Does using OpenDNS or Google DNS affect anything about security or gaming speed?

Question

I used to use google DNS and OpenDNS long time ago, didn't notice any improvements. I recently heard a security expert saying that OpenDNS is the best way for malware protection. But found out that this feature isn't free.

I saw a gamer saying that google DNS is faster for regular users and OpenDNS is better for gamers because of lower ping, and all of the bloggers recommend using a DNS service.

My brother noticed that both providers had higher ping on steam than our default DNS provider and he read that DNS won't affect Dota 2 on steam in anyway.

I did my tests, in incognito and flushed DNS after each test, I let speedtest pick the closest DNS. My results are:

• Default DNS

---

• Google DNS

---

• OpenDNS

---

All results are similar if not worse than the default DNS, if anything OpenDNS has the lowest ping but by a small margin, if I were to repeat tests that gap would go away.

Does DNS providers really affect speed or security or gaming? Gaming nowadays is mostly on steam, so does it affect steam?

Answer 1

DNS has no effect on ping whatsoever. It is nonsense. DNS provides name resolution services and that is it. Nothing more and nothing less.

Your internet connection does not go through the DNS server, nor would routing through it improve your speed as chances are you will be going through several other connections (potentially on the wrong side of the world) before heading back to where you wanted to go. This does not happen normally anyway.

What Google or OpenDNS might provide you is a slightly faster resolution of names to IP address and possibly some level of protection from known malware domain names.

You might get a quicker initial name resolution, especially if your ISP has a small DNS cache and doesn't see requests for that site often, but after the first request both your server and local machine will cache the request meaning that Google or OpenDNS will be slower if there is a large distance between you and their servers. There will be no improvement to ping tests at all except for possibly the initial lookup.

---

I've said it in a comment above, but your tests are also not fair for the purposes of your testing. Using speedtest is not relevant for testing DNS and the tests you have run are resolving to different servers with different speeds or locations which will unfairly skew your results. If you want to prove that DNS makes no real difference then you need to be selecting the same server each time.

As to why DNS will make no real difference? It is because it is used in the first half-second of your connection to a server (to resolve a name to an address) and maybe if your cache times out then it will use it again. You might save a fragment of a second in getting the IP address of your game or Steam server, but after that the software will always be taking the direct route to the server and the speed will be the same regardless of DNS server used.

---

Having a fast DNS server can be good if you are browsing websites that are particularly laden with off-site resources such as social media buttons, advertising images and scripts and other resources which all need their locations resolved. This can be particularly annoying to most users as it appears to be the main site being slow when in reality it is the resolution and download of all the "extra" resources that makes the site slow.

Many people may equate this slow resolution of resources as being the sites "ping" being bad, when in all actuality the sites ping is perfectly fine. If the site loads faster with the DNS changed then it is your DNS server that is bad, not the sites speed or ping (latency). These are two very different things.

I've made a quick drawing of what (roughly) happens.

For existing connections and if the name is in your local cache you will see no benefit to changing your DNS. If the names are not in your cache then changing the DNS can make a brief improvement at the start of the connection.

Answer 2

Well, other people have pointed out the malware, speed and ping points. I'll talk about the fourth and fifth point, which dns actually very clearly helps: Censorship (and bugs in DNS Servers) and Privacy.

In my case, changing your DNS server allows you to circumvent through the DNS blocks (there are currently 113683 blocked websites in Turkey) and connect to some* blocked websites. Most people here uses a DNS on their computers to be able to connect to the popular blocked sites.

About an issue that might affect everyone, there might be issues with the DNS servers, mostly slow speeds, non-%100 uptime and some sites not having proper DNS records (as a bug). As the first two are mostly mentioned by other answers, I'll talk about the last. This is actually very rare and can be caused by many reasons, however this happened to me once and I'll mostly shortly talk about that case. A site was inaccessible using Google DNS but was fine with any other DNS servers, we got the owners to contact google and the site got working on Google DNS again in a few hours. This is simply an example of how your DNS choice can affect you, even when it doesn't have censorship (or you don't care about your privacy).

Also, your DNS queries can be viewed easily if you get MitM'd or, for example, your company or your ISP is tracking you. While other DNS servers' queries will be visible to them too, most people who uses OpenVPN and similar VPN services route DNS queries to go through the VPN to hide the sites they visit. If you were to use the default DNS' IP address (the one of your ISP or country) in the openvpn config, they'd still be able to see which sites you access, even though you are behind a VPN and route your DNS queries through the VPN.

* Some sites, most notably wikileaks.org, is blocked at IP level and some, most notably i.imgur.com, are blocked at DNS level.

Answer 3

@Mokubai's response is fairly correct but for glossing on some details:

In general, when you want to test performance of a given traffic flow, you want to ensure that you're testing the same thing. Ping is an ICMP-based traffic-type. DNS primarily uses UDP (though, there are scenarios - zone transfers and signed queries/responses - where TCP is used.

Further exacerbating the validity problem of using ICMP as your basis for measuring UDP responses is the fact that ICMP responses are frequently given a lower quality of service (QoS) than TCP and UDP are. This is particularly so for large/busy sites - it makes far more sense for site operators to prioritize the traffic-types that they offer services over while de-prioritizing traffic-types that don't directly support that service. This QoSing will adversely impact not only ping but other diagnostic tools like traceroute.

Not directly relevant to DNS, but still worth being aware of if you're doing long-running, network-oriented tasks (you don't just game for a few minutes, here and there, do you): it's also not uncommon for ISPs to mess with speed-testing system. ISPs know that most speed-testing tools only operate for a few tens of seconds to a few minutes (and that most transfers happen within the span of a few minutes). As such, they will tend to implement traffic-shaping algorithms that will make shorter tests not representative of your speeds. That is, flows that are only a few seconds to a few minutes in length will give full bandwidth for the span of the test. If you go to a testing method that's longer-running - say 10+ minutes to a few hours - you may find that your throughput drops over time because one of the links had down-prioritized your traffic.

At any rate, if you want to benchmark DNS, you want to use a tool like dig to do so. dig tests the actual protocols you're interested in and tends to run in a non-caching mode.

Answer 4

When you visit a domain, be it Google or Steam, your device consults DNS once and keeps the result in cache for a long time (TTL = Time to Live), at least one hour but usually more.

A difference of milliseconds in this single query won't change the latency of an online game.

OpenDNS or Google DNS can determine if a site contains malware or at least if it's suspicious and then they can send you to a warning site where you can decide by yourself if you want to connect to the supposed malicious site,

Answer 5

Once the IP has been resolved, you do not need DNS for connections to the same host (as long as the IP is cached on your system, of course). I believe that speedtest.net only needs DNS when you start the test to resolve the IP of the testing server, after that you ping the server without needing DNS. As such, DNS does not have any influence over the actual connection speed.

I think your speedtest results are within a margin of error of each other, the higher ping on the Google DNS test is probably caused by the fact that you ran the test to another server than your other two tests.

The way OpenDNS protects you against malware is by not resolving known malware domains. It still won't protect you from malware when you can resolve the domain to the IP.

I don't think DNS has any noticeable effect when gaming. The only time you need it is to resolve the IP of a server where you connect using a domain (something like play.example.com), after that most games use the IP to talk to the server directly, circumventing DNS.

Answer 6

I doubt DNS will protect against malware. The only thing OpenDNS can do is stop from malware links from resolving. Because that is the only thing DNS can do, it resolves an name to an IP address.

The only possible explanation is that one DNS server is closer to you hence resulting in lower ping. But once it is resolved it will cache in your system meaning its only 1 time resolution. I also noticed you picked different servers each time you checked your ping. all in all DNS will not affect your speed.

Answer 7

There are certainly more secure ways to configure DNS servers than others. Not all DNS servers support DNSSEC properly, for example, or take other proactive steps to be resistant to DNS-related security vulnerabilities, which google takes extremely seriously.

On the speed side, with all due respect to the other answers, although in theory DNS should have nothing to do with speed, in practice it can have quite a significant, albeit indirect effect. Misconfigured ISP DNS servers are way too common, whether out of incompetence or poor business practices.

If a deprovisioned machine is kept in cache too long, you might be wasting bandwidth trying to connect to a machine that's no longer there. If a service provider spins up new servers to handle peak demand, but your DNS cache isn't caught up, you may not be able to use those new servers that are closer to you or less busy. If your DNS cache is for the west coast and you live on the east coast, your packets might be going cross country for no reason.

At one point, my Netflix and Hulu streaming was so bad during prime time that I considered canceling. Turns out all I needed to do was change my DNS provider.

That being said, the other answers are right for the most part. If your ping is already pretty good, changing DNS is unlikely to make a difference. My issues were I would do a wireshark capture and my Netflix packets were suddenly deciding to come from the other side of the continent, or 50% of my packets were being lost, or something like that. Not minor things like my ping being marginally slower.