{"id":12,"date":"2019-06-14T17:25:34","date_gmt":"2019-06-14T16:25:34","guid":{"rendered":"https:\/\/increasec.com\/?p=12"},"modified":"2023-10-12T15:56:58","modified_gmt":"2023-10-12T19:56:58","slug":"security-via-dns","status":"publish","type":"post","link":"https:\/\/increasec.com\/?p=12","title":{"rendered":"Security Via DNS"},"content":{"rendered":"\n

Article DNS security filtering<\/p>\n\n\n\n

Quad9 is a free offering from an IBM led group of security organizations. OpenDNS made this type of service popular and Quad9 builds on that by making the service faster using AnyCast and a fleet of world-wide distributed DNS servers.
This method makes it easy to protect your entire Home\/Enterprise from KNOWN bad\/phishing sites by replacing your ISP’s DNS server entries with Quad9’s DNS servers. IBM has given us a very easy to remember address 9.9.9.9 (hence the name Quad9)
Add a few DNS servers for redundancy. Following order based on speed
9.9.9.9 Quad9 WorldWide ThreatFilter (IBM, PCH, GCA), strict filtering
94.149.14.14 AdGuard, strict filtering
208.67.222.222 OpenDNS US ThreatFilter, mild filtering
208.67.220.220 OpenDNS US ThreatFilter, mild filtering
208.67.220.123 OpenDNS Parental Control
208.91.112.220 Fortinet US ThreatFilter, gets DDoS’d occasionally?
149.112.121.20 Cira (Canadian)
149.112.122.20 Cira (Canadian)
<\/p>\n\n\n\n

The Good
easy to implement
protects an entire network
auto updating
resilient
free
supports DNSSEC (not to be confused with DNS over TLS)
can prevent IoT <\/a>relay attacks (Chromecast, Alexa etc)
easy to troubleshoot (https:\/\/www.quad9.net\/ has a search function)
The Bad
only mitigates KNOWN threats
DNS caching hinders fast updates
Easy to circumvent by querying specific DNS server<\/p>\n\n\n\n

Single Computer\/Testing
\n use NirSoft’s Quickset DNS https:\/\/www.nirsoft.net\/utils\/quick_set_dns.html
\nHome Network
\n set DNS in router\/Firewall
\nBusiness
\n set DNS in M$ Domain Controller integrated DNS server<\/p>\n\n\n\n

ref https:\/\/quad9.net\/
\nBlocking Test surf to darkweb.com
\nDns Benchmark https:\/\/www.grc.com\/dns\/benchmark.htm<\/p>\n\n\n\n

<\/p>\n\n\n\n

See Lawrence Systems<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Article DNS security filtering Quad9 is a free offering from an IBM led group of security organizations. OpenDNS made this type of service popular and Quad9 builds on that by…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[5,2,4,3],"class_list":["post-12","post","type-post","status-publish","format-standard","hentry","category-uncategorised","tag-dns","tag-personal","tag-security","tag-smb"],"_links":{"self":[{"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/posts\/12","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/increasec.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=12"}],"version-history":[{"count":4,"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/posts\/12\/revisions"}],"predecessor-version":[{"id":2715,"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/posts\/12\/revisions\/2715"}],"wp:attachment":[{"href":"https:\/\/increasec.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/increasec.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/increasec.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}