22

I used to use Google DNS servers, i.e. 8.8.8.8 and 8.8.4.4, but I couldn't access certain websites. Then I decided to use Quad9 DNS as my alternate DNS server:
enter image description here

Now those websites are accessible, but I wonder if it's OK to use mixed DNS servers.

14
  • 4
    Sure, but what's wrong with your ISP's default servers - they're guaranteed to be closest to you.
    – Tetsujin
    May 22, 2022 at 9:21
  • 10
    Usually. The only real reason to use other DNS servers is if your own ISP's aren't performing well. Usually there is no reason at all to change from defaults.
    – Tetsujin
    May 22, 2022 at 9:25
  • 13
    @Tetsujin Based on personal experience, one big advantage to using public resolvers instead of your ISP’s servers is that you generally get a proper NXDOMAIN response when the domain does not actually exist instead of the address to a page trying to sell you the domain. That actually matters in some cases. That, and with most client systems doing caching themselves, the network distance usually does not matter as long as there’s decent geolocation of the servers (and all the big public DNS services use anycast to do this already). May 23, 2022 at 1:04
  • 12
    another big advantage of public DNS is that it bypasses blocked websites by your ISP May 23, 2022 at 7:08
  • 2
    @TooTea Usually it's because the ISP is required by law, but wants to spend the minimum effort to comply. The next step will be intercepting all unencrypted DNS traffic, which users get around with encrypted DNS, and then DPI filtering.
    – Martheen
    May 24, 2022 at 6:12

4 Answers 4

42

You are not using "mixed" DNS servers. You have specified a preferred DNS server, and a alternate fail-back secondary DNS server to be used if the primary fails to answer.

There is no connection between the two. It's actually advisable to use a different alternate DNS server, in case the DNS servers of the preferred one are unreachable for some reason.

19

It won't do what you think it does.

If the primary server returns an empty response (no IP addresses match a domain name), the alternate server will not be queried at all.

On most platforms the alternate server is used when the primary one fails to respond (not just fails to resolve). That's because this system assumes that both (all) configured DNS servers return credible responses. The goal of configuring more than one is reliability when one fails to respond.

The websites that didn't resolve originally still won't resolve as long as the primary server is functional.

You may consider using your preferred DNS server as the primary and the other one as a secondary.


Additional Linux-y notes:

  1. IIRC Pihole will treat all DNS servers it's forwarding to as equal and use them round-robin.
  2. In distros using systemd-resolve once a DNS server fails and an alternate one is used, the resolver will keep using the alternate server until that one fails too. This is different than dnsmasq's behavior, which would always retry the primary first.
3
  • 1
    If one resolver returns SERVFAIL, clients will often retry or try another one. But I don't know how Windows works. May 25, 2022 at 0:06
  • By default, DNSMasq doesn't prefer resolvers based on order. You can configure it to. May 25, 2022 at 0:07
  • "It won't do what you think it does" Well, actually it does. As I said in my question, now those websites are accessible.
    – Mori
    May 28, 2022 at 9:00
9

You can view both adresses as totally separate. The DNS is just a big "phonebook" of IP adresses. It doesn't matter where and from which provider your system gets them from, as long as that lookup is consistently available. That's why it lets you specify 2 adresses. The first one is always looked for first and if that "DNS phonebook" is nowhere to be found (for example because it's down) it uses the second one you specified to ensure you get your precious IP adresses.

You can go for example 1.1.1.1 (Cloudflare) and 8.8.8.8 (Google). But always keep in mind, the first one, in that case Cloudflare, is preferred and will be looked up first. If that succeeds, the second one will be completely ignored. That's important if you are using special DNS based services, for example a Pi Hole etc.

DNS providers usually specify 2 DNS adresses. That's out of redundancy reasons. They say when one of our DNS servers is down, just use our other one. That's why Google has 8.8.8.8 and 8.8.4.4 and Cloudflare has 1.1.1.1 and 1.0.0.1

You can either use primary and backup from one company, if you are looking for that, or you can use a different companies DNS for your backup one.

6

You almost always can use multiple resolver operators. Whether it's a good idea depends on your requirements and priorities.

You get a combination of the features offered by both providers. Notably, 9.9.9.9 blocks malicious domains, and 8.8.8.8 does not. If you use them both, sometimes malicious domains will resolve and sometimes they won't!

8.8.8.8 also supports EDNS Client Subnet, which can improve CDN performance, while reducing DNS privacy and performance. 9.9.9.9 does not, though Quad9's alternative 9.9.9.11 resolver does.

Some DNS services provide detailed logging. Conversely, some promise privacy. Most people probably won't want to combine the two.

DNSSEC can be an important difference. If one resolver validates and one doesn't, you'll be able to resolve bogus domains (sometimes slowly). (The resolvers mentioned here all validate, and I don't know whether that is important to you anyway.)

If you care about certain features, you'll want to consider the trade-offs and choose which resolver(s) to use carefully. If you don't, you can go wild.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .