DNSLeak to Airtel when using Quad9

Code: 
lmg@serv113-ent:~$ python3 ./dnsleak.py
Your IP:
203.192.206.XXX [India, AS17665 OneBroadband OneOTT Intertainment Limited]
You use 1 DNS servers:
125.20.246.123 [India, AS9498 Airtel]

lmg@serv113-ent:~$ dig +short ch txt id.server. @9.9.9.9
"res200.bom2.rrdns.pch.net"


If I use Cloudflare.
Code: 
lmg@serv113-ent:~$ python3 ./dnsleak.py
Your IP:
203.192.206.XXX [India, AS17665 OneBroadband OneOTT Intertainment Limited]
You use 3 DNS servers:
172.69.75.76 [India, AS13335 CloudFlare Inc.]
172.69.75.78 [India, AS13335 CloudFlare Inc.]
172.69.75.79 [India, AS13335 CloudFlare Inc.]
 
Last edited:
I am concluding this as a bad config from quad9's end.

This would mean that either I am talking to quad9 exclusively or Airtel is actually listening to my requests.
It can also mean, PCH is running on Airtel's donated DC space.

For now, I will avoid using quad9. It wasn't a good resolver anyway, performance wise.
 
Having similar issue, got this as reply from them
This is expected in our "bom2" Mumbai location. Our network partner is unable to announce their unicast IP space there via BGP, so we have to use some bandwidth donated by Bharti Airtel to perform outbound DNS queries. This network is not used between the client and Quad9; only between Quad9 and the root / authoritative DNS servers.

on.quad9.net is the source of truth. We have a few global locations with a similar network configuration, so a DNS leak test will yield unexpected results in those few locations, but this our expected IP address in Mumbai.
Click to expand...
 
ping dns10.quad9.net -4
PING dns10.quad9.net (149.112.112.10) 56(84) bytes of data.
64 bytes from dns10.quad9.net (149.112.112.10): icmp_seq=1 ttl=59 time=63.4 ms
64 bytes from dns10.quad9.net (149.112.112.10): icmp_seq=2 ttl=59 time=63.8 ms
64 bytes from dns10.quad9.net (149.112.112.10): icmp_seq=3 ttl=59 time=63.6 ms
64 bytes from dns10.quad9.net (149.112.112.10): icmp_seq=4 ttl=59 time=63.5 ms
(Singapore)


ping dns10.quad9.net
PING dns10.quad9.net (2620:fe::fe:10) 56 data bytes
64 bytes from dns10.quad9.net (2620:fe::fe:10): icmp_seq=1 ttl=59 time=129 ms
64 bytes from dns10.quad9.net (2620:fe::fe:10): icmp_seq=2 ttl=59 time=129 ms
(Frankfurt)
 
hi all,
what is peered isp?
BTW, i post here to say that even i am seeing airtel (125.20.246.123) as dns server (getting almost ALL of the hits) when checked on ipleak.net
I am using dnscrypt on my PC (windows), actually a mix of dnscrypt and doh and dot and quic.... In short, all encrypted thingies. but still how am i seeing airtel as one of the dns server?
Anyone? so this post mentions quad9 to use airtel for root dns queries, what impact it has my isp snooping/filtering my dns queries?
Please help. BTW i am not networking guy, and dont really care for ping time, just want the isp out of my dns queries.
 
@pinoco Keeping it simple, since you mentioned you are not a networking person.
You can safely ignore the Airtel IP when seen via DNS Leak, if you are using Quad9 with any kind of encryption.
This does not mean that Airtel or any other ISP can see your queries.

Technical Explanation below:
Quad9 is a non-profit foundation, hence they mostly use equipment and circuits that is donated by others.
In this instance, Airtel has donated some bandwidth to Quad9 so they can use it to make detailed lookups from the main root servers. (If you want to know what is root server then you can read this https://www.cloudflare.com/learning/dns/glossary/dns-root-server/).
The only downside of Quad9 using Airtel for bandwidth, is that it shows up on dnsleak.
To mitigate this, Quad9 can use their own IPs but those costs money. Regardless, Q9 using Airtel does not change anything.
 
Last edited:
You must log in or register to reply here.
Back