Fedora mulls providing a local DNSSEC resolver

Fedora mulls providing a local DNSSEC resolver

I like this idea from a security standpoint. But there are going to be a lot of practical problems implementing this for laptop users.

For one, many wifi hotspots rely on DNS hijacking to present you with the login page. This will mean that you never see that login page, and thus are never allowed to log in to stop your packets from being blackholed.

For another, content deliver networks like Akamai use your DNS request to figure out what network you're on, and thus direct you to a topologically close server. They keep a big map of the most common DNS resolvers on the Internet, with metrics for how close each of those networks are to each of their data centers. If you're running your own resolver, you won't be in their database and thus will most likely get a more generic result. There are other techniques used to mitigate this somewhat, but it's still likely that you'll get somewhat worse performance for content hosted on CDNs if you run your own personal resolver rather than using your ISP's.