Writing · networking

The three VPN tiers differ in exactly one thing — who resolves your DNS, and what that resolver can see. What each tier actually changes, and what it costs you.

HTB scheduling decides from queue state, not from an accounting problem. That is how peers get fair shares of a link while no per-peer usage record is kept.

An endpoint measures the path it traverses. Run the test on the host you are measuring and the number is dominated by loopback and CPU, not by the network.

Signing a zone your own resolvers answer converts a soft failure into a hard one: a validating resolver returns SERVFAIL, and the name dies everywhere at once.

A filtering resolver has no test mode: your test query is answered by real policy, and often by an exemption that hides the policy from you.