Eleix 🦊 @[email protected]

@koala Oh aye 😣 Yeah I couldn't imagine asking users to remember or type in ip addresses for things. Worst case a server gets replaced or fails and the address changes. Much easier to remember a hostname that can be easily pointed to the new record when things change.

If I was head of IT there I would be having a cow. 😄

@koala Dang.. Though I can totally understand the ip addresses part. I actually memorized my network structure entirely by ip address so having the internal dns names did pretty much nothing for me 😄

Although from a work perspective it would drive me crazy once things got above 5-8 systems.

I'm just a small environment in a larger-than-necessary network 😁

@garfiald @trickster @jacethechicken

What if we are the thinking man inside of the thinking man?

How bored do you have to be in order to go through the process of making your own .tld and CA? Cause I'm pretty sure I've just created my own rudimentary Intranet at this point.

@L1Cafe That is ultimately my goal. My end game is to ultimately have everything I use be completely inside my own network so that no matter what, I cannot be easily tracked or have my activity monetized by any of the big corporations. It's a stance not many can easily take but I'm slowly managing to pull all the service I rely on under my own control and so far it's been successful. :)

@L1Cafe Yep, this works at the network level so even devices like a Chromecast or Roku that don't give you that control are now forced to respect your privacy :)

@L1Cafe From my experience it's really awesome. Being able to see the DNS queries your devices make is useful in both a security sense and also to see what devices on your network are secretly calling home. I have a good blocklist that completely kills ads as well as telemetry and other tracking which is a nice boost to your online privacy.

@L1Cafe Can quickly feel the difference though. I was expecting the slower resolutions but I'll have to adjust my local cache settings on the Pihole because without using any forwarders I'm quickly running into moments where some websites take that extra couple of seconds to resolve and timing out at times.

@L1Cafe Namely just for resolving non-ICAAN names like .pirate, .fur, .geek to name a few and is entirely user run. But yeah, whole point is to take what ICCAN does with the root servers and give that control back to the people.

@L1Cafe Yep, that was it. Apparently having OpenNIC on the "." record will break DNSSEC resolutions. Setting it to the ICCAN root hints and enabling DNSSEC in pihole got things working.

@L1Cafe Let me remove the opennic config and see what happens. It's not a listed opennic server so I'm not worried about breaking anyone's DNS queries other than my own :P

@L1Cafe Thanks. Though I'm wondering if maybe it's somewhat related to the OpenNIC config I have on the same server. It's running as a T2. If I do a dig on "." it returns the ns0.opennic.glue. I'm not using any forwarders ether. But I'm assuming if I can resolve hosts without forwarders then something has to be working right?

@L1Cafe Yep all resolutions just flat out die but with the toggle off work perfectly fine. Was just about to do that but held off just in case it was something simple in the config I was missing.

So I have my own DNS resolver running Bind9 with dnssec enabled but whenever I toggle "Use DNSSEC" in pihole it completely breaks all DNS resolutions even though I can see DNSSEC working by doing a dig on my own domain that has it enabled.

This is the last thing I needed to fix to get off of Cloudflare's DoH tunnel and relying on my own servers.