Public encrypted resolver

DNSBunker

Encrypted DNS resolver with DNS-level ad, tracker and threat blocking.
No account, no app, no query logs.

Configure device Copy endpoints
Most clients

DoH / DoH3

Works well in browsers, mobile profiles and apps that ask for a DNS-over-HTTPS URL.

https://dnsbunker.org/dns-query
System-wide

Private DNS

For Android, many routers and operating systems, the hostname alone is enough.

dnsbunker.org
Hard rule

Encrypted only

Plain DNS is intentionally unavailable from outside. If a client cannot encrypt DNS, it cannot use this resolver.

How DNS works

Before a page loads

Your browser cannot connect to dnsbunker.org directly. First, a resolver has to turn that name into an IP address. That lookup happens constantly, often before you notice anything on screen.

Where tracking starts

DNS reveals which domains a device wants to contact. If those lookups are sent in the clear, the local network and the access provider can read them. If the resolver logs them, the trail lives there.

The filter belongs early

A DNS resolver can refuse unwanted domains before a browser, app or smart TV opens a connection. That is not a full security suite, but it removes a lot of noise before it reaches a device.

Area
DNSBunker default
What that means
Transport
DoH / DoH3 / DoT / DoQ
DNS traffic is encrypted on the way to the resolver.
Filtering
Hagezi Pro / TIF
Ads, trackers, phishing and malware domains are rejected at DNS level.
Logging
No query logs
Client queries and client IPs are not written to persistent storage.
DNSSEC
Strict validation
Broken signatures are refused instead of silently accepted.
Where it helps
At home
Set the resolver once and reduce tracking, ad calls and known bad domains across phones, laptops, tablets and TVs. No browser extension is needed for the basic DNS layer.
Beyond the browser
Many ads and telemetry calls do not come from a web page. They come from apps, launchers, smart TVs and devices where installing an extension is not an option.
Small offices
Use DNSBunker as an upstream resolver on a router, AdGuard Home, Pi-hole or dnscrypt-proxy. The network gets a shared first line of filtering without an agent on every device.
Public Wi-Fi
In hotels, airports or cafés, encrypted DNS keeps lookups away from casual network inspection. DNSBunker only accepts encrypted transports from outside.
VPN users
A VPN can hide traffic from the access network, but DNS still needs a resolver. If you choose your own encrypted resolver, you also choose the logging and filtering policy.
Admins
DNS stamps, DoQ, QNAME minimisation and strict DNSSEC are available without a special plan. Copy the endpoint you need and wire it into your existing stack.
Request path
1 A domain is requested
A browser, app or device needs an IP address for a domain and sends the lookup to DNSBunker.
2 The transport is encrypted
Instead of plain DNS on port 53, the client uses HTTPS, TLS or QUIC. The access network can see the connection to DNSBunker, not the requested domain.
3 The resolver checks policy
If the domain matches an ad, tracker, phishing, malware, rebind or bypass rule, DNSBunker answers with NXDOMAIN. Clean domains resolve normally.
4 The answer leaves no trail
The response goes back to the client. Query content and client IPs are not written to disk, so there is no browsing history to sell, analyse or hand over.
Endpoints
DNS over HTTPS
DoH / DoH3

Use this for browsers, mobile configuration profiles and clients that accept a DoH URL. DoH3 uses HTTP/3 over QUIC where the client supports it.

https://dnsbunker.org/dns-query h3://dnsbunker.org/dns-query
DNS over TLS
DoT

Good for Android Private DNS, routers and system resolvers that ask for a hostname instead of a URL.

dnsbunker.org
DNS over QUIC
DoQ

QUIC-based DNS transport for clients that support DoQ directly. Useful when connection migration and fast reconnects matter.

quic://dnsbunker.org
DNS Stamps

DNS stamps bundle address, protocol and resolver metadata into a portable string. They are handy for DNSCrypt-Proxy, AdGuard Home and compatible clients.

DoH sdns://AgMAAAAAAAAADjI3LjEyMy4yNDUuMTMwAA1kbnNidW5rZXIub3JnCi9kbnMtcXVlcnk
DoT sdns://AwMAAAAAAAAADjI3LjEyMy4yNDUuMTMwAA1kbnNidW5rZXIub3Jn
DoQ sdns://BAMAAAAAAAAADjI3LjEyMy4yNDUuMTMwAA1kbnNidW5rZXIub3Jn
IP addresses

These addresses do not provide plain DNS service on port 53.

185.250.250.61 2a0a:51c1:000a:00ea::
Device setup
Android 9+

Open Settings > Network & Internet > Private DNS, choose Private DNS provider hostname and enter the hostname below. Android will use DoT system-wide.

dnsbunker.org
Windows 10 / 11

Windows 11 supports DoH in network settings. Select the active connection, edit DNS server assignment, switch to manual, enter the IP address and set DNS encryption to HTTPS only. For Windows 10 or more advanced routing, YogaDNS is a practical option.

https://dnsbunker.org/dns-query
iOS & macOS

Apple devices can install an encrypted DNS profile system-wide. Download the profile below, review it in the system prompt and install it if the endpoint matches what you expect.

Download configuration profile Generate a custom profile
Routers & home networks

On OpenWrt, pfSense, OPNsense, AdGuard Home or Pi-hole, set DNSBunker as encrypted upstream. Keep local names and DHCP handling local; send public lookups through the resolver.

Security policy
DNSSEC

DNSSEC validation checks whether signed DNS answers still match their cryptographic chain. DNSBunker treats broken or invalid signatures as a failed answer instead of quietly falling back to unsigned trust.

Ad, tracker and threat filtering

Blocked domains are answered as non-existent (NXDOMAIN), so the connection attempt stops before an ad server, telemetry endpoint, phishing host or malware domain can respond. Wildcard and regular-expression rules cover many generated hostnames too.

Filter lists
Active blocklists
False positives

If a legitimate domain is blocked, report it to the maintainers of the list that contains it. For Hagezi lists, the right place is the Hagezi issue tracker.

Privacy & infrastructure
No query logs

DNSBunker does not keep a history of requested domains. Client IPs and query contents are not written to persistent storage, so the resolver cannot build a browsing profile from them.

Germany, EU law

The infrastructure is located in Frankfurt, Germany. The project is operated under EU data protection law and the German legal pages linked below describe the processing details.

QNAME minimisation

When the resolver has to ask authoritative nameservers, it sends only the part of the name needed for that step. Higher-level servers do not receive the full hostname if it is not necessary.

Private project

DNSBunker has no ad business, investor story or analytics product attached to it. It is a private, non-commercial resolver for people who want a stricter default without running the whole stack themselves.