Notes tagged dns — ymrtech.com

A no-log policy means nothing unless its exceptions are named: what this service records, what it does not, how it is tested, and what a tunnel cannot cover.

The three VPN tiers differ in one thing: who resolves your DNS, and what that resolver can see. What each tier changes, and what it costs you.

Signing a zone your own resolvers answer converts a soft failure into a hard one: a resolver returns SERVFAIL, and the name dies everywhere at once.

A filtering resolver has no test mode: your test query is answered by real policy, and often by an exemption that hides the policy from you.