fix
OpenDNS Offers DNS Vulnerability Protection
Posted by Gina Trapani at 11:30 PM on July 29, 2008
Tech site Webmonkey advises users not sure whether or not their DNS servers are patched against a recently discovered vulnerability to switch to the excellent, free DNS service, OpenDNS. Test your DNS server for the vulnerability here and get Webmonkey's instructions for setting up OpenDNS . (We love OpenDNS so much it was one of our best apps of 2006.)

Comments (AU Comments · US Comments)
There are currently no AU comments for this post.
Buddha916
Posted 1:11 AM 30/7/08
People using OpenDNS are funny.
"It's great, it has no downside!"
Really, then you don't know much about DNS.
OpenDNS breaks RFC compliance.
It fails to offer proper error pages for sites, and instead sends you to THEIR OWN pages.
It also plays tricks with Google search to use THEIR OWN google page.
you can of course get around these, but the very idea of it being done in the first place is offensive to me.
Buddha916
kc2idf
Posted 1:06 AM 30/7/08
I have been using OpenDNS for a few years now, mostly because our local RoadRunner DNS servers keep disappearing from the network and RR tech support doesn't want to talk to me because I don't run Windows.
kc2idf
Torley
Posted 12:56 AM 30/7/08
I've used OpenDNS for awhile - I haven't noticed a conscious difference (not in speed nor otherwise), altho the benefits may've been under-the-hood all along.
Torley
Paperclip
Posted 12:50 AM 30/7/08
I've been using OpenDNS for a couple of years. It's great! Safe and fast.
Paperclip
YachiraG
Posted 12:45 AM 30/7/08
I've been using OpenDNS for over a year. There is NO downside. Packed with features, great for family computing, secure, fast, and free. What more could you ask for!
YachiraG
snowmentality
Posted 12:44 AM 30/7/08
OpenDNS irritated me when I tried it, because it wouldn't resolve an address I typed without the preceding "www." The example in the linked article is "wired.com" -- had I just typed that, rather than "www.wired.com," it would have complained that it couldn't find it.
I hope they've fixed that. If they can do spelling correction, they can surely do that.
snowmentality
joelena
Posted 12:36 AM 30/7/08
I have used OpenDNS in the past, but I hate that it attempts to resolve addresses for you - I vastly prefer Firefox's "I'm feeling lucky" Google search. I seem to remember it even prevented keyword bookmarks from working (though I could be mistaken).
Is there a way to avoid that?
joelena
robdew
Posted 12:33 AM 30/7/08
Read their privacy policy carefully and make sure you agree to their tracking of site information.
robdew
HChKn
Posted 12:32 AM 30/7/08
Wow, just a day after I started using it. Are you guys spying on me or something?!
HChKn
WarBread
Posted 12:25 AM 30/7/08
It's a great service for small business. I personally have had SMTP/DNS resolution issues with OpenDNS. They really didn't address their issues at that point in time.
However, as stated above, OpenDNS has continually added fuctionality and fixed flaws. If you don't mind having your traffic monitored by a third party, OpenDNS is excellent. We've implemented it at a few non-profits and high schools in the area to lock down browsing.
WarBread
whoisvaibhav
Posted 12:16 AM 30/7/08
I have been using it forever I think. Here's a benchmark comparison I did for OpenDNS performance in India (considering that they don't have any servers located here): OpenDNS Performance in India
whoisvaibhav
the_gank
Posted 12:13 AM 30/7/08
same here...just put those two dns ip address on the router and it's like putting butter over cheese...
the_gank
MrGutts
Posted 12:10 AM 30/7/08
Yeah I have also been using it since 2006 and it's been great to me, plus it's fast as hell. Never ever deal with the ComCrap Crappy dns servers.
MrGutts
y0himba
Posted 12:07 AM 30/7/08
I have been using OpenDNS since July of 2006, it's outstanding. They have added so many features and have come a LONG way.
This is a must have.
y0himba
tasselhoff76
Posted 1:54 AM 30/7/08
Ok that was weird.
tasselhoff76
tasselhoff76
Posted 1:54 AM 30/7/08
@Buddha916: I don't seem to be having the Google issue you and many others describe. Maybe they changed something internally? Even pinging seems to work. I can see switching over this. I am not sure I can see switching over it redirecting you over a mistyped url. It's annoying, to be sure, but not a big enough issue.
tasselhoff76
tasselhoff76
Posted 1:52 AM 30/7/08
@Buddha916: I don't seem to be having issues with it using its own Google page for searches. I've tried pinging and I seem to get a response from Google. I am not sure why - maybe they changed something in the last few months? I guess the being redirected when you enter the wrong url is annoying, but not so annoying that I would stop using the service.
I would switch over the Google thing, but not the url thing.
tasselhoff76
imrcly
Posted 2:09 AM 30/7/08
If you are using split tunneling with your VPN opendns will cause your internal resolution to not work because OpenDNS resolves everything breaking RFC compliance. Split tunneling generally relies on the fact that internal addresses are not on public DNS and the fact that the DNS will time out to resolve on internal DNS servers.
imrcly
rcrowley
Posted 2:37 AM 30/7/08
@imrcly: We hear you on the VPN issue. In your OpenDNS account you can setup typo exceptions for your VPN's domains. That will make our DNS servers yield to your company's for those domains so you can continue to use OpenDNS for the public Internet without losing functionality on your VPN.
rcrowley
sceo
Posted 2:33 AM 30/7/08
I love and use OpenDNS because they're far more reliable than my ISP's servers. I can live with their ad/search pages (that's the deal you make when you sign up with them, and they're forthright about it). What I wish they DIDN'T do was ignore TTL's. It's really difficult to know if my DNS changes have propagated to "most of the world," knowing that OpenDNS caches whatever it wants for longer than the master-server tells it to. But oh well, like I said - I deal with it because of the reliability.
sceo
nsxstorm
Posted 2:50 AM 30/7/08
Just started using OpenDNS a few weeks ago b/c my ISP's DNS server was a joke. It's made internet browsing faster and more reliable.
I also like that you can set filters to block certain sites or groupings of sites. It's a nice alternative or addition to using a client-side filter. (If you need/want one that is)
nsxstorm
JrezIN
Posted 3:46 AM 30/7/08
I do like OpenDNS... but CAN'T STAND their "guide"...
If some site doesn't work, I want to be able to refresh it... not see a lot of junk and have to manually edit the URL bar to try this site again (they usually don't even put a direct link to the url you just tried... it's not a bug problem with front side pages, but when you're following a link inside some site...
...again, I do like OpenDNS... I just want they to better follow the RFC compliance and these annoyances.
JrezIN
_Jonny
Posted 3:50 AM 30/7/08
Yes those are really annoying, almost to the point where I don't want to use OpenDNS anymore.
There's a firefox config that uses the google search in preference if you type in lifehacker or something, it'll bring you to lifehacker search results, but the error webpage not found/unavailable, etc. is annoying and I'd prefer the default local FF3 error messages.
_Jonny
crazylady
Posted 5:54 AM 30/7/08
@YachiraG: I care when things break. opendns breaks things sometimes. shows me stupid messages i do not want to see.
if you don't know what it is it probably doesn't apply to you. but if you know what it is you probably know enough to patch your own dns servers..but you don't have a choice if your ISP is staffed by morons. Since my ISP *is* staffed by morons, I'm using opendns only to tide me over till they fix this vulnerability.
Now, I will note that you could probably set up opendns to return NXDOMAINs and all, but it's a big hassle.
crazylady
YachiraG
Posted 5:45 AM 30/7/08
@Buddha916: Who cares about "RFC Compliance" Jeez.... And as far as the ads go, I don't think I've ever seen them....i.e. have no idea what you're talking about.
YachiraG
OctDev
Posted 2:03 AM 30/7/08
@tasselhoff76: Probably some weird OpenDNS issue.
OctDev
Elitesean
Posted 1:15 AM 30/7/08
@joelena:
To disable OpenDNS's URL hijacking service, simply open "about:config" in a new tab in Firefox, ignore the notice and continue, type 'keyword' in the Filter toolbar on the page, double-click on Keyword.URL row, change "http://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=" to "http://www.google.com/search?ie=UTF-8&oe=UTF-8&gfns=1&q=" and you're done! I suppose they have to make money somewhere, but they could make it a bit nicer.
Good luck
Elitesean
Elitesean
Posted 1:12 AM 30/7/08
@joelena:
To you and anyone else interested, you can avoid this by opening "about:config" in the url bar and going to it, continue through the warning about not to mess with it, type 'keyword' into the Filter toolbar on the page, double click on Keyworld.URL item and change from "http://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=" to "http://www.google.com/search?ie=UTF-8&oe=UTF-8&gfns=1&q=". Click OK, close the Tab and never see that ugly page again (it's the only downside of OpenDNS, but they've got to make money somewhere!).
Good luck.
Elitesean
tasselhoff76
Posted 7:49 AM 30/7/08
@OctDev: Ha. Yeah, I figured someone would say that.
tasselhoff76
socioecoboy
Posted 7:38 AM 30/7/08
I'd learned and forgotten about this. Thank you for helping to speed up my connection times.
socioecoboy
arungupta
Posted 9:05 AM 30/7/08
OpenDNS has a problem. If a hostname does not exists on my network, OpenDNS resolves the name to a fictitious IP address. This is unacceptable. It breaks my VPN connectivity to servers at work.
arungupta
JoshuaB
Posted 10:20 AM 30/7/08
arungupta & others,
My major problem with openDNS is breaking local LAN resources. They resolve their own search page's IP when trying to access private name. Eg. "server" might resolve to 192.168.0.2 but OpenDNS doesn't resolve this and things start breaking.
You can exclude these names individually in OpenDNS's configuration. I think they're called shortcuts, but can't remember.
However, the best way to set this up is with a local DNS server that can attempt to resolve names locally, if it fails, then try OpenDNS. In Windows Server's DNS, its called Forwarders. This is especially nice, but hard to find on SOHO routers (Linksys, Dlink, etc).
It's also important to note you either need a static IP to properly maintain configuration. That, or a dynamic ip updating service.
JoshuaB
JoshuaB
Posted 10:59 AM 30/7/08
arungupta & others,
My major problem with openDNS is breaking local LAN resources. They resolve their own search page's IP when trying to access private name. Eg. "server" might resolve to 192.168.0.2 but OpenDNS doesn't resolve this and things start breaking.
You can exclude these names individually in OpenDNS's configuration. I think they're called typo corrections, but can't remember.
However, the best way to set this up is with a local DNS server that can attempt to resolve names locally, if it fails, then try OpenDNS. In Windows Server's DNS, its called Forwarders. This is especially nice, but hard to find on SOHO routers (Linksys, Dlink, etc).
It's also important to note you either need a static IP to properly maintain configuration. That, or a dynamic ip updating service.
JoshuaB
arungupta
Posted 11:50 AM 30/7/08
@JoshuaB:
The problem with this approach is that I have to remember to do this. Sometimes I spent lot of time troubleshooting before I realized that it is OpenDNS issue. My ISPs DNS servers do not do this.
Why is OpenDNS doing this, any ideas?
arungupta
JoshuaB
Posted 9:34 PM 30/7/08
@arungupta,
Yes, it is a pain. If you have a nice DNS server on the LAN, its easy. But if your a home or small business, it is pretty difficult. Especially when adding devices.
I imagine they're making money... that's why the resolution of any address.
I don't comment often on Lifehacker... are the comments delayed? I hate I got a dupe up there.
JoshuaB
dromedary512
Posted 3:45 AM 31/7/08
I don't really know much about this "OpenDNS" (granted, on the surface, it sounds a lot like a sham)... but... if you're savvy enough to setup your own DNS server to resolve local names... I cannot fathom why you would then fail over to these yahoos instead of simply using a standard root nameserver cache.
To be honest... most of the ranting and raving I've seen about how great this service is... looks all the world like astroturf.
I mean, really... DNS isn't all that hard.
dromedary512
woolwit
Posted 5:37 AM 3/8/08
I switched to 'open'DNS after Verizon started hijacking my browsing error traffic, i.e. when I mis-spelled a url in my browser bar I'd get directed to Verizon's suggestion page full of (Google feed?) ads to click on. About a week later- this is with the typo correction setting set to OFF- OpenDNS started directing my error traffic to their (page
full of ads to click on)'Guide'. I actually find this even more offensive because they call themselves 'Open', when in fact they are not open software. They are a private for-profit DNS service. I think they
have business model issues. I wish there were a real OpenDNS service.
woolwit