22

I used to use Google DNS servers, i.e. 8.8.8.8 and 8.8.4.4, but I couldn't access certain websites. Then I decided to use Quad9 DNS as my alternate DNS server:
enter image description here

Now those websites are accessible, but I wonder if it's OK to use mixed DNS servers.

Mori
  • 72

4 Answers4

42

You are not using "mixed" DNS servers. You have specified a preferred DNS server, and a alternate fail-back secondary DNS server to be used if the primary fails to answer.

There is no connection between the two. It's actually advisable to use a different alternate DNS server, in case the DNS servers of the preferred one are unreachable for some reason.

harrymc
  • 498,455
20

It won't do what you think it does.

If the primary server returns an empty response (no IP addresses match a domain name), the alternate server will not be queried at all.

On most platforms the alternate server is used when the primary one fails to respond (not just fails to resolve). That's because this system assumes that both (all) configured DNS servers return credible responses. The goal of configuring more than one is reliability when one fails to respond.

The websites that didn't resolve originally still won't resolve as long as the primary server is functional.

You may consider using your preferred DNS server as the primary and the other one as a secondary.


Additional Linux-y notes:

  1. IIRC Pihole will treat all DNS servers it's forwarding to as equal and use them round-robin.
  2. In distros using systemd-resolve once a DNS server fails and an alternate one is used, the resolver will keep using the alternate server until that one fails too. This is different than dnsmasq's behavior, which would always retry the primary first.
gronostaj
  • 58,482
9

You can view both adresses as totally separate. The DNS is just a big "phonebook" of IP adresses. It doesn't matter where and from which provider your system gets them from, as long as that lookup is consistently available. That's why it lets you specify 2 adresses. The first one is always looked for first and if that "DNS phonebook" is nowhere to be found (for example because it's down) it uses the second one you specified to ensure you get your precious IP adresses.

You can go for example 1.1.1.1 (Cloudflare) and 8.8.8.8 (Google). But always keep in mind, the first one, in that case Cloudflare, is preferred and will be looked up first. If that succeeds, the second one will be completely ignored. That's important if you are using special DNS based services, for example a Pi Hole etc.

DNS providers usually specify 2 DNS adresses. That's out of redundancy reasons. They say when one of our DNS servers is down, just use our other one. That's why Google has 8.8.8.8 and 8.8.4.4 and Cloudflare has 1.1.1.1 and 1.0.0.1

You can either use primary and backup from one company, if you are looking for that, or you can use a different companies DNS for your backup one.

Celeste
  • 883
6

You almost always can use multiple resolver operators. Whether it's a good idea depends on your requirements and priorities.

You get a combination of the features offered by both providers. Notably, 9.9.9.9 blocks malicious domains, and 8.8.8.8 does not. If you use them both, sometimes malicious domains will resolve and sometimes they won't!

8.8.8.8 also supports EDNS Client Subnet, which can improve CDN performance, while reducing DNS privacy and performance. 9.9.9.9 does not, though Quad9's alternative 9.9.9.11 resolver does.

Some DNS services provide detailed logging. Conversely, some promise privacy. Most people probably won't want to combine the two.

DNSSEC can be an important difference. If one resolver validates and one doesn't, you'll be able to resolve bogus domains (sometimes slowly). (The resolvers mentioned here all validate, and I don't know whether that is important to you anyway.)

If you care about certain features, you'll want to consider the trade-offs and choose which resolver(s) to use carefully. If you don't, you can go wild.