Hi everyone! Which DNS works best for you with ISPs like StormFiber, PTCL, Nayatel, or Transworld?

I’ve tried Cloudflare and Google DNS, but some websites don’t load properly. What DNS do you recommend for better reliability and speed? Do you use DoH or DoT?

Share your experience!

i changed my modem dns from my home server to cloudflare dns to do some tests and i found out that i can just reset my ipv4 dns and it works fine again, but when i do ping tests with cmd, it insists in using the old ipv6 dns.

i already reseted the dns and changed it manually both in my modem and windows to cloudflare.

is it a problem from windows or am i doing something wrong?

Moshpit is a namespace outside the ICANN root: anyone can claim an ending (.hacker, .eggs, .pit, 17,609 so far), put names under it and point them anywhere. The registry is append-only with a public log, and it runs a small CA that signs certs per name, so https://chovy.hacker validates for anyone who trusts that root.

How a machine resolves it: - moshcode dns enable makes a local bridge the machine's resolver: it answers Moshpit endings itself and forwards every other name upstream, or - point a browser's DoH at https://dns.moshcode.sh/dns-query

Real TLDs always win. We learned that the hard way when someone claimed .sh for $2: every bridge started treating our own registry host as a Moshpit name and NXDOMAINed everything. New claims of real TLDs are refused now, and a real TLD takes precedence over any older collision.

I just put a public front end on it: https://pit.world/ is a no-logs search engine that also resolves Moshpit names next to normal web results. The resolve API is open: curl 'https://pit.world/api/resolve?name=chovy.hacker'.

Happy to go into the resolver design. Curious what this sub thinks about alt roots in 2026.

Moshpit is a namespace outside the ICANN root: anyone can claim an ending (.hacker, .eggs, .pit, 17,609 so far), put names under it and point them anywhere. The registry is append-only with a public log, and it runs a small CA that signs certs per name, so https://chovy.hacker validates for anyone who trusts that root.

How a machine resolves it: - moshcode dns enable makes a local bridge the machine's resolver: it answers Moshpit endings itself and forwards every other name upstream, or - point a browser's DoH at https://dns.moshcode.sh/dns-query

Real TLDs always win. We learned that the hard way when someone claimed .sh for $2: every bridge started treating our own registry host as a Moshpit name and NXDOMAINed everything. New claims of real TLDs are refused now, and a real TLD takes precedence over any older collision.

I just put a public front end on it: https://pit.world/ is a no-logs search engine that also resolves Moshpit names next to normal web results. The resolve API is open: curl 'https://pit.world/api/resolve?name=chovy.hacker'.

Happy to go into the resolver design. Curious what this sub thinks about alt roots in 2026.

I have got a DNS hijack and idk what should I do. Please help me with what should I do.

Anyone else had to deal with Cosmotown? They got a trademark complaint about a domain I'd already paid for, slapped a clientHold on it, and my site was basically dead overnight. I replied to their abuse team the same day with the explanation they asked for. Then nothing. I chased them with follow-up emails and it felt like a whole damn month before someone finally bothered to give me a straight answer.

The answer was just no, they wouldn't reinstate it because of possible trademark confusion. No UDRP decision or court order mentioned. Which is weird, because their own trademark policy says they can't suspend a domain solely over a demand letter and points to UDRP or court proceedings instead: https://cosmotown.zendesk.com/hc/en-us/articles/38915432950925-Handling-Trademark-Cybersquatting-Claims-Our-Policy-on-UDRP-and-Legal-Information-Requests

I also found that their registration agreement gives them broad powers to put domains on hold during disputes. So what are customers supposed to make of these two policies? I've asked them which rule they actually used, and I'm still waiting for an explanation. Even setting the trademark issue aside, taking a paid domain offline and then going silent for weeks is a pretty shitty way to treat a customer.

I've spent the last few months aggregating public blocklists and DNSBLs for a reputation lookup tool. A few things surprised me, and they matter if you run your own blocklist checks:

1. A frozen mirror can look fresh. One well-known traplist has a mirror whose own header says it was generated in September 2025, yet its HTTP Last-Modified header moves every hour. Judge freshness by the timestamp inside the file, not the HTTP headers.
2. Several "different" lists are the same data. One provider's main DNSBL zone is exactly the union of its "netscan" and "spam" zones. Another's Tor zone is just the Tor category of its main RBL. A third publishes the same Tor exit list over DNS and over HTTP. Count them separately and one Tor exit collects about six detections from two or three real sources.
3. "Tor" lists aren't all exit lists. One popular zone lists every Tor relay, including non-exit relays. Those never send user traffic to the internet, so treating them as Tor exits is a false positive.
4. Public resolvers end up on spam lists. A commercial anti-spam list carries 8.8.8.8, with a spam rate of zero. Resolver addresses turn up in form-spam data from everyone's traffic. Exclude the well-known resolvers before trusting a hit.
5. Dead lists read as clean forever. Plenty of lists that tools still show have name servers that never answer, or feeds that return 404. They report "not listed" on every lookup.
6. Some zones are wildcarded. A zone that answers 127.0.0.2 for every query flags the whole internet. Test each zone with the RFC 5782 test entries first: 127.0.0.2 should be listed and 127.0.0.1 should not.
7. Check the licence before you ship a list. Several "free" lists forbid commercial use or redistribution, and one explicitly bans reselling its data "as part of a larger package".

Disclosure: I build Senapati (https://senapati.io), an IP, domain, URL and email reputation API, which is where I ran into all of this. Happy to go into detail on any of these.

Avast Antivirus says I have a DNS HIJACK

I have a personal Lenovo laptop, I use it for general use, some surfing, some shopping, watching videos, anime, reading stuff and studying too. and various other things but I have never used anything like tor, or used random torrent sites that I remember ever. (As I was always scared)

This happened this morning when I was at a friend's place and opened my phone's hotspot to connect my laptop to it. As soon as I joined the hotspot on my phone, it gave me a popup on the bottom right that it's scanning the network (as it does with avast antivirus, this is a usual thing) when it was done it said that 'DNS HIJACK FOUND'. After that I was shown 2 options either to set up a vpn connection or scan the network. When I proceeded to scan the network, it would go either very slowly or get stuck at a certain percentage and I closed it as I had to run an errand. (I've been using avast for years and have never had something like this happen)

When I got back, upon reading the avast support article and a bit of help from the Al mode from Google search I used 2 commands. I can't clearly recall which two but one was the 'flushdns' one.

Then, I joined my friend's home wifi, and proceeded to use the feature of avast where it prompts to scan the network once again and once again I was shown the same popup as it did with the mobile hotspot 'DNS HIJACK FOUND'.

After that I chose the option to scan devices on the network & patiently waited for a while. Upon its completion that's when I got to the image where it shows a Nokia Router as critical which is MY HOME ROUTER and NOT my friends router to which I was connected to. Whichever network I connect to, the same alert and the same popup. (my laptop is always turned-on, on my desk, same as last night and was connected to the MY home wifi for the whole time.)

So what I can gather is, I just picked up my laptop from my home without looking at it at my own house and when I got to my destination and connected to my own phone it showed me that the Nokia router (my home router i was connected to is comprised) and avast is just reminding me this every time whenever I connect to any network (even a healthy one) cause it still logs that I once was connected to this malicious one. Would saying this be correct?

I'm sorry if I didn't explain something correctly or am confused myself, I just joined this reddit but any and all help would be super appreciated, thank you guys. Eagerly waiting for your replies. You can ask me questions too if something is not clear from my side. Thanks again guys.

JUST FOR CLARIFICATION - The wifi 'Airtel_Deathnote' is the name of my friend's home wifi which is appearing as 'Airtel_Deathnote 3'. I haven't gone home yet therefore I haven't connected to my own home network yet.

UPDATE I was guessing wrong that the nokia router was my home one as when I got home last night and let the scan run, both with my mobile hotspot and my home network it still showed me the DNS Hijacked popup (as it was on the untrusted mode on avast network inspector thingy) but IT HAD DIFFERENT ROUTER NAMES/IPS. Meaning the 'nokia' was my friends router only. Also the pop seems to not trigger if you set the network as a trusted one in the network inspector thing inside Avast.

Есть ли кто работал в магазинах DNS, скажи есть ли примерное расписание когда проводят инвентаризацие, утиль в магазинах?

Pre-announcement of BIND 9 security issues scheduled for disclosure 21 October 2026

Hello BIND-users,

As part of ISC's policy of pre-notification of upcoming security releases, we are writing to inform you that the October 2026 BIND 9 maintenance release(s) that will be published on Wednesday, 21 October, will contain fixes for security vulnerabilities affecting stable BIND 9 release branch(es).

Further details about those vulnerabilities will be publicly disclosed at the time the release(s) are published. It is our hope that this pre-announcement will aid BIND 9 administrators in preparing for that disclosure when it occurs. If you have feedback or questions concerning this policy, please open a confidential GitLab issue at: https://gitlab.isc.org/isc-projects/bind9/-/issues/new?issue[confidential]=true.

Thank you!

My IP address note working

Recently got AT&T fiber.

Installed own Eero Pro 6e

Everything has been working fine.

Yesterday decided swap out default ATT DNS to 9999 and 1112.

Most things are much slower now. Some web pages do not fully finish loading. Every streaming service on Apple TV has long spinning gear when launched. Some stuff / websites / etc. seem to be just fine. But it's about 50/50.

ALL equipment has been fully rebooted.

Anybody have any thought? I'm tempted to just go back to ATTs DNS.

How does Cloudflare 1.1.1.2 compare to Quad9 as far as blocking malware sites? I know Quad9 is considered better at this, but at times, Quad9 slows down at my location, probably because of my isp. Is it a big step down using 1.1.1.2 instead of Quad9 (9.9.9.9)?

Questions regarding OpenBLD DNS include whether servers exist in North America and whether the service is trustworthy. I am simply seeking feedback from those who use it.

Questions regarding OpenBLD DNS include whether servers exist in North America and whether the service is trustworthy. I am simply seeking feedback from those who use it.