NextDNS logging is opt-out, not opt-in as stated on PG's DNS Resolvers recommendations page

[dngray (Daniel Gray)]

@ignoramous

NextDNS’ “log storage location” feature is misleading in light of their use of all these other global service providers

This is largely speculation that GCP is logging everything regardless of a downstream privacy policy. One could make a similar argument that colocation isn’t even good enough because a datacenter might track incoming IPs on their firewall.

I do agree though they should be clearer about their sub processors though. Their Privacy policy is likely brief for brevity reasons (and maybe too much so).

Hopefully we hear back from them soon.

@ignoramous

@dngray

NextDNS does partner with Mozilla and other companies which do care about privacy so that has to mean something

You’ll notice that it is a separate endpoint and not the one sold to users or recommended by PrivacyGuides. Cloudflare does the same (they’ve got a Mozilla specific endpoint).

That may be so, and due to scaling and provisioning. They would still have to have some competency as a service. This isn’t really evidence that the services are run in a vastly different way.

@ignoramous

@dngray

I can’t see how you’d be bound by a NDA on an agreement you didn’t accept.

NDAs are signed before you even take such meetings.

All of this really can’t be verified, so lets drop that. I do find it odd you’d sign an NDA with a company before you even know what the meeting will be about/without contacting a lawyer though.

@ignoramous

My point is, get more clarity before recommending dns0.eu as “no logs”. Cloudflare also gathers intel as does Quad9, and both are marked as such on PrivacyGuides: https://www.privacyguides.org/en/dns/#fn:2

@pinkandwhite

As I said, threat intel is unlikely to have people’s personal data (I guess dns requests in this case) unless they’re doing something that’d make an alert fire off, because to do otherwise would make the threat intel pretty useless and overly broad

Their privacy policy does state though:

We do not log any Personally Identifiable Information (PII).

Our recursive DNS service, this website and other services we provide are fully compliant with the GDPR, and we welcome audits from reputable European entities.

The zero service seems to be information that isn’t specific to dns0. I don’t think you can really argue that Newly Registered Domains or Newly Active Domains are logging. Is it really logging if they look at whois records of requests going through their system? When people think of DNS logging they think of logging the client’s IP, ie who is requesting what domains. I don’t think their service is doing that. We don’t have any evidence that indicates that they do.

If you really can’t trust a privacy policy then you will have to depend on technical means for anonymity.