跳至正文
Wener Notes

DNS Awesome

约 6 分钟阅读
标签：资源精选

推荐 DNS 配置

  • 选择支持分流的 DNS 服务、支持 DoH/DoT 解析的服务
    • AdGuard、PiHole
  • 默认走国内 DNS
    • 因为国内很多服务 CDN 依赖 DNS 解析，使用国外 DNS 可能导致 CDN 出问题，访问非常慢或打不开
    • 国内 DNS 更快
  • 选择会被污染的域名走 DoH/DoT 解析
    • DoH 和 DoT 不会被污染
    • 即便是用国外的 DNS over TCP/UDP 也是会被污染的，协议层不安全
bash
# DoT tcp 853
kdig @223.5.5.5 +tls-ca wener.me
# kdig @120.53.53.53 +tls-ca wener.me
fping 223.5.5.5 223.6.6.6 8.8.8.8 1.1.1.1 119.29.29.29 120.53.53.53 -l

# 检测 DNS 配置
curl https://nstool.netease.com/

DNS Provider

ProviderPrimarySecondaryIPv6DoHDoTDoQECSECS-Override
Google8.8.8.88.8.4.4dns.googledns.google✓✓✓
Cloudflare1.1.1.11.0.0.1cloudflare-dns.com
one.one.one.one		1dot1dot1dot1.cloudflare-dns.com✓✗✗
Quad99.9.9.9149.112.112.112dns.quad9.netdns.quad9.net✓✓✗
Cisco OpenDNS208.67.222.222208.67.220.220doh.opendns.comdns.opendns.com✗✓✗
国内
Aliyun223.5.5.5223.6.6.6dns.alidns.comdns.alidns.com✗✓✗
腾讯 DNSPod119.29.29.29182.254.116.1162402:4e00::doh.pubdot.pub✗✓✗
114DNS 中国电信114.114.114.114114.114.115.115
百度180.76.76.762400:da00::6666
protocolurl
UDP1.1.1.1
TCP1.1.1.1
DoTtls://1.1.1.1
DoHhttps://dns.wener.me/dns-query?name=wener.me&type=A
abbr.stand fornotes
DoHDNS over HTTPS通过HTTPS协议加密DNS查询
ODoHOblivious DNS over HTTPSRFC 9230, 隐私增强, Proxy 无法感知内容
HPKEHybrid Public Key EncryptionODoH实现中使用的加密标准
DNSSECDomain Name System Security Extensions验证DNS响应以防止欺骗
DNSKEYDNS Public KeyDNSSEC中使用的公钥记录
DoQDNS over QUIC通过QUIC协议的DNS查询，提供更好的性能
ECSEDNS Client Subnet允许DNS解析器指定客户端子网以优化CDN响应的扩展
yaml
- name: google
  url: https://developers.google.com/speed/public-dns
  services:
    - hosts:
        - 8.8.8.8
        - 8.8.4.4
        - 2001:4860:4860::8844
        - 2001:4860:4860::8888
    - host: dns.google
    - host: dns.google.com
      notes: since 2020-06-23 -> dns.google
    - hosts:
        - 2001:4860:4860::6464
        - 2001:4860:4860::64
      notes: DNS64
  notes: DoH 支持 `GET /resolve?` 的 JSON-API

- name: cloudflare
  url: https://developers.cloudflare.com/1.1.1.1/
  services:
    - hosts:
        - 1.1.1.1
        - 1.1.0.0
        - 2606:4700:4700::1111
        - 2606:4700:4700::1001
        - one.one.one.one
        - cloudflare-dns.com
    - title: Block malware
      hosts:
        - 1.1.1.2
        - 1.0.0.2
        - 2606:4700:4700::1112
        - 2606:4700:4700::1002
        - security.cloudflare-dns.com
    - title: Block malware and adult content
      hosts:
        - 1.1.1.3
        - 1.0.0.3
        - 2606:4700:4700::1113
        - 2606:4700:4700::1003
        - family.cloudflare-dns.com
    - title: Oblivious DNS over HTTPS
      hosts:
        - odoh.cloudflare-dns.com
    - hosts:
        - http://cloudflare-ech.com/

- name: quad9
  url: https://quad9.net/service/service-addresses-and-features
  services:
    - hosts:
        - 9.9.9.9
        - 149.112.112.112
        - 2620:fe::fe
        - 2620:fe::9
        - dns.quad9.net
      features: [Malware Blocking, DNSSEC Validation]

- name: aliyun
  url: https://alidns.com
  services:
    - hosts:
        - 223.5.5.5
        - 223.6.6.6
        - 2400:3200::1
        - 2400:3200:baba::1
        - dns.alidns.com
bash
curl 'https://dns.google/resolve?name=wener.me&type=A'
ini
#AliDNS
223.5.5.5
223.6.6.6
2400:3200::1
2400:3200:baba::1
dns.alidns.com

#DNSPod
1.12.12.12
120.53.53.53
doh.pub
dot.pub

#360
101.198.191.4
101.199.254.118
106.63.24.74
111.7.73.60
112.65.69.15
123.6.48.18
180.163.249.75
221.181.72.233
36.99.170.86
39.156.84.71

#OpenDNS
208.67.222.222
208.67.220.220
2620:119:35::35
2620:119:53::53
146.112.41.2
146.112.41.5
2620:119:fc::2
2620:119:fc::5

#HiNet 中華電信
168.95.1.1
168.95.192.1
2001:b000:168::1
2001:b000:168::2

#Cloudflare
104.16.132.229
104.16.133.229
2606:4700::6810:84e5
2606:4700::6810:85e5

#Google
8.8.8.8
8.8.4.4

#Cloudflare
1.1.1.1
1.0.0.1

#DNS.SB
#HK
45.125.0.26
#JP
103.121.210.210
202.5.221.130
#KR
3.34.32.82
#SG
165.22.61.129

#NextDNS
#HK
45.11.104.186
#TW
45.150.242.161
#JP
103.170.232.254
#KR
103.127.124.46
#SG
194.156.163.172

Server

Block

bash
curl https://raw.githubusercontent.com/jdlingyu/ad-wars/master/hosts -so ad-wars.txt
# 拆分为 1000 列表方便 cloudflare 导入
grep '127.0.0.1' ad-wars.txt | grep -v '#' | awk '{print $2}' | sort -u | split -l 1000 -d --additional-suffix '.csv' - ad-wars-

mDNS

Misc

GFW

Well Known Domains

domainfor
pki.googGoogle Trust Services

污染封禁域名列表

不要走国内解析

bash
# for dnsmasq
curl -L https://raw.githubusercontent.com/wenerme/wener/master/notes/service/dns/gfwlist.txt \
  | sed -E 's#.+#address=/&/172.32.1.1#'

#
curl -L https://raw.githubusercontent.com/gfwlist/gfwlist/master/gfwlist.txt | base64 -d > gfwlist.txt

# address=/docker.io/$SNI
curl -sfL 'https://github.com/wenerme/wener/raw/master/notes/service/dns/gfwlist.dev.txt' | sed -e 's#.*#address=/\0/$SNI#'

grep -E '^([|]{2}|[.])' gfwlist.txt | grep -v '/' | grep -v '[*]' | wc -l | sed 's/^[|.]*//' | sort -u

curl -LO https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/refs/heads/meta/geo/geosite/gfw.list
sed -i -e 's#^+.##' gfw.list

Bypass

text
netflix.com
netflix.net
chat.openai.com
bard.google.com

CDN

  • ghcr.io -> pkg-containers.githubusercontent.com

reverse

  • 112.46.2.37
    • pcs.baidu.com
    • 百度网盘
  • public-dns-a.baidu.com

关联信息

反向链接、本文链接的其他页面和外部资料。

站内链接

  • AdGuard
    笔记 · adguardhome

    AdguardTeam/AdGuardHome · | port | for | · | 53 | DNS | · | 67,68 | DHCP | · | 80,443,3000 | DoH | · | 853 | DNS over TLS |

  • blocky
    笔记 · 0xERR0R/blocky

    0xERR0R/blocky · Apache-2.0, Go · Blocking · 支持自定义规则 · 支持多协议 · DNS over UDP and TCP · DNS over HTTPS (aka DoH) · DNS over TLS (aka DoT)

  • PowerDNS
    笔记 · pdns

    PowerDNS/pdns · GPLv2, C · Authoritative Server · PowerDNS Recursor · PowerDNS DNSdist · PowerDNS Cloud Control · PowerDNS Dstore

  • PowerDNS Recursor
    笔记 · pdns recursor

    https://doc.powerdns.com/recursor/settings.html

参考资料

GitHub34 条
Wikipedia3 条
其他外链36 条
最近更新commit d1d6167编辑

Blocky

上一页

DNS FAQ

下一页