It isn't really primarily about organization oversight, though. The weird goings on are in practice usually at the behest of the people paying the salaries of all of the people involved (which includes law enforcement, which goes through corporate channels). There's no real independent oversight for that common case. Everyone is on the payroll. (-:

As a concrete thought experiment, consider if (say) a WWW/DNS hosting company providing such free proxy DNS service decided to covertly record the domain name lookups from the general public that fail in order to compile a list of domain names for the company to prospectively squat on. Having multiple employees handling the public service doesn't stop this if it is the company's actual business decision to sneakily do this.

It really is a statement of bus factor, not about oversight. To make a statement about oversight one has to take into account something else not covered by this list: which of the list entries has attempted to show some level of independent auditing or oversight of its data protection.

* https://blog.cloudflare.com/announcing-the-results-of-the-1-...

CloudFlare has had some independent auditing done, by an accountancy firm. DNS4EU holds itself subject to GDPR rules on Personal Data with respect to query data, and so is auditable by the Czech ÚOOÚ. AdGuard likewise, except that it holds Personal Data in Frankfurt. CZ.NIC likewise, except that it hasn't actually updated its legal doco since 2018 and it's only by implication that the Czech ÚOOÚ can audit the Personal Data handling under the GDPR. DNS.SB simply disclaims the existence of any Personal Data whatsoever, which as with AdGuard is overseen by the German BfDI and relevant Land authorities (HBDI for Frankfurt).

* https://legal-documents-dns4eu.s3.fr-par.scw.cloud/DNS4EU-Pu...

* https://uoou.gov.cz

* https://adguard-dns.io/en/privacy.html

* https://nic.cz/files/documents/20180525_Zasady_zpracovani_os...

* https://dns.sb/privacy/

* https://bfdi.bund.de/EN/Home/home_node.html

* https://datenschutz.hessen.de

Even Thomas Steen Rasmussen, who also claims zero Personal Data, would be subject to oversight by the Datatilsynet.

* https://datatilsynet.dk

prefer this form:

    echo "nameserver 192.168.1.1" | sudo tee /etc/resolver/captive.apple.com

If its public , how do you prevent others from accessing it?

I pre-cache for speed, verifying records that have expired since I retain the expired records for sites that have intermittent DNS issues and also to throw in domains that I do not use in the off chance someone is logging where I go and when. They will see the Cloudflare top 20K domains hourly. Myself and family members have been able to access sites when others around the internet can not due to infrastructure related DNS problems. In other words, when others will say "It's always DNS" for myself and family members that is rarely the case as DNS records do not change as often as people seem to think they do.

I use both of those as well in Unbound.

It looks like this [1] I enable query logging to a tmpfs RAM disk and then every month I update a list of domains that I have queries more than {n} times. I mix that in with a list of the Cloudflare top 20K domains after removing the broken ones and some TLD's.

[1] - https://nochan.net/b/Internet-Crap/20260602-Set-Up-Your-Own-...

Do you mean when communicating directly with a root DNS server over unencrypted UDP or TCP? You're right. There's currently no universal way to encrypt direct queries to root DNS servers. To work around this, the best approach is to host your own public DNS server outside your untrusted ISPs network and connect to it securely using DoH, DoQ, or DoT. Alternatively, you can rely on a trusted third-party public DNS provider that supports encrypted connections. In the end, there's no perfect solution. You have to choose who to trust. Personally, I trust my ISP more than external DNS providers. For anonymity you could route your DNS root queries throe tor or a VPN for the cost of performance.

I also used third-party public resolvers before. Mainly FFM (its not on the list) but non-profit, EU and encrypted. If you boil down the list (from the website) to this categories, you have 4 providers. You can trust, in my opinion. But the problem with all this provider is, that you ran quick into rate limits or some query type restrictions. Especially if you run your own mail server or other DNS expensive task.

Fun fact about hosting your own DNS infrastructure and offering it to friends and family: They might actually trust other providers more than they trust you. Even if they know and trust you personally. Because they know you can theoretically read their queries, it’s more convenient for them to have a stranger do it instead.

I've never felt this. Most large services run or delegate to anycast DNS services.

If you have knowledge of TCP, you know you will occasionally get stalls much greater than that beyond control.

Versus letting a singular entity snoop everything? If you actually open a connection to the result what is the difference? The only way to fully deal with all that is an overlay or mixnets.

Quad9 employs DNSSEC on all endpoints now. https://quad9.net/news/blog/quad9-enables-dnssec-on-all-serv...

Was about to comment this. I actually don't like advert or malware blocking on my public DNS resolvers. It sounds cool but annoying when it misfires.

Once Quad9 blocked Halo MCC XBOX Live -> Steam achievements, several fileshare services (probably used for malware somewhere but not my usage) etc...

1.1.1.1 blocked archive.is or got blocked by them or something...

Gone back to Google DNS (gasp) for now, yes as a European... no blocking, fast, never goes down.

Some CDNs (like Cloudflare) use solely BGP anycast steering for routing to the "nearest" server. Other CDNs (like Akamai, Fastly, Netflix, and YouTube) use a hybrid BGP-DNS steering because some ISPs have extremely questionable routing practices.

Unfortunately, if the CDN only rely on BGP steering (or conversely if you are a user who is stuck on an ISP monopoly), there are cases where this is not necessarily the nearest network-wise (or performant network-wise) if there are peering disputes. If the said ISP is a virtual monopoly or (worse) state-sanctioned to collect network "toll fees" (like in South Korea), non-preferred and international routes are (intentionally) congested.*

If you use a third-party DNS, you basically lose this DNS optimization, and ECS does not fully solve this (because sometimes the DNS override are placed only on the ISP's recursive DNS servers). You're basically in a lose-lose position: either use third-party servers and the IP addresses served to you on popular CDNs are in the congested path, or use the often-unreliable and heavily-logged ISP-provided DNS.

* Usually. There are exceptions, but this comment is just a simplification of the complexities of real-life networking (where RFCs and mutual cooperation die out without fanfare).

Edit for further reading: DNS is the new BGP by Geoff Huston of APNIC (https://ispcol.potaroo.net/2023-09/service-routing.html), How LinkedIn used PoPs and RUM to make dynamic content download 25% faster from the old LinkedIn engineering team (Archived at https://web.archive.org/web/20160310065302/https://engineeri...), Wikimedia's mapping of their CDNs (https://gerrit.wikimedia.org/r/plugins/gitiles/operations/dn...)