No one can feasibly run their own DNS server at home. Those requests ultimately have to go somewhere.
Recursive DNS servers will contact root DNS servers. You CAN run a recursive DNS at home quite easily. The only downfall is that root DNS typically doesn’t support any of the encrypted DNS options.
Right, and I would prefer to not accidentally make my home DNS server vulnerable to zone transfer attacks, and have all that traffic leave my home unencrypted regardless. This can be done, but the risks and overhead outweigh the benefits.
For my threat model (and probably most everyone’s), using Cloudflare’s encrypted DNS is good enough for me.
I just use the DNS proxy on my Mikrotik. If you communicate with the root DNS servers in plain text, then it can be just sniffed too. Hard to win here as to have to trust something at one point.
Recursive DNS servers will contact root DNS servers. You CAN run a recursive DNS at home quite easily. The only downfall is that root DNS typically doesn’t support any of the encrypted DNS options.
Right, and I would prefer to not accidentally make my home DNS server vulnerable to zone transfer attacks, and have all that traffic leave my home unencrypted regardless. This can be done, but the risks and overhead outweigh the benefits.
For my threat model (and probably most everyone’s), using Cloudflare’s encrypted DNS is good enough for me.
I just use the DNS proxy on my Mikrotik. If you communicate with the root DNS servers in plain text, then it can be just sniffed too. Hard to win here as to have to trust something at one point.