Currently I’m not an OpenDNS user and I just figured out I will never be…
OpenDNS provides 2 DNS servers which (they claim) are safer, faster and smarter. They are safer because they protect you from phishing sites. If you do a DNS request for a site which is know for phishing you will be redirected to another site. They are faster because they got this huuuuuuuge cache so they can server DNS requests from their cache and don’t need to ask other DNS servers. And, finaly, they are smarter because the correct spelling mistakes. If you are like me and sometimes type the wrong top level domain OpenDNS will correct it for you. For example typing www.linux.ogr will be corrected to www.linux.org. Great huh?
Well, not quite… They say it’s faster. I’ve used it a while and I can’t say it’s faster. It actually seemed to be slower than using my providers DNS servers. Maybe my provider (multikabel) has fscking fast DNS servers, but somehow I don’t believe that. I just think OpenDNS servers are not as fast as they claim.
The ’safer’ and ’smarter’ bit are actually the same. When an OpenDNS server receives your request for a domain it evaluates the request. They look if it’s a phishing site and if so, they redirect you. If your input is wrong they look for matches with the domain and either present you with a search engine like page with close hits, or redirect you to the page you most likely mean at their opinion. So, in both cases they tamper with your original DNS request.
The problem with this is that DNS should not be used to protect anyone from phishing sites. Don’t get me wrong, phishing is a crime but basically phishing relies on people being stupid and not verifying the pages they are on or just blindly give information that the original site would never ever ask.
The second bad thing is that they actually rewrite your DNS request. When you make a typo you will land on a totally different site which you didn’t request. When you do a wrong DNS request the behavior is to get an error that the domain doesn’t exist. Imagine you make the same typo again and again, you type www.opendns.cmo without noticing it. OpenDNS will make sure you will get to the right site because they are so kind to modify the request. After that you get to use a computer that doesn’t use OpenDNS and now you are going to have a hard time reaching the site. Yes, of course we ALL know it should be .com, but if it’s always corrected for people, there will be idiots that don’t understand DNS anymore and will be totally confused by the “Server not found”. I can already see my users complaining. “The internet is broken, because when I type www.opendns.cmo I don’t reach their site. At home it works so there’s something wrong with your network. FIX IT!”. We all know how users are…
Moreover, OpenDNS decided that when you request www.google.com you actually request google.navigation.opendns.com. Yes, did read it correctly. They decided you actually didn’t want to reach www.google.com, instead you get redirected to one of their own sites which looks remarkably much like googles own site. But hey, isn’t this what phishers do? Well, yeah, but since you voluntarily decided to use OpenDNS it’s not really phishing anymore because they didn’t force you to use it, and it’s probably somewhere in their Terms but I didn’t read them completely. Yes, they are open about doing it. But when asked on the forum about this they took one month to respond. Now, that’s strange isn’t it?
When asked on their forums why OpenDNS did this they replied that Dell and Google are the guilty parties. Dell installs the google toolbar with another tool on the computers they sell. This software redirects DNS requests to unknown domains to their own site with similar pages and some adds. The OpenDNS people responded furiously. How the HELL could Dell and Google do this!!! You should not be allowed to redirect unknown requests to other pages with adds!!! Well, guess what, they are furious because this one of the things OpenDNS makes money with. With the google software installed OpenDNS will miss profit. So, they made sure that requests from the google program gets filtered through their own google site so they can redirect is themselves.
Yes, Google and Dell did go too far with this tool. They shouldn’t have installed it on they hardware that Dell sold. But then again, OpenDNS did go too far too… It’s something like “The Pot Calling The Kettle Black”. In my opinion DNS is something that shouldn’t be tampered with. You of course are totally free to use whatever DNS system you want. But I just think it modifies the ‘reality’ of the internet. The next step will be censorship (which OpenDNS currently doesn’t do) through DNS… and then it really gets scary…