Regarding DNS reliability testing for relay operators
Hey all, I've spent a good part of the fall learning about Tor, and I'm excited to start contributing as a relay operator. DNS seems to be a significant point of confusion. I posted about this a few weeks back (https://forum.torproject.org/t/best-practices-for-dns-local-vs-external-reso...) and got a helpful response from NTH, but there still seems to be uncertainty around DNS performance. That inspired me to run some tests that might help current and future operators set up more reliable and private DNS. My plan is to run three separate hosts with identical OS/resources and torrc configs, but with different DNS setups based on the three most commonly recommended configurations: - Node 1: Runs a local Unbound server using itself as the resolver - only contacting recursive resolvers from the node. - Node 2: Runs an Unbound server on an external IP used by the relay as an upstream resolver, ensuring queries aren't made over a Tor IP. - Node 3: Uses the ISP's local DNS configuration (no changes from the “out-of-the-box” setup). Is there another configuration worth testing that I haven't listed here? Have anyone here conducting similar testing? Feel free to email me directly. I still need to get more comfortable with Prometheus and Tor metrics before I feel ready to run the nodes, so in the meantime I'd really appreciate hearing your thoughts on this kind of contribution. Happy December 1st everyone. Riley
Am 01.12.2025 um 14:51:06 Uhr schrieb relayadmin via tor-relays:
I still need to get more comfortable with Prometheus and Tor metrics before I feel ready to run the nodes, so in the meantime I'd really appreciate hearing your thoughts on this kind of contribution.
You do not need that to operate the relay itself. I use monit to monitor that the relay is still running - if not ist sends me an email. Your relay doesn't need to be high-available. It is a volunteer service and if it is unreachable, the client will choose another. Running your own resolver is rather simple. You have to define an ACL including the IPs from your TOR exits to allow recursive requests from them. With BIND, this is simple to set up. -- Gruß Marco Send unsolicited bulk mail to 1764597066muell@cartoonies.org
participants (2)
-
Marco Moock -
relayadmin