What is 1.1.1.1? How does it speed up the Internet and secure data when browsing?

What is 1.1.1.1?

1.1.1.1 is a high-speed and well-secured DNS service from Cloudflare, a famous reverse proxy service provider. Cloudflare's DNS service will help users reduce browsing history tracking while increasing Internet access speed. According to Cloudflare, the DNS service has a response time of only 14ms, much faster than OpenDNS (20ms) and Google DNS (34ms).

Cloudflare's IPv4 addresses provided by APNIC are easy to remember: 1.1.1.1 and 1.0.0.1.

In addition, users can rest assured when using Cloudflare's DNS service because it will delete all recorded records within 24 hours so the data will not be disclosed or used.

The role of the resolver in DNS

When resolving a domain name, a query travels from the back-end system (i.e. a web browser) to a recursive DNS service. If the DNS record is not in the service's local cache, recursively queries the trusted DNS hierarchy to find the IP address information you are looking for. Recursion is part of what DNS 1.1.1.1 does, so it needs to be fast and secure.

Objective of 1.1.1.1

Cloudflare's goal is to operate the fastest public resolver in the world, while raising the bar on user privacy protection. To speed up the Internet, the company has built data centers globally to reduce the distance (ie latency) from users to content.

In March alone, Cloudflare activated 31 new data centers globally (Istanbul, Reykjavik, Riyadh, Macau, Baghdad, Houston, Indianapolis, Montgomery, Pittsburgh, Sacramento, Mexico City, Tel Aviv, Durban, Port Louis, Cebu City, Edinburgh, Riga, Tallinn, Vilnius, Calgary, Saskatoon, Winnipeg, Jacksonville, Memphis, Tallahassee, Bogotá, Luxembourg City, Chișinău) and like every other city in this network, the new sites run DNS Resolver, 1.1 .1.1 on the first day.

This fast and widely distributed network is built to serve any protocol, and Cloudflare is currently the fastest, most reliable DNS provider on the Internet. In addition, the company also provides Anycast service for two of the thirty root nameservers (root domain name resolution service) and provides recursive DNS services for users. Recursion can take advantage of co-located authoritative servers to make looking up all domain names faster.

Although DNSSEC ensures data integrity between the resolver and the trusted server, it does not protect 'last mile' privacy for users. However, DNS Resolver 1.1.1.1, supports the new DNS security standards - DNS-over-TLS and DNS-over-HTTPS, providing last mile encryption to keep users' DNS queries private and confidential. is tampered with.

Resolver protects privacy

Previously, recursively sent the full domain name to any intermediary to find its way to root or trusted DNSs. This means that if you visit the website TipsMake.com, the root server and the .com server will be queried with the full domain name (i.e. TipsMake and the com part), even though the root server simply redirects. converted to .com (independent of the full domain). Easy access to all this personal browsing information via DNS is a concern for many people. This problem is solved by some resolver software packages, although not everyone knows about these solutions.

The DNS Resolver service, 1.1.1.1, provides all of the DNS privacy protection mechanisms identified and recommended for use between the stub resolver and the recursive resolver. The stub resolver is a component of the operating system that "talks" to recursive resolvers. By only using Query Name Minimization DNS defined in RFC7816, DNS resolver 1.1.1.1 makes it less likely to leak information to intermediate DNS servers, such as roots and TLDs. That means DNS resolver 1.1.1.1, only sends enough names so the resolver knows what to ask next.

DNS resolver, 1.1.1.1 also supports private TLS queries on port 853 (DNS over TLS), so it can keep queries hidden from network leaks. Additionally, by providing an experimental DoH protocol (DNS over HTTPS), the service has improved both privacy and speed in the future for users, as browsers and other applications can connect to each other. Consolidates DNS and HTTPS traffic into a single connection.

With the increasing use of negative cache (Negative cache is a cache that stores "negative" responses, meaning errors) in DNS, as described in RFC8198, Cloudflare can continue to reduce the load on the system. Global DNS. This technique first uses a negative cache for existing resolvers to hold negative (or non-existent) information for a period of time. For DNSSE signed zones and from in-memory NSEC records, the resolver can find out that the requested name does not exist without performing any additional queries. Therefore, if you type wwwwww dot and write something, then wwww dot and write something, the second query is answered 'no' very quickly (NXDOMAIN in the DNS world). Negative cache only works with DNSSEC signed zones, including root and 1400 of the 1544 TLDs signed yesterday.

The company uses DNSSEC authentication because this allows to ensure that the answers are correct, with low and economical signature verification costs. Cloudflare always wants users to trust the answers they receive and performs all possible checks to avoid negative answers for customers.

However, errors in DNSSEC configuration caused by DNS operators can cause domains to be misconfigured. To fix this issue, Cloudflare will configure ' Negative Trust Anchor ' on domains where DNSSEC errors have been identified and corrected, and remove them when operators correct the configuration. This limits the impact of failed DNSSEC domains by temporarily disabling DNSSEC validation for a specific misconfigured domain, restoring access to end customers.

How was the DNS resolver 1.1.1.1 service formed?

Initially, Cloudflare thought about building their own resolver but this idea was later rejected due to complexity and considerations related to go-to-market (GTM) strategy - delivering value. unique to customers and gain competitive advantage. After they reviewed all the open source resolvers on the market, from this long list, they narrowed the choice down to two or three options that fit most project goals. Finally, the company decided to build the system on CZ NIC's Knot Resolver, which was released two and a half years ago. With the selection of Knot Resolver, software diversity is also increased. The highlight is that it has more core features than Cloudflare wanted. With a modular architecture similar to OpenResty, Knot Resolver is being used and developed.

Interesting things that make Cloudflare's resolver different

The advanced features of DNS resolver 1.1.1.1 service are:

1. Query Minimization RFC7816
2. DNS-over-TLS (Transport Layer Security) RFC7858
3. DoH DNS-over-HTTPS protocol
4. RFC8198 'negative' responses

Note, Knot Resolver lead developer Marek Vavruša has been with the Cloudflare DNS team for over two years.

How to make resolver faster

There are many factors that affect resolver speed. First and foremost is: Can it reply from cache? Where it is possible, the time to reply is just the "round-trip" time for a packet from the client to the resolver.

When the resolver needs an answer from an authority, things get a bit more complicated because the resolver needs to keep track of the DNS hierarchy to resolve domain names, which means it has to talk to multiple trusted servers starting with the domain name. starting from the origin server. For example, a resolver in Buenos Aires, Argentina will take longer to monitor the DNS hierarchy than a resolver in Frankfurt, Germany because it is close to trusted servers. To solve this problem, we have to pre-populate the cache, out-of-band for common names, which means that when an actual query comes in, responses can be retrieved from the cache. much faster.

One problem with scale-out networks is that the cache hit rate is inversely proportional to the number of nodes configured in each data center. If there is only one node in the nearest data center, you can be sure that when you ask the same query twice, you will get a cached answer the second time. However, because there are hundreds of nodes in each data center, users may receive unresolved responses, introducing latency for each request. A common solution is to place a cache load balancer in front of all resolvers, but this becomes a single-point-of-failure for the entire system and Cloudflare. do not do it. Instead of relying on a centralized cache, DNS resolver 1.1.1.1, uses an advanced distributed cache.

Data policy

Cloudflare claims to never store customer IP addresses and only uses query names to improve DNS resolver performance (such as filling caches based on popular domains in a region and /or after blurring).

Cloudflare will never store any information in logs that identifies the end user, and all these collected records will be deleted within 24 hours. The company said it will continue to follow its privacy policy and ensure that no user data is sold to advertisers or used to target consumers.

How to set up DNS resolver 1.1.1.1

TipsMake.com has quite specific instructions on how to set up this DNS on PC and mobile, if you are interested you can follow it.

A few things about the DNS resolver address

Cloudflare worked with APNIC and used IPv4 addresses 1.0.0.1 and 1.1.1.1 (everyone agreed these addresses were easy to remember). Without years of research and testing, these sites would not have made it into production.

For IPv6, the company has chosen 2606:4700:4700::1111 and 2606:4700:4700::1001 for this service. As you know it's not easy to get an IPv6 address, however, they chose an address that only uses numbers.

But why use an easy-to-remember address? What's special about this public resolver? The first thing to do in this process is where to put these numbers. They need a number that can be entered into any computer or connected to the device the user uses to find the resolver service.

Anyone on the Internet can use this public resolver, and you can see how it's done by going to https://1.1.1.1/ and clicking GET STARTED .

Why announce the release of DNS resolver in April?

For most people in the world, Sunday is April 1, 2018 (In the US, the way the date is written will be the month before the day after January 4, 2018). Do you see 4 and 1? That's why Cloudflare announced on this day, four numbers one (1.1.1.1).