First off, before I get to anything that’s wrong, there’s a lot that’s right about OpenDNS: It’s a simple, effective and flexible tool for content filtering. As a company, they’re trying to improve the state of DNS for end users with tools like DNSCrypt. You can’t beat their entry-level price – free. Their anycast network is good, especially if you’re on the west coast of the United States, like I am (in fact, it’s better for me than surely-much-larger Google’s 8.8.8.8 and 8.8.4.4). Their dashboard is pretty neat, too.

Second, let’s get the most common complaint about OpenDNS – one that isn’t going to be discussed here any further – out of the way: Their practice of returning ads on blocked or non-existent sites in your browser, via a bogus A RR of 67.215.65.132 (if you don’t go with one of their paid options). OpenDNS is upfront about doing this, so you can decide if the trade-off is worthwhile before you sign up – and you can quit using them any time you want.

Those two preliminaries covered, here’s a case study of what I think is a serious problem with OpenDNS, plus some thoughts on how they could fix it.

Background: Recently, I helped my wife buy a domain for a personal blog; it turns out OpenDNS has tagged this domain as pornographic. Currently, the domain hosts nothing beyond an empty WordPress blog.

I can think of three possible scenarios that could be in effect here:

1. The site has been compromised. This was my first thought, although I now consider it unlikely. I’ve gone through the site and the logs pretty closely, and have been unable to find anything amiss. I’m willing to leave the possibility open that I missed something, though.
2. The domain used to be pornographic, but is no longer. This also appears unlikely, at least based on archive.org and other sites; the domain name itself also doesn’t exactly suggest a porn site, either, unless there’s some obscure slang I’m unaware of.
3. The OpenDNS classification is incorrect. The domain was accidentally or intentionally mislabeled. It appears most classification – especially for small sites like the one in question – is crowd-sourced, but only a few members of the “crowd” might tag a small site.

It’s unclear which of the above went wrong, but there are several obvious ideas that OpenDNS could implement to address this class of problems:

1. More metadata, please. For my “pornographic” domain, it would have been nice to know when it was tagged as such, what the DNS servers and relevant records were when it was tagged, what a screenshot looked like then (not now), and what the registrar data was. If it was a site compromise, this data would make my finding it that much easier. If the classification is stale, metadata would make this obvious as well.
2. Automatically-triggered classification reviews. If there are substantial changes to a domain’s registrar entry, that should trigger an automatic review of the site – especially so if the domain registration lapses, and another party purchases the domain after a period of time. The volume of users whitelisting a site in the control panel should be another signal of misclassification, although this probably won’t help obscure sites. This is an obvious, simple fix, and perhaps OpenDNS has something like this in place, but I don’t see any signs of it.
3. A better user interface. When I first visited their tagging interface, the thumbnail viewer was broken, and the “flag for review” link was missing. Both later reappeared, apparently functional, although I have no idea if or when a review will actually take place.
4. Better policing of community members. Some of the OpenDNS Community’s most prolific members tag in excess of 1,000 domains on an average day. Many of these tags appear to be of dubious quality, going far beyond anything that could be called a difference of opinion into the realm of flat-out wrong. Poor quality – or malicious – tagging is damaging OpenDNS’s product; I’m surprised they don’t appear more strongly motivated to address this.

For now, I’m going to continue to use OpenDNS’s services at home, although I’m on the lookout for a better product elsewhere. But until I see some signs that they’re addressing the issue of incorrect tags, I can no longer recommend them for professional use, which is too bad; as I said in the first paragraph, there’s a lot to like about OpenDNS.

Update, 1/2/2012: It’s been a couple weeks since I flagged the domain for OpenDNS’s review – and nothing has happened. I think it’s fair to update my conclusion: OpenDNS has a garbage-in, garbage-out problem and does not appear to be invested in the quality of their product; look elsewhere for a content-filtering tool that goes beyond hobbyist quality.