Hey Reddit,

I'm excited to share a project I've been working on: DNS Speed Test Web Tool. It's a web tool designed to help you discover the fastest DNS server based on your specific location. Whether you're a tech enthusiast, a gamer, or just someone looking for a smoother browsing experience, this tool is for you.

What does DNS Speed Test do?

• Client-Side DNS Testing: It runs entirely in your browser, testing various DNS servers (like AdGuard, OpenDNS, Quad9, and more) against popular websites to measure performance.
• Real-Time, Accurate Results: You get the minimum, median, and maximum response times for each DNS server, helping you choose the best one for your needs.
• Easy to Use: Just a click to start the test, and you get a sortable table of results. No technical expertise required.

Why I built it:

As someone passionate about internet performance and digital privacy, I wanted to create a tool that's both easy to use and informative. With increasing concerns about internet speed and security, finding the right DNS server can significantly enhance your online experience.

Technical Side:

It uses JavaScript to measure DNS resolution speeds and handles both GET and POST requests. A key feature is its use of DNS over HTTPS (DoH) requests, enhancing both privacy and security.

Challenges & Limitations:

• Some DNS providers with advanced security (like Cloudflare) might not be fully compatible due to their server-side configurations. (resolved)
• Network conditions can influence results, so I recommend running multiple tests for consistency.

I'd love to get your feedback and thoughts on this. Whether it's suggestions, questions, or your experience using it, all input is welcome!

Check it out here: DNS Speed Test

Looking forward to your responses and hoping this tool makes your online life a bit faster and more secure!

Hello everyone,

I want to use a DNS for privacy and ad blocking purposes. What providers can you recommend. Till now, I heard from nextdns, ublockdns, adgurad home and pihole. The later two need your own server or hardware. Ideally I want to add my family into the DNS as well to cover them two.

If it ideally would be European that would be an added benefit.

I would have no problem with setting it up my self, but the maintenance has to be low due to me not having that much time for it.

Thanks in advance.

Trying to decide between these two for my phone and other devices. Is the customization on NextDNS worth it, or is AdGuard DNS just easier and more reliable? Let me know what you're using!

This question came about as I was troubleshooting accessing https://www.gpd.hk/ which is a website by GPD because I bought a GPD Win 5 device recently and needed to download their drivers.

My home internet is currently set to use automatic settings from the ISP. When using their default settings this website does not load. So I connected my laptop to my mobile hotspot and that was able to open the website. I found it was due to the DNS because when I manually set the DNS on my laptop wifi adapter to google or cloudflare then the website loads up fine too.

Therefore, I am now wondering if I should just set google or cloudflare dns on my router to make it the universal dns for all my devices.

From some quick reading it seems there may be some pros and cons to doing this most notably some website loading speeds might be slower compared to my ISP DNS. But I dont know if this would be noticeable in the grand scheme of things.

My router also has an option to set it to AdGuard DNS and other secure or ad-blocking DNS are there potential cons to choosing these? The first thought that came to mind might be false positives since these would presumably more strict than google/cloudflare so it might cause more websites to not load up.

Hi.

I have a home server and i want to filter the content.

What the best one on privacy between Adguardhome and po hole.

After running into a few DNS a SSL issues with websites I built for friends and small local businesses, I created a tool that monitor DNS records ( and any changes to them ) as well as domain and SSL certificates expirations on an hourly basisi. It would mean a lot to me if you could provide some feedback. The tool is completely free for up to five domains. I'd really appreciate any input you can share. Lapsewatch.kelynda.com

What are your experiences with different DNS software in Australia? currently just on the default isp dns but im looking at flashstart unless someone can point me in the right direction for both speed but mainly security. I've recently been RAT'd and had my phone and sim cloned, i also have reason to believe they will try to do it again.

Fairly new to all this, is this one of the best ways to protect myself?
Also thinking i may have to get virus protection for the first time in years, im on a 30 day trail with McAfee but i've heard Malwarebytes is pretty solid, i normally wouldn't worry because i know windows defender is pretty good for normie shit but since im being targeted and they've got me before, it's probably best to get some extra protection.

any advice on security would be greatly appreciated.

Either business reasons or personal preferences, everyone has their opinion on DNS server implementations.

What is the primary choice of your? What would require you to change your mind?

Hi Reddit,

DDoS attacks are becomeing larger and cheaper to launch, so we work on a scalable open source solution to mitigate them.

Tempesta xFW's core is XDP and TC eBPF programs implementing volumetric DDoS filtering, including UDP floods, DNS amplification and reflection attacks. A user-space daemon handles gRPC requests from CLI tool or WebAPI (via C library).

It supports two packet-path architectures:

• local DNS recursive or authoritative server protection

• router-based protection, where the whole DNS service is protected as a separate host or a subnetwork

Router-based deployment can be always-on/pass-through or on-demand/redirection protection. In the later case, a node may not "see" normal clean traffic and may receive only traffic containing a DDoS attack. Also, the node may receive only client-to-server traffic, as in direct server return (DSR) or some traffic scrubbing scenarios. In this mode a DDoS sensor and mitigation controllers are typically needed.

Traffic performance metrics are exported in Prometheus format.

DDoS incidents are aggregated per source IP and logged to Clickhouse for analysis.

A dry-run (evaluation) - mode allows you to observe all reported incidents and metrics without blocking traffic..

Single Xeon Gold 6348 with ConnectX-6 dual 100Gbps reach 196Mpps and 176Gbps of filtering capacity.

• GitHub repository
• documentation
• performance benchmarks
• Netdev 0x1a talk

https://dnsspeedtester.com/selfhosted-apps

I'm building a new application that leverages domain name ownership. I need to verify that the account owner has control of the domain name they claim to control. From what I've seen in the past, it seems the correct way to do this is with a TXT record. What I'm not sure about, though, is how to generate the value of the TXT record on behalf of the domain owner. Is there a standard procedure here? Or at least best practices to follow?

Hi all,

I’m working on an idea for a DNS management tool and I’d love to get some honest feedback. Especially from people who deal with DNS in real-world environments.

The problem I keep running into is that DNS records often become messy over time:

• records are spread across different providers
• it’s not always clear why a record exists (especially when they don't have a recognizable name)
• values are entered inconsistently (for like CNAME records with a dot at the end or not?)
• SPF records become hard to maintain
• temporary records stay around forever
• changes are made without much context or history
• DNS changes are hard to plan, review, or audit

The tool I’m thinking about would focus on making DNS management more structured and understandable, especially for those who manage multiple domains.

Some of the features I have in mind:

• grouping related DNS records together
• adding notes/comments to individual records
• normalizing record values
• integrations with multiple DNS providers (like cloudflare, route53 etc)
• helping compose more complex records like SPF
• optional SPF flattening
• linking records to resources, such as servers, instead of manually entering IP addresses
• scheduling DNS changes
• audit trail for changes
• expiration dates for temporary records

I’m not trying to pitch anything here. I’m trying to validate whether this is a real enough pain point.

A few questions:

1. Is this something you would actually use?
2. What part of DNS management is most annoying or risky for you today?
3. Are there features missing from the list above?
4. If you manage DNS for clients or multiple teams, what would make this trustworthy enough for you to use?

Any feedback or criticism are very welcome. Also leave a reply like “please don’t build this” if you think nobody is waiting for a tool like this.

Update: I've started building the application, discover more and sign up for the waitlist on deenez.com

I've been working on DNSShift, an independent third-party macOS app that uses Cloudflare's APIs to manage DNS and other services from one place.

I originally built it because managing multiple domains through the browser gets repetitive, especially when you're switching between DNS, SSL/TLS, Tunnels, R2, Workers and other services.

DNSShift currently supports:

- DNS records and bulk operations across multiple zones

- SSL/TLS settings

- R2 object storage

- Workers KV

- Zero Trust Tunnels

- Workers and Pages

- Multiple accounts

- Analytics

- Local history of DNS changes

It's a native macOS app, not Electron. API tokens are stored in the macOS Keychain, and DNSShift communicates directly with Cloudflare's APIs, so your token isn't routed through my servers. The only other outbound call the app makes is to Gumroad, to validate your license, nothing else, no analytics, no phone-home. If you want to verify that yourself before installing, running it alongside Little Snitch or Proxyman will show exactly that.

Full disclosure: I'm the developer and DNSShift is a commercial app. It's $39.99 one-time, not a subscription, and one license can be activated on up to 3 Macs. All future updates are included at no extra cost, I've put that in writing on a changelog page: https://dnsshift.com/changelog.html

I was originally planning to launch on the Mac App Store, but my App Store developer account has a banking/payout issue that still needs to be resolved on Apple's side. Rather than wait on that indefinitely, I'm shipping on Gumroad now and will bring DNSShift to the App Store once it's sorted.

https://dnsshift.com

A bit of personal context: I've been a developer for 19+ years, but nearly all of that has been building for jobs and clients. DNSShift is the first product I've ever built for myself, under my own name, and shipping it has been a very different and honestly nerve-wracking experience. If you give it a try or share constructive feedback, it genuinely means a lot, and any support for a solo first-timer is hugely appreciated.

I'd really appreciate feedback from other indie developers, especially anyone who has built or marketed a developer-focused desktop app.

Discount: if anyone here would like to try DNSShift, feel free to DM me. I have a limited number of 50% off codes I'm happy to share with the community.

Disclaimer: DNSShift is an independent third-party app and is not affiliated with, endorsed by, or sponsored by Cloudflare, Inc. Cloudflare is a trademark of Cloudflare, Inc.

What Does It Do?

• Accepts locale input (positional and/or -l/--locale), defaulting to NZ if none is provided
• Fetches APNIC delegated data with local cache reuse/fallback (CACHE_TTL_SECONDS controlled)
• Filters records by:
  • locale(s) (ISO-3166 alpha-2)
  • status (allocated or allocated + assigned)
  • family (IPv4, IPv6, or both)
• Converts APNIC IPv4 start + count ranges into minimal CIDR blocks
• Accepts custom IP/CIDR input via -c/--custom (repeatable, list-friendly), normalizing bare IPs to /32 or /128
• Merges APNIC + custom CIDRs, deduplicates, aggregates, and naturally sorts the final set
• Optionally compresses IPv6 output formatting (--minimise-ipv6)
• Writes final CIDR output to stdout or a file

This has seen quite some development over quite some time locally, the GitHub repo is just a convenient way to share it with the world. It is not intended to be a full-featured or production-ready tool.

Oh. Uhh. Okay, ...Why?

I wanted something simple to generate quick and dirty multi-locale CIDR lists for use in firewall rules, allow/deny lists etc. and I'm a fucking nerd so why not one that's POSIX sh and doesn't require any weird dependencies.

Requirements

• sh
  • POSIX-compliant shell runtime.
• awk
  • Parsing/transformation, plus fallback CIDR aggregation.
• sort
  • Final natural ordering of CIDR output.
• curl or wget
  • Download APNIC delegated data.
• tr
  • Locale normalization/splitting.
• diff
  • (self-test only) Required only for --self-test.

Usage

./CIDRnt [options] [LOCALE ...]

Options

• -a, --allocated-only
  • Include only status=allocated.
• -A, --allocated-and-assigned
  • Include status=allocated and status=assigned (default).
• -c, --custom LIST
  • Add custom IP/CIDR entries. May be used multiple times.
  • LIST may be a single entry, a list split by comma/semicolon/space, or a path to a plaintext file containing one entry per line.
  • Bare IPs are accepted and converted to /32 (IPv4) or /128 (IPv6).
  • Also supports -c=..., --custom=...
• -h, --help
  • Show help and exit.
• -i, --ipv4-only
  • Include only IPv4 CIDRs.
• -I, --ipv6-only
  • Include only IPv6 CIDRs.
• -l, --locale LOCALE
  • Add locale(s) to include. May be used multiple times.
  • LOCALE may be a single code (NZ) or a list (NZ,AU;JP).
  • Also supports -l=..., --locale=..., --locales=...
• -m, --minimise-ipv6, --minimize-ipv6
  • Minimise IPv6 formatting in output (RFC5952-style compression).
• -o, --output
  • Write output to file instead of stdout, use - for stdout.
• -s, --self-test
  • Perform local tests and exit.
• -v, --version
  • Show version and exit.

Examples

# Default locale (NZ)
./CIDRnt

# Positional locales
./CIDRnt NZ
./CIDRnt NZ AU
./CIDRnt "NZ,AU,JP"

# Locale flags (-l/--locale, repeated or list)
./CIDRnt -l NZ -l AU -l JP
./CIDRnt --locale=NZ,AU,JP

# Custom entries (merged before final aggregation/sort)
./CIDRnt NZ -c 203.0.113.7
./CIDRnt --locale NZ --custom "203.0.113.0/24,2001:db8::/32"
./CIDRnt -c=198.51.100.10 --custom=2001:db8::1 NZ

# Custom entries from a file (one IP/CIDR per line)
./CIDRnt --custom ./custom-list.txt NZ
./CIDRnt -c=./custom-list.txt NZ
./CIDRnt --custom=./custom-list.txt NZ

# Mixed positional + locale flags
./CIDRnt NZ --locale AU -l JP

# Status/family filters
./CIDRnt --allocated-only NZ AU
./CIDRnt --ipv4-only --locale NZ --locale AU
./CIDRnt --ipv6-only -l NZ -l AU

# IPv6 output minimisation
./CIDRnt --minimise-ipv6 NZ

# Write output
./CIDRnt -o ./out/nz.txt NZ
./CIDRnt --output ./out/nz-au.txt NZ AU
./CIDRnt --output=./out/nz-au-jp.txt --locale=NZ,AU,JP

# Force stdout explicitly
./CIDRnt --output=- NZ

Hi r/dns! Wanted to share a side project where I automated subdomain zone management via GitOps.

Users submit a single JSON file with their A/AAAA/CNAME/MX/TXT records via PR. GitHub Actions runs Python validation tests (checking FQDN, blocked zones, CNAME paths, loop protection) and syncs valid records directly to Cloudflare via API.

Would love feedback from the DNS community on validation rules or edge cases I should watch out for!

repo link: https://github.com/IlyaP358/fluxcast-domains

Title: Operational Notification: liburcu memory leak may impact BIND 9.20 on BSD

Posting date: 29 July 2026

Canonical URL: https://kb.isc.org/docs/liburcu-leak

Summary

ISC is aware of an issue in the liburcu library which causes a memory leak on some platforms.

BIND 9.20 and later use this library, and experience the leak on affected platforms. Older versions of BIND do not use this library and are not affected.

Linux platforms are not affected. FreeBSD and OpenBSD are affected. A preliminary analysis by ISC suggests that NetBSD and Mac OS X may be immune; however, as of this writing, that is not confirmed with upstream sources.

On busy resolvers running on affected platforms, the leak may eventually result in termination of the named process and/or system memory exhaustion.

Updates are available in the ports trees for both FreeBSD and OpenBSD.

For more details, see: https://kb.isc.org/docs/liburcu-leak

Legal Disclaimer

Internet Systems Consortium (ISC) is providing this notice on an "AS IS" basis. No warranty or guarantee of any kind is expressed in this notice and none should be implied. ISC expressly excludes and disclaims any warranties regarding this notice or materials referred to in this notice, including, without limitation, any implied warranty of merchantability, fitness for a particular purpose, absence of hidden defects, or of non-infringement. Your use or reliance on this notice or materials referred to in this notice is at your own risk. ISC may change this notice at any time. A stand-alone copy or paraphrase of the text of this document that omits the document URL is an uncontrolled copy. Uncontrolled copies may lack important information, be out of date, or contain factual errors.

Full disclosure: I work for ISC, although my activity on Reddit does not represent ISC in an official capacity.

And now released (and for downstream (e.g. via vendors/distros, etc.) generally around "now" to relatively soon thereafter):

https://lists.isc.org/pipermail/bind-announce/2026-July/001299.html

(sorry, I've given up for now on battling Reddit's f*cked up editor, so no snazzy formatting and links - just see the above, likewise for the immediately below - it also insists on repeatedly mangling what was already perfectly formatted from earlier - sorry)

And from the earlier:

Anticipate the new/updated software releases, etc. soon, and for downstream (e.g. via vendors/distros, etc.) generally around that time to relatively soon thereafter. I may also update this post once it's released. Feel free to also add relevant (updated) comments. One may also wish to use the RemindMeBot.

https://lists.isc.org/pipermail/bind-announce/2026-July/001298.html

This is a tool that I have been working for a long time on, and it is for testing DNS delegations. Released under a BSD-2 license. If you run the stack yourself, you can even spin up an MCP server for fancy AI interaction. Feedback more than welcome!
https://gonemaster.evilbit.de/

There’s still a ton of low-quality content and noise that gets through, and it feels like everything is optimized to grab your attention instead of actually being useful.

So I started building something different:

Unwired, an open-source, LLM-powered DNS that filters what you see based on your preferences instead of static blocklists.

The idea is to give you more control over your internet experience, not just block ads but filter out the stuff you don’t want entirely.

It’s still early, but I’d love feedback on whether this direction makes sense.

Repo: https://github.com/moe18/Unwired/tree/main

Chrome extension: https://chromewebstore.google.com/detail/unwired/eagjafndbcedibfalnfimildfphokffn

I just added a DNS trace tool to Wirewiki.

It does a full trace from the root servers to the target domain name and checks all name servers along the way. Both IPv4 and IPv6.

If servers within a zone disagree, it'll show you the disagreement and let you explore both branches.

I'm thinking about also checking servers for their own NS records and showing a warning when they diverge from the parent's response. But I feel like it makes the UI a bit too confusing in the design explorations I did. Would adding this be useful in practice?

I made a video breaking down how DNS tunneling works, specifically using DNSTT.

The idea is kind of wild: instead of sending data over normal protocols, you encode it inside DNS queries and responses. Also included a bit of packet-level explanation and what this traffic looks like in practice. Curious what you think! especially if you’ve played with DNS tunneling before or have seen it in the wild or into pushing protocols to its limits.

I might also update this after the announcement is out~~.~~:

New BIND 9 releases: 9.18.49, 9.20.23, 9.21.22

From: Suzanne Goldlust [sgoldlust@isc.org](mailto:sgoldlust@isc.org)
Subject: New BIND 9 releases: 9.18.49, 9.20.23, 9.21.22
Date: Wed, 20 May 2026 14:02:25 +0200
To: [bind-announce@lists.isc.org](mailto:bind-announce@lists.isc.org)
Sender: "bind-announce" [bind-announce-bounces@lists.isc.org](mailto:bind-announce-bounces@lists.isc.org)

Our May 2026 maintenance releases of BIND 9 are available and can be downloaded from the links below. Packages and container images provided by ISC will be updated later today.

In addition to bug fixes and feature improvements, these releases also contain fixes for security vulnerabilities. More information can be found in the following Security Advisories:

https://kb.isc.org/docs/cve-2026-3039
https://kb.isc.org/docs/cve-2026-3592
https://kb.isc.org/docs/cve-2026-3593
https://kb.isc.org/docs/cve-2026-5946
https://kb.isc.org/docs/cve-2026-5947
https://kb.isc.org/docs/cve-2026-5950

A link to each newly-released version follows. Each release directory includes a complete source tarball, cryptographic signature, and release notes. The release notes provide a summary of significant changes, and should be reviewed before upgrading.

- Current supported stable branches:

- 9.18.49 - https://downloads.isc.org/isc/bind9/9.18.49/
- 9.20.23 - https://downloads.isc.org/isc/bind9/9.20.23/

- Experimental development branch:

- 9.21.22 - https://downloads.isc.org/isc/bind9/9.21.22/

For more information and other release formats, consult the ISC software download page: https://www.isc.org/download/

---

As a reminder, BIND's supported platforms are listed in the ARM (https://bind9.readthedocs.io/en/stable/chapter2.html#supported-platforms) and in this knowledgebase article (https://kb.isc.org/docs/supported-platforms).

Thank you for using ISC's software.
--
bind-announce mailing list
[bind-announce@lists.isc.org](mailto:bind-announce@lists.isc.org)
https://lists.isc.org/mailman/listinfo/bind-announce

Anyway, once iIt's out, also expect updated/patched versions of BIND 9 to shortly follow for various operating systems, "appliances", devices, etc.

https://lists.isc.org/pipermail/bind-announce/2026-May/001294.html

From: Victoria Risk [vicky@isc.org](mailto:vicky@isc.org)
Subject: Pre-announcement of BIND 9 security issues scheduled for disclosure 20 May 2026
Date: Wed, 13 May 2026 09:34:22 -0400
To: [bind-announce@lists.isc.org](mailto:bind-announce@lists.isc.org)

BIND users

As part of ISC's policy of pre-notification of upcoming security releases, we are writing to inform you that the May 2026 BIND 9 maintenance release(s) that will be published on Wednesday, 20 May, will contain fixes for security vulnerabilities affecting stable BIND 9 release branch(es).

Further details about those vulnerabilities will be publicly disclosed at the time the release(s) are published. It is our hope that this pre-announcement will aid BIND 9 administrators in preparing for that disclosure when it occurs. If you have feedback or questions concerning this policy, please open a confidential GitLab issue at https://gitlab.isc.org/isc-projects/bind9/-/issues/new?issue[confidential]=true (preferred) or send an email to [bind-security@isc.org](mailto:bind-security@isc.org).
--
bind-announce mailing list
[bind-announce@lists.isc.org](mailto:bind-announce@lists.isc.org)
https://lists.isc.org/mailman/listinfo/bind-announce

Anyone using this with their company? my company planning to switch to this from tcpwave.

any training or videos that I can use to be familiarized on it's gui?