47 collapse

For DNS? It’s an alternative for that, but not for the huge amount of other services Cloudflare provides.