DNS0: The European public DNS that makes your internet safer

"dns0.eu is a French non‑profit organization founded in 2022 by Romain Cointepas and Olivier Poitrey — co-founders of NextDNS."

&gt; safe for children<p>Ah, it&#x27;s filtered.<p>Someone decides what &quot;children&quot; means. Someone decides what &quot;safe&quot; means.<p>There are people who think that not just under-16s, but <i>almost everyone</i> is incapable of making adult decisions. And different (responsible, informed) adults may come to different conclusions about what is and isn&#x27;t safe.<p>Curated DNS may suit some people, but I appreciate having access to the real internet.

Before i start digging into it, does anybody know how they do &quot;No mature videos on YouTube&quot; (in the &quot;kids&quot; filter) with just DNS?

If anyone&#x27;s wondering which are the &quot;High-risk TLDs&quot; blocked in the &quot;zero&quot; filter: CF, CG, GA, GQ, ML, TK, TOP, WIN (right now, i guess it may change any time)<p>The &quot;kids&quot; filter blocks the same TLDs, so it allows XXX or PORN, i guess they just block individual 2nd level domains.<p>I just looped through IANA&#x27;s TLD list with a simple script to get this. The resolver returns NXDOMAIN with &quot;negative-caching.dns0.eu.&quot; SOA for the blocked ones:<p><pre><code> $ kdig +tls ns tk @zero.dns0.eu … ;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY; status: NXDOMAIN; id: 39321 … ;; QUESTION SECTION: ;; tk. IN NS ;; AUTHORITY SECTION: tk. 300 IN SOA negative-caching.dns0.eu. hostmaster.tk. 0 1200 300 1209600 300</code></pre>

Is this actually affiliated with the EU, other than just being hosted in the EU?

Europe having already planned to launch a service which will be called DNS4EU, it looks a bit like phishing. Source: <a href="https:&#x2F;&#x2F;joinup.ec.europa.eu&#x2F;collection&#x2F;ict-standards-procurement&#x2F;solution&#x2F;dns-rfc-1034-rfc-1035-domain-name-system&#x2F;news&#x2F;dns4eu" rel="nofollow">https:&#x2F;&#x2F;joinup.ec.europa.eu&#x2F;collection&#x2F;ict-standards-procure...</a>

Pity they couldn&#x27;t get a cool IP address like Cloudflare and Google. Since without some source of DNS you can&#x27;t reach dns0.eu it&#x27;s good to have something memorable like 1.1.1.1 or 8.8.8.8

Warning:<p>Do not go to this site with enabled javascript! They spam your uplink DNS provider with thousands of uniq, uncachable (fingerprinting?) &#x27;test&#x27; dns keys without your consent, to identify &amp; track the DNS service you are using!<p>Take a look at your DNS outbound log yourself!

Since they don&#x27;t seem to be mentioned on their website, DNS Stamps are sdns:&#x2F;&#x2F;AgMAAAAAAAAAACCaOjT3J965vKUQA9nOnDn48n3ZxSQpAcK6saROY1oCGQdkbnMwLmV1Ci9kbnMtcXVlcnk (&quot;zero&quot; version) and sdns:&#x2F;&#x2F;AgMAAAAAAAAAACCaOjT3J965vKUQA9nOnDn48n3ZxSQpAcK6saROY1oCGQxraWRzLmRuczAuZXUKL2Rucy1xdWVyeQ (&quot;kids&quot; version).<p>But these are already present in the list of public encrypted resolvers (<a href="https:&#x2F;&#x2F;github.com&#x2F;DNSCrypt&#x2F;dnscrypt-resolvers&#x2F;blob&#x2F;master&#x2F;v3&#x2F;public-resolvers.md">https:&#x2F;&#x2F;github.com&#x2F;DNSCrypt&#x2F;dnscrypt-resolvers&#x2F;blob&#x2F;master&#x2F;v...</a>).

This is founded by co-founders of NextDNS. But why? How is it different?

I just use quad9:<p><a href="https:&#x2F;&#x2F;www.quad9.net&#x2F;service&#x2F;service-addresses-and-features" rel="nofollow">https:&#x2F;&#x2F;www.quad9.net&#x2F;service&#x2F;service-addresses-and-features</a>

The EU will actually start offering an official European DNS service later this year, not to be confused with this private initiative

If I choose their DNS, the website shows a text at the bottom that says &quot;You are using dns0.eu&quot;<p>How does the website know I&#x27;m using their DNS? I couldn&#x27;t find anything in the HTTP header that would help them with this.<p><a href="https:&#x2F;&#x2F;imgur.com&#x2F;fMZwxYz" rel="nofollow">https:&#x2F;&#x2F;imgur.com&#x2F;fMZwxYz</a>

My router runs Unbound in order to rotate queries across a number of different DNS-over-TLS providers. I&#x27;ll toss these guys into the mix as well out of curiosity just to see how it goes.

CIRA, Canada&#x27;s Internet Registry, runs a number of public DNS servers[1]. The main attraction is that the service is provided by a non-profit and the data and control are held in Canada, subject to Canadian laws and regulation.<p>They also offer a number of levels of protection, from none (simply resolving the queries) to one blocking suspected malware&#x2F;C2 domain and one blocking pornographic material.<p>[1] <a href="https:&#x2F;&#x2F;www.cira.ca&#x2F;cybersecurity-services&#x2F;canadian-shield" rel="nofollow">https:&#x2F;&#x2F;www.cira.ca&#x2F;cybersecurity-services&#x2F;canadian-shield</a>

Do they block or allow mandated blocked domain by EU countries?

They make it seem like they&#x27;re affiliated with the EU, from brand colors, to TLD, and more. But of course they&#x27;re unaffiliated. Seems intentionally deceptive.

So this is just NextDNS but without a control panel, and it’s 100% free? That’s nice.

Comparison to PiHole: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22718670" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22718670</a> and <a href="https:&#x2F;&#x2F;help.nextdns.io&#x2F;t&#x2F;q6hmvay&#x2F;what-is-the-advantage-of-using-nextdns-over-pi-hole" rel="nofollow">https:&#x2F;&#x2F;help.nextdns.io&#x2F;t&#x2F;q6hmvay&#x2F;what-is-the-advantage-of-u...</a>

&quot;The European public DNS&quot; sounds misleading to me.

While I don&#x27;t think it should be the only choice. Recursive dns does sound like the sort of service a government should offer it&#x27;s citizens.<p>Authoritative dns also sounds like the sort of service a government should offer it&#x27;s citizens. I mean, sure, it would suck compared to commercial dns, but at least everybody could have a name if they wanted.

No support for Anonymized DNSCrypt nor ODoH. Guess they still want to see client IP addresses.

&gt; 193.110.81.0<p>Ah yes, easy to remember &#x2F;s

No, thanks.

Note that for the iphone&#x27;s configuration to work, you need to use Safari to open their &quot;configuration profile&quot; link

Unbelievable that so many operating systems don&#x27;t support encrypted DNS out of the box.

No IPv6 in 2023, is this a joke?

Doesn&#x27;t disclose where their blocklists come from for the child product, hugely overblocks legitimate websites, has no appeals process for miscatagorisation.<p>What an awful product.

I just use OpenNIC<p><a href="https:&#x2F;&#x2F;www.opennic.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.opennic.org&#x2F;</a>

it&#x27;s so slow for me. probably only deployed in Europe.

So the end of NextDNS ?

It has quite extreme filtering:<p>- No porn or other adult websites<p>- No explicit search results<p>- No mature videos on YouTube<p>- No dating websites or apps<p>- No mixed-content websites<p>- No piracy<p>- No ads

Today it&#x27;s a feature. Tomorrow it becomes mandatory by law. Loosing freedom with a big bang and a hole lot of happy people because they cannot compute. There is nothing good about things like that, at least on the long run.

&gt; 100% European<p>but is it gluten free? &#x2F;s at least it&#x27;s not google or cloudflare<p>it&#x27;s pretty funny how a completely irrelevant broken protocol that i don&#x27;t actually needed (could just type the 4 IP digits) is the central talking point of politics junkies