There's likely a performance impact that is significant at that scale. If they're blocking 670M DNS requests a day, they're likely doing 10-100x that overall.

Have you implemented something at that scale to say this is no big deal for them to do? And what about when 180 countries want their own list and maybe even states, providences, etc do as well?

Thanks to multiple mentions of Mullvad in this overall post comments, I decided to replace dnsmasq with unbound and convert the laptop to DoT. Here's the specific Mullvad snippet if anyone needs:

    # Mullvad Unfiltered
      forward-addr: 2a07:e340::2@853#dns.mullvad.net
      forward-addr: 194.242.2.2@853#dns.mullvad.net
    # Mullvad Adblock
    #  forward-addr: 2a07:e340::3@853#adblock.dns.mullvad.net
    #  forward-addr: 194.242.2.3@853#adblock.dns.mullvad.net

If you're behind a big CGNAT and Google knows it, they might intentionally return multiple addresses to have more capacity.

Each service port (IP:Port) can only receive 64k connections from each NAT IP, returning more IPs from DNS makes more connections available. Google is a very popular service, so it makes sense to do. (Less so for v6, though)

Alternately, if they can't get a good feel for where you are, returning A records for multiple locations makes sense, too.

No idea why 4 AAAA vs 6 A; Google runs dual stacked and I'd expect the same number of records for both; IIRC, 8 AAAA will usually fit in a 512 byte udp reply, and anyway DNS64 might expand As into AAAAs, so you have to gauge sizes with those anyway.

If we are talking about the actually root servers, there are 13 redundant names spread out (thanks to anycast) on around 1700 servers located around the world, and the lookup a user would do is cached for 2 days. That mean the highest amount of traffic a system will generate is one request per unique TLD (like .com) per 2 days, and it will fit a single UDP package.

We can then do some guesses about size for questions like "what is the nameservers for .com". Those are a bit larger than most dns queries since the answer is a bit bigger than most, since .com has a lot of nameservers, so lets put it down to 800 bytes. Every 2 day a average use might then, using some guessing, generate maybe 10 kb of traffic, or about 0.015 seconds of watching a 1080p video on youtube.

Everyone used to query the root servers directly from their ISP or corporate edge servers until the big platforms wanted to gather more of everyone's data in the name of "keeping people safe" from "bad ISP's". As with any manipulation campaign there are a few incidents corporate propagandists can site to say, "See! We are protecting you!!" forcing people to debate the issue and knowing the majority will accept the default settings. Blocking all the DoH/DoT resolvers would be trivial for any ISP to do just as I have been doing at home since the inception of DoH.

The root Anycast clusters are absolutely designed to handle the entire internet querying them which I do from Unbound. If one wishes to help reduce load they can enable large memory caches and rewrite min-ttl to something sane to protect the root servers from Amazon EC2's default 5 second ttl and others like them. Blocking known spam and tracking domains also helps reduce the total number of queries. Groups of friends can even further reduce the load by setting up their own DoH/DoT servers using Unbound DNS and sharing the cache and using cron to keep their favorite domains hot in the cache and increasing private by making the crond queries from a VPS node.

Here's my cache stats for a 3 day uptime:

    total.num.cachehits=18149
    total.num.cachemiss=2300
    total.num.prefetch=4561

     Private  +   Shared  =  RAM used Program
    343.1 MiB + 523.5 KiB = 343.6 MiB unbound

https://datatracker.ietf.org/doc/html/rfc8806

Abstract

Some DNS recursive resolvers have longer-than-desired round-trip times to the closest DNS root server; those resolvers may have difficulty getting responses from the root servers, such as during a network attack. Some DNS recursive resolver operators want to prevent snooping by third parties of requests sent to DNS root servers. In both cases, resolvers can greatly decrease the round-trip time and prevent observation of requests by serving a copy of the full root zone on the same server, such as on a loopback address or in the resolver software. This document shows how to start and maintain such a copy of the root zone that does not cause problems for other users of the DNS, at the cost of adding some operational fragility for the operator.

This document obsoletes RFC 7706.

RFC 7706. Even has config file examples.

True, DNSSEC should tell you if requests are being rewritten or blocked, but it will not help you circumvent this.

Only for TLDs within legal reach. TLDs like .ru and .su require diplomatic outreach and backroom deals.

After the Samourai case, you shouldn’t be so confident in cryptocurrency-based solutions for things like this. If devs can somehow stay anonymous and out of reach, maybe.

I’m not ideologically against cryptocurrency-based solutions, but it isn’t a magic bullet by any means. I still think that the EU in particular isn’t done making life difficult for crypto users.

Not to discourage projects like ENS, I think it’s good to have alternatives, but I do think we need noncommercial fallbacks to the current system as well. Anything involving money will always have choke points.

You can choose not to delegate it, but then how long and who should maintain the list of names that should not be delegated? Who should pay for the work to implement it, and who should pay for the maintenance for said system, and for how long? Should there be an appeal process or some kind of oversight, and who should body those roles?

In theory the law makers could specify this in law as form of registry regulation, but no one want to do that just to address one or two court cases where this question comes up. The registrar of last resort doesn't give any direct answer to those questions either.

"Additional root servers" popping up that would server missing TLDs would fail DNSSEC validation unless you modified the root hints and turned off DNSSEC or resigned the root zone and updated the trust anchors in validating resolvers.

Ever since the Verisign coup in 2003, the world has had the idea of "delegation-only" and suchlike filtering on responses from superdomain servers. More recently, query minimization was invented. Both of these can militate against the root content DNS servers doing that.

Better still, one can run one's own private root content DNS server. I've been doing that (in several ways) for a couple of decades. If ICANN decided to blackhole (say) www.microsoft.com. tomorrow, my DNS lookups wouldn't be affected.

To affect them, the aforementioned "court action" would have to target Verisign.

Yes and no. See QNAME Minimization (https://datatracker.ietf.org/doc/html/rfc7816.html).

> and this has very little to do with facts and very much to do with personal connections.

Disagree, anybody would have gone to prison for doing what SBF did

Free markets are not unbridled capitalism; capitalism needs strong trust-busting and anti-monopoly enforcement.

[dead]

Nice read but we also have democracy to prevent things but it still feels effectively hi-jacked by such fictional constructs like capitalism and the lobbying power

Theoretically we should be able to think of the majorities or ourselves and we can have a good system

but we also feel like a lack of choice I suppose, the elections feel between just two parties with choosing the lesser evil (I think zohran is cool tho in the democratic party and maybe he could signify some good things I guess)

Personally I feel like we need to focus more on the incentives and competency of people more than anything and try to vote it on that and not what they speak I suppose.

'Both capitalism and its nemesis arose in the mid 1900s, when humanity was obsessed with modernist thinking about "solving problems once and for all". And in that context, the people fell in love with these two "clean systems". A more perfect set of rules.'

All of this is junk. Karl Polanyi famously puts the birth of capitalism very late compared to other important thinkers, in 1834, by defining it as characterised by markets of fictitious commodities, i.e. stuff like labour, land, money. More mainstream would be to point to the Renaissance or british 16th century.

The idea that capitalism and communism would be dependent on an art movement of the early 20th century is quite bizarre, the Communist Manifesto was published in 1848 and by the late 19th century when modernism started to form unions and communist parties were already common.

Actually, modernism is a reaction to the apparent stalling of 'progress', WWI and nostalgia for the optimism of the early modern period. I.e. from 1500 to late 1800s. In part it was also a reaction to what is usually called modern physics, i.e. things like newtonianism and ether hypotheses breaking down in due to Michelson-Morley and early study of quantum phenomena, relativity and so on.

another absurd ahistorical comment on HN, where capitalism apparently arose in the mid 20th century despite the long-standing pre-existence of stock issuing multinationals, wage laborers, currency-mediated trade, reserve banking, etc.

[dead]

Presuming you're talking Europe only, are you talking Copernicus? Brahe? Kepler? Galileo? You know that the heliocentric model had been discussed 2000 years earlier in Europe.

Let's assume that correct. Now, what did that "one person" do? Just reject the idea of Earth being the center of the universe? Or actually seek ways to make an alternate model more accepted?

"Individual action" is fucking worthless. But not all types of activism are.

Guessing this might be interpreted by some as a reference to Galileo so I'll take the opportunity to mention Against Method.

https://en.wikipedia.org/wiki/Against_Method