Comment

InnerScientist@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

Forwarding: just passes the DNS query to another DNS server (e.g. your ISP’s). Home routers use forwarding to pass DNS queries from your home network’s clients to your ISP’s DNS servers. For example, for foo.example.com, a forwarding DNS server would first check its cache (did it already ask this question before), and if the answer is not in its cache, it would ask its forwarder (your ISP’s DNS server) for the answer, which would respond with either a cached response, or would perform recursion until it figured out the answer.

Recursion: the DNS server receiving the query takes it upon itself to figure out the answer to that query by recursively querying authoritative DNS servers for that domain. For example, for foo.example.com, a recursor would first query the root servers for what DNS servers are responsible for the .com TLD, then it would ask those servers for example.com, then it would query the servers for example.com for foo.example.com, finally getting the answer to the original query.

Copy-pate from here.

Basically, it remove one middle man from the DNS resolving.

source

Sort:hotnew top

Onomatopoeia@lemmy.cafe ⁨3⁩ ⁨weeks⁩ ago
Cool, thanks for the clarification. This is good info to have in here in general.

source
- pishadoot@sh.itjust.works ⁨3⁩ ⁨weeks⁩ ago
  If pi hole is configured to use another DNS it will still forward your request, just not to your ISP DNS server. Essentially you’re providing your DNS requests to a 3rd party, for a slight boost to performance (because they’ll have tons of stuff cached and can do recursive queries faster if you’re requesting a site not in their cache.) Your web pages will load faster because you don’t have an SBC trying to manually figure out what’s the IP for bigfuckdaddyhairbrushemporium.net
  
  The downside is you’re exposing your DNS queries to a 3rd party and it’s a bit of a privacy hit, as the upstream DNS server you select has your public IP correlated with your DNS requests. Doesn’t really matter to most, but it does for some.
  
  source
  - Onomatopoeia@lemmy.cafe ⁨2⁩ ⁨weeks⁩ ago
    Thanks for the clarification.
    
    How is that different than unbound? Isn’t it also forwarding requests?
    
    source
- InnerScientist@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
  There are 13 root name servers, they container info about which DNS is authorative (can tell you about) a given TLD (like .com or .de) then that repeats for every part of your query with that given server.
  
  Something. Foo. Bar. Com. (<root name server>) ^ most of the time the same as. ^ DNS for baz or bar dns again ^ DNS for Bar ^ DNS server for the .com tld ^ the one unbound asks first, not part of the domain
  
  The root server ips are known to unbound and static.
  
  Then it will ask that server? Like I said unbound remove the middle man and somewhat increases privacy (debatable if only you use it but anyway)
  
  source
  - Onomatopoeia@lemmy.cafe ⁨2⁩ ⁨weeks⁩ ago
    Ah, unbound has the root DNS servers hard coded. That’s a significant point.
    
    Any reason you couldn’t do the same with any other DNS server such as PiHole?
    
    I’m really trying to understand why I’d run two DNS servers in serial, instead of one. All this sounds like it’s just a different config that’s been built in - is there something else I’m missing that unbound does differently?
    
    source
    InnerScientist@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    Because pi-hole asks the configured DNS the whole domain, the root server will promptly <access denied> because that’s not how DNS is supposed to work.
    
    There’s a difference between asking about the individual domain parts of the domain to the corresponding authorative DNS server and just sending the whole thing to a root server. If you did that then the root server would get ddosed to death.
    Pi-hole can’t ask the root servers, it can only forward. Unbound can forward or be authorative or ask the root servers or do all of those at once.
    
    source