Do you have a specific objective you're looking to achieve?
It depends on what you mean by secure and worth it. DNS isn't really a security service. But as others have mentioned, there are things you can do to make using DNS more secure. Those being DoH (DNS over HTTPS) or DoT (DNS over TLS) and DNSSEC (adds authentication to DNS queries). These cut down on the possibility of your DNS queries being intercepted and altered. I can understand why it's confusing as Cloudflare's marketing is a bit misleading, describing their service as safer. Yet out of the box their service does nothing to increase your safety. If you want that, by means of Malware blocking, then you need to use their 1.1.1.2 and 1.0.0.2 IPs. Which you have to go digging to find. You'd still need up-to-date anti-virus software as, with most things IT, a multi-layered approach is best.
If security with privacy are being conflated, then again as others have stated, it's rather trivial for your ISP to spy on your traffic to see what you're accessing. If privacy from your ISP is a concern, then you should be looking at a VPN service. I'd recommend something WireGuard based. But even then you're essentially just swapping one ISP for another.
Personally I use quad9.net's offering via DoT with DNSSEC for that extra peace of mind. It does Malware blocking as standard. Plus, even if it's slower to resolve than Cloudflare DNS, the 1, 2 or even a few hundredths of a second make no difference in real world applications.
Edited by Noolah (Tue 12-Mar-24 09:52:08)
Print Thread
