Subject: [Add] Home routers with their own DNS servers

From: Rob Sayre <[email-masked]>
Date: Sun, 18 Aug 2019 10:24:14 -0700

Hi,

I was reading the paper ekr recommended:

<
https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-liu_0.pdf

and I noticed they provide a service here:

<http://whatismyresolver.com/>

I ran this in Firefox with DoH. As expected, I got a result that indicated
my resolver was Cloudflare.

In other browsers, I found that my resolver was run by Google[1]. I was a
little puzzled at first, since Google is not my ISP. But, then I remembered
that my router is a Google Wifi product. I guess it uses its own DNS
servers sometimes. I don't think it always does this, because I do
occasionally see DNS redirect pages[2] from my ISP for NXDOMAIN responses,
although I don't right now. Another possibility is that my ISP sometimes
intercepts this traffic.

I only bring this up to point out how fluid the terms used on this list can
be. I guess I'm the network administrator of my house, and it appears that
I've purchased a router that uses Google's DNS servers by default (fine
with me). I hope my router is using DoH or DoT. If it's not, it might get
updated to do so at some point--its software self updates all the time.

thanks,
Rob

[1] https://www.whois.com/whois/172.253.0.2
[2] https://tools.ietf.org/html/draft-livingood-dns-redirect-03

---

From: Rob Sayre <[email-masked]>
Date: Sun, 18 Aug 2019 10:53:50 -0700

It looks like it uses some local telemetry to decide whether to use the
ISP's DNS servers.

I've attached a screenshot of its management application.

thanks,
Rob

On Sun, Aug 18, 2019 at 10:24 AM Rob Sayre <[email-masked]> wrote:

> I only bring this up to point out how fluid the terms used on this list
> can be. I guess I'm the network administrator of my house, and it appears
> that I've purchased a router that uses Google's DNS servers by default
> (fine with me). I hope my router is using DoH or DoT. If it's not, it might
> get updated to do so at some point--its software self updates all the time.
>
> thanks,
> Rob
>

---

From: Adam Roach <[email-masked]>
Date: Sun, 18 Aug 2019 12:54:33 -0500

On 8/18/19 12:24 PM, Rob Sayre wrote:
> In other browsers, I found that my resolver was run by Google[1]. I 
> was a little puzzled at first, since Google is not my ISP. But, then I 
> remembered that my router is a Google Wifi product. I guess it uses 
> its own DNS servers sometimes.

I'm not sure that's the cause. I have no Google products on the network 
path between my browser and my ISP, and I'm getting a similar result: 
"Your DNS Resolver is: 74.125.45.14"

https://www.whois.com/whois/74.125.45.14

https://www.maxmind.com/en/geoip-demo?js-geoip-demo__addresses=74.125.45.14

Which, If I understand correctly, means that my laptop sent a query to 
the recursive resolver provided by my ISP (68.94.156.9), and then 
whatismyresolver.com's authoritative DNS resolver received that query 
from Google (74.125.45.14). I'm having a hard time coming up with a 
reasonable story about what happened between those servers.

I wonder if my ISP is somehow outsourcing their DNS resolution to Google 
nowadays -- it's the only explanation that I can come up with to explain 
this result. In any case, it's clear that my DNS queries are flowing 
through Google even when they aren't related to any Google properties. I 
don't recall providing informed consent for this to happen, and I wonder 
how much PII is being sent to Google when this happens.

/a

---

From: Rob Sayre <[email-masked]>
Date: Sun, 18 Aug 2019 11:40:14 -0700

On Sun, Aug 18, 2019 at 10:54 AM Adam Roach <[email-masked]> wrote:

> I'm not sure that's the cause.
>

In my case, it is (see my other reply).

There are a lot of ISPs that send their DNS traffic to Google, though.
That's why Google DNS gets 15% of queries--it's not like 15% of the
internet manually set their resolver to 8.8.8.8.

This is covered by this report from APNIC:
<https://blog.apnic.net/2019/03/14/the-state-of-dnssec-validation/>

"DNSSEC validation in Africa

Let’s first look in a bit more detail into Africa. DNSSEC validation use
peaked at 22% of users in mid-2016 and declined to 12% by early 2018 and
has shifted back to 18% in early 2019. ISP’s in this region have been
relatively enthusiastic users of Google’s Public DNS services. Over the
past five years, the use of Google’s Public DNS services has been between
20% to 35% of the entire African user population."

If you read more of the report, it sure seems like there are some
negotiations going on around this arrangement. Which is fine.

I think your point was to highlight the value of DoH in conjunction with
TRR, and I think that effort is good.

thanks,
Rob

---

From: Mikael Abrahamsson <[email-masked]>
Date: Mon, 19 Aug 2019 06:49:01 +0200 (CEST)

On Sun, 18 Aug 2019, Adam Roach wrote:

> Google even when they aren't related to any Google properties. I don't 
> recall providing informed consent for this to happen, and I wonder how 
> much PII is being sent to Google when this happens.

When I run this test on my home connection I get the IP of my ISP 
resolver. My ISP is not doing any trickery, and I definitely do not wany 
my queries to go to any TRR or to Google without my active permission that 
this will happen.

I'm sorry your experience with ISPs are so flawed, but this is not the 
case across the entire world.

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: Amelia Andersdotter <[email-masked]>
Date: Mon, 19 Aug 2019 11:46:24 +0200

On 2019-08-19 06:49, Mikael Abrahamsson wrote:
>> Google even when they aren't related to any Google properties. I
>> don't recall providing informed consent for this to happen, and I
>> wonder how much PII is being sent to Google when this happens.
>
> resolver. My ISP is not doing any trickery, and I definitely do not
> wany my queries to go to any TRR or to Google without my active
> permission that this will happen.
>
If I try to replicate exactly what Adam Roach appears to have done at
the ETSI WIFI PUBLIC network at ETSI HQ in France, I also get a Google
resolver though: https://www.whois.com/whois/172.253.14.5 Curious.

best regards,

-- 
Amelia Andersdotter
Technical Consultant, Digital Programme
Chair, RCM TIG, IEEE 802.11

ARTICLE19
www.article19.org

PGP: 3D5D B6CA B852 B988 055A 6A6F FEF1 C294 B4E8 0B55

---

From: Bret Jordan <[email-masked]>
Date: Mon, 19 Aug 2019 07:19:37 -0600

Thanks for sending this report.  I still find it alarming that a small group of DNS operators have that much visibility in to what is going on. 

Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

> On Aug 18, 2019, at 12:40 PM, Rob Sayre <[email-masked]> wrote:
> 
> 
> 
> On Sun, Aug 18, 2019 at 10:54 AM Adam Roach <[email-masked] <mailto:[email-masked]>> wrote:
> There are a lot of ISPs that send their DNS traffic to Google, though. That's why Google DNS gets 15% of queries--it's not like 15% of the internet manually set their resolver to 8.8.8.8.
> 
> <https://blog.apnic.net/2019/03/14/the-state-of-dnssec-validation/ <https://blog.apnic.net/2019/03/14/the-state-of-dnssec-validation/>>
> 
> Let’s first look in a bit more detail into Africa. DNSSEC validation use peaked at 22% of users in mid-2016 and declined to 12% by early 2018 and has shifted back to 18% in early 2019. ISP’s in this region have been relatively enthusiastic users of Google’s Public DNS services. Over the past five years, the use of Google’s Public DNS services has been between 20% to 35% of the entire African user population."
> 
> If you read more of the report, it sure seems like there are some negotiations going on around this arrangement. Which is fine.
> 
> I think your point was to highlight the value of DoH in conjunction with TRR, and I think that effort is good.
> 
> thanks,
> Rob
> -- 
> Add mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/add

---

From: Erik Kline <[email-masked]>
Date: Mon, 19 Aug 2019 11:38:04 -0700

> resolver though: https://www.whois.com/whois/172.253.14.5 Curious.

ISPs forwarding their resolution service to Google Public DNS services is
something that is done:

    https://developers.google.com/speed/public-dns/faq#isp

Usually the ISP works the 8dot8 operators to notify them of the ISP's
expected query rate so as to avoid surprises on all sides.

---

From: Adam Roach <[email-masked]>
Date: Mon, 19 Aug 2019 13:39:45 -0500

On 8/19/19 1:38 PM, Erik Kline wrote:
>
> ISPs forwarding their resolution service to Google Public DNS services 
> is something that is done:
>

Depends on what you define as a "side." I was certainly surprised.

/a

---

From: Erik Kline <[email-masked]>
Date: Mon, 19 Aug 2019 11:46:44 -0700

> Depends on what you define as a "side." I was certainly surprised.
Fair enough (I meant more operational surprises like tripping DoS detection
limits, etc).

---

From: Rob Sayre <[email-masked]>
Date: Mon, 19 Aug 2019 13:33:50 -0700

Someone asked which model this is. It’s a TP-Link manufactured OnHub device
that costs about $50-60.

You can see the management app in the product photography.

https://on.google.com/hub/

It doesn’t have a configuration web server. You have to authenticate an iOS
or Android app using sounds from its built in speaker.

It’s been on the market for about 3 years, but I don’t know if it’s always
used Google DNS by default.

thanks,
Rob

On Sun, Aug 18, 2019 at 10:53 AM Rob Sayre <[email-masked]> wrote:

>> I ran this in Firefox with DoH. As expected, I got a result that
>> indicated my resolver was Cloudflare.
>>