DoH / DoH3 (ECH)
For Firefox, Chrome, Edge, the iPhone and Mac profile and any app that asks for a DoH address.
https://dnsbunker.org/dns-queryThe filter before the click.
A public encrypted DNS resolver that blocks ads, trackers, phishing and malware before your device ever connects to them. No account, no app, nothing written to disk.
LiveQueries/s over time
- Queries (24 h)
- –
- Blocked (24 h)
- –
- Queries/s (median)
- –
- Availability (24 h)
- –
Anonymous totals
Works with: Android, iPhone & iPad, macOS, Windows, Linux, FRITZ!Box, OPNsense, pfSense, OpenWrt, MikroTik, AdGuard Home, Pi-hole, Technitium, Unbound, Knot Resolver, Blocky, CoreDNS, dnsproxy, dnscrypt-proxy, stubby, systemd-resolved, YogaDNS, RethinkDNS, Intra, AdGuard, Firefox, Chrome, Brave, Edge
Private DNS
Android's Private DNS only needs this hostname. Windows, Linux and most routers also ask for the IP address; the device guides below show exactly where.
dnsbunker.orgEncrypted only
DNSBunker doesn't answer unencrypted lookups. A device that can't encrypt its DNS can't use the service.
Before your device connects anywhere, it asks DNSBunker for the address. If the name is on one of the block lists, DNSBunker replies that it doesn't exist (NXDOMAIN). The ad server, tracker or scam site is never contacted.
Ads & trackers
Hagezi's Pro list covers the ad networks, analytics services and manufacturer telemetry that apps, smart TVs and websites contact in the background, not only the ads on web pages.
Phishing & malware
Hagezi's Threat Intelligence Feed (TIF) adds domains used for phishing, scams and malware. It's updated continuously, which also helps against freshly registered scam sites.
Subdomains included
Wildcard rules block a listed domain together with all of its subdomains, so a tracker can't slip through just by switching to a new name like x7.tracker.example.
What you'll notice
Fewer ads, and pages often load faster. A few things stop working on purpose: sponsored links at the top of search results, some tracking links in newsletters, and ad banners in apps, which usually show up as empty space.
What DNS filtering can't do
It blocks whole domains. Ads delivered from the same domain as the content itself, such as YouTube video ads or sponsored posts in social media feeds, can't be separated this way; a browser ad blocker complements DNSBunker there. It also doesn't replace antivirus software or caution with suspicious links.
- Hagezi TIF (Threat Intelligence Feed)active
- Hagezi Proactive
Order of checks: own block list, then TIF, then Pro. A domain on both lists counts towards TIF; Pro only counts what TIF doesn't already block.
Both lists are mirrored publicly at hagezi-mirror.dnsbunker.org for anyone who wants to point their own resolver at them.
Something you need is blocked?
Your browser then says the site can't be found (in Chrome: DNS_PROBE_FINISHED_NXDOMAIN), usually naming the blocked domain. Report that name in the Hagezi issue tracker, since the lists come from there. The lists apply to all users equally, so until the entry is fixed, the only workaround is to switch DNSBunker off on that device for a moment (see Undo in the device guides).
Not blocked: local addresses
DNSBunker doesn't block answers that point to devices in a private network, because home automation, self-hosted services and company networks rely on them. Protection against the related attack, DNS rebinding, belongs in the browser or router, which can tell whether such an answer makes sense.
No query logs
DNSBunker keeps no history of the domains you look up. Your IP address and your lookups are never written to disk, so nobody, the operator included, can check later which sites you visited.
QNAME minimisation
To find an answer, DNSBunker asks several servers on the internet one after another. Each one only learns the part of the name it's responsible for: the .com servers are asked about example.com, never about mail.example.com (RFC 9156). None of them ever sees your IP address.
Germany, EU law
The infrastructure is located in Frankfurt, Germany. The project is operated under EU data protection law and the German legal pages linked below describe the processing details.
Private project
DNSBunker has no ad business, investor story or analytics product attached to it. It is a private, non-commercial resolver for people who want a stricter default without running the whole stack themselves.
Open-source resolver stack
Query dispatching runs on dnsdist, recursive resolution on PowerDNS Recursor. Both are established open-source projects from the DNS infrastructure world, not a custom black box built for this project alone.
More detail
Every claim on this page is backed by a technical description in the Privacy Policy: what is processed, for how long, and why.
Encrypted transport only
Your lookups travel encrypted (DoH, DoT, DoQ or DNSCrypt), so your Wi-Fi, your internet provider or anyone else in between can neither read nor change them. Unencrypted DNS on port 53 isn't answered at all.
DNSSEC
Many domains digitally sign their DNS entries. DNSBunker checks these signatures, and if one is broken or forged, the answer is rejected instead of passed on. That protects you from being sent to a fake server by a manipulated answer.
Encrypted Client Hello (ECH)
Even with encryption, the start of a connection normally reveals which server a device is talking to. With Encrypted Client Hello, DoH connections hide that too, so an observer can't read in plain text that you're using DNSBunker. This works when your browser or device supports ECH.
EDNS(0) padding
Even encrypted, the size of a message can hint at which site was looked up. DNSBunker pads its encrypted answers to uniform block sizes (EDNS(0) padding, RFC 7830), so their size gives much less away.
Postcard or sealed letter
Postcard · plain DNS, port 53
A? dermatologist-booking.example
dermatologist-booking.example A 203.0.113.10
Like a postcard: your Wi-Fi, your provider and anyone in between can read along.
Sealed letter · DoT / DoH / DoQ / DNSCrypt
17 03 03 00 9c e8 4f 1a 7c 22 b9 d1 06 …
17 03 03 01 d4 5b c0 93 2e 6a 0f 48 b7 …
Like a sealed letter: only the recipient is visible, DNSBunker's IP. With DoH and ECH even the server name is sealed.
“You wouldn’t tell everyone where you’re going. So why should your DNS?”
Before a page loads
Like a phone book: your device knows the name (dnsbunker.org) but needs the number, the IP address. A resolver looks it up. That happens constantly, usually before anything appears on screen.
Where tracking starts
DNS reveals which domains a device wants to contact. If those lookups are sent in the clear, the local network and the access provider can read them. If the resolver logs them, the trail lives there.
The filter belongs early
A DNS resolver can refuse unwanted domains before a browser, app or smart TV opens a connection. That is not a full security suite, but it removes a lot of noise before it reaches a device.
Example terminal session: DNSBunker answers a tracker domain with NXDOMAIN and the reason “Blocked”, and resolves dnsbunker.org with a DNSSEC-validated address.
Try it yourself: the lookup goes straight to DNSBunker over DoH and isn't stored.
Area
DNSBunker default
What that means
Transport
DoH / DoH3 / DoT / DoQ
DNS traffic is encrypted on the way to the resolver.
Filtering
Hagezi Pro / TIF
Ads, trackers, phishing and malware domains are rejected at DNS level.
Logging
No query logs
Client queries and client IPs are not written to persistent storage.
DNSSEC
Strict validation
Broken signatures are refused instead of silently accepted.
1A domain is requested
A browser, app or device needs an IP address for a domain and sends the lookup to DNSBunker.
2The transport is encrypted
Instead of plain DNS on port 53, the client uses HTTPS, TLS, QUIC or DNSCrypt. The access network can see the connection to DNSBunker, not the requested domain.
3The bouncer checks the list
Like a bouncer with a list: if the domain is on a block list for ads, trackers, phishing or malware, it doesn't get in. DNSBunker answers that it doesn't exist (
NXDOMAIN) and your device never connects. Every other domain is let in and looked up normally.4Only what’s needed leaves the bunker
Most answers come straight from the cache. For the rest, DNSBunker needs no root servers: it keeps verified copies of the root zone and of the reverse-lookup zones (arpa, in-addr.arpa, ip6.arpa) itself. It then asks the server of the top-level domain and the domain’s own server, each only for as much of the name as it needs, and never with your IP address.
5The answer leaves no trail
The response goes back to the client. Query content and client IPs are not written to disk, so there is no browsing history to sell, analyse or hand over.
At home
Set the resolver once and reduce tracking, ad calls and known bad domains across phones, laptops, tablets and TVs. No browser extension is needed for the basic DNS layer.
Beyond the browser
Many ads and telemetry calls do not come from a web page. They come from apps, launchers, smart TVs and devices where installing an extension is not an option.
Small offices
Use DNSBunker as an upstream resolver on a router, AdGuard Home, Pi-hole or dnscrypt-proxy. The network gets a shared first line of filtering without an agent on every device.
Public Wi-Fi
In hotels, airports or cafés, encrypted DNS keeps lookups away from casual network inspection. DNSBunker only accepts encrypted transports from outside.
VPN users
A VPN can hide traffic from the access network, but DNS still needs a resolver. If you choose your own encrypted resolver, you also choose the logging and filtering policy.
Admins
DNS stamps, DoQ, DNSCrypt, QNAME minimisation and strict DNSSEC are available without a special plan. Copy the endpoint you need and wire it into your existing stack.
You only need this section if you set things up by hand or use special software. For phones, computers and routers, the step-by-step guides in Device setup are easier.
DoHDNS over HTTPS
For browsers, iPhone, iPad, Mac and Windows 11
https://dnsbunker.org/dns-queryDetails and DNS stamp
For browsers, the Apple profile and apps that ask for a DoH URL (RFC 8484). The h3:// variant forces HTTP/3 in clients that support it, such as AdGuard Home.
HTTP/3 only
h3://dnsbunker.org/dns-queryDNS stamp
sdns://AgMAAAAAAAAADjE4NS4yNTAuMjUwLjYxAA1kbnNidW5rZXIub3JnCi9kbnMtcXVlcnkDoTDNS over TLS
For Android (Private DNS), routers and Linux
dnsbunker.orgDetails and DNS stamp
For Android's Private DNS, routers and system resolvers (RFC 7858). Some only ask for the hostname; others, like systemd-resolved or the FRITZ!Box, also need the IP addresses below.
DNS stamp
sdns://AwMAAAAAAAAADjE4NS4yNTAuMjUwLjYxAA1kbnNidW5rZXIub3JnDoQDNS over QUIC
For AdGuard Home, dnsproxy, Technitium and other apps that support DoQ
quic://dnsbunker.orgDetails and DNS stamp
DNS over QUIC (RFC 9250) for clients that support it directly, such as AdGuard Home. It reconnects quickly when you switch networks, for example from Wi-Fi to mobile data.
DNS stamp
sdns://BAMAAAAAAAAADjE4NS4yNTAuMjUwLjYxAA1kbnNidW5rZXIub3JnDNSCryptVersion 2
For dnscrypt-proxy, RethinkDNS, YogaDNS and AdGuard, also anonymised through relays
DNS stamp
sdns://AQMAAAAAAAAAEzE4NS4yNTAuMjUwLjYxOjg0NDMgNw_pM00juOiBe9ZNN0x42xQvsI5EWe3DjleywHCz0eUdMi5kbnNjcnlwdC1jZXJ0LmRuc2J1bmtlci5vcmcDetails, IPv6 stamp and keys
DNSCrypt v2 on port 8443 (UDP and TCP). Most clients only need the DNS stamp above; the values here are for clients that ask for them one by one. The certificates are renewed every 12 hours.
DNS stamp (IPv6)
sdns://AQMAAAAAAAAAF1syYTBhOjUxYzE6YTplYTo6XTo4NDQzIDcP6TNNI7jogXvWTTdMeNsUL7CORFntw45XssBws9HlHTIuZG5zY3J5cHQtY2VydC5kbnNidW5rZXIub3JnProvider name
2.dnscrypt-cert.dnsbunker.orgAddress
185.250.250.61:8443[2a0a:51c1:a:ea::]:8443Provider public key
370F:E933:4D23:B8E8:817B:D64D:374C:78DB:142F:B08E:4459:EDC3:8E57:B2C0:70B3:D1E5IPIPv4 and IPv6
Only where a device asks for IP addresses, and always together with DoH or DoT
185.250.250.612a0a:51c1:a:ea::Why only together with DoH or DoT?
Needed wherever a device asks for a DNS server's IP address, such as Windows, the FRITZ!Box or systemd-resolved. On their own they don't work: always combine them with DoH or DoT, because DNSBunker doesn't answer unencrypted queries.
A DNS stamp packs address, protocol and settings into one string. You only need it for dnscrypt-proxy, AdGuard Home and similar tools; always copy the whole string.
Choose your device and follow the steps in order. It takes about five minutes, only needs to be done once per device and doesn't require an account.
Set up on your phone
Scan the code with your camera. The guide for your device opens right away.
Android 9 or newer
- Open Settings and tap Network & internet. On Samsung phones it's Connections › More connection settings.
- Tap Private DNS. Can't find it? Type DNS into the search bar at the top of Settings.
- Choose Private DNS provider hostname, enter this exactly as shown and tap Save:
dnsbunker.org
Check: if websites keep loading, it works. In this mode Android never falls back to unencrypted DNS: if DNSBunker can't be reached or the name is mistyped, Android warns that the private DNS server can't be accessed and pages stop loading. Undo: set Private DNS back to Automatic. Do the same if the login page of a hotel or train Wi-Fi won't open, and switch it back on once you're logged in.
Apps instead of Private DNS
Private DNS is enough in almost all cases. You need an app if your device runs Android 8 or older, a network blocks port 853, or you want DNSCrypt. These apps work as a local VPN, so no other VPN can run at the same time. Set Private DNS to Off so that lookups go through the app.
RethinkDNS
Free and open source (Google Play, F-Droid). Tap Configure at the bottom, then DNS, and choose Other DNS. Select DNSCrypt, create your own entry with the first value under Stamp, tap Add and select the new entry. For DoH, choose DNS-over-HTTPS instead and use the second address. Then turn protection on with Start on the home screen.
sdns://AQMAAAAAAAAAEzE4NS4yNTAuMjUwLjYxOjg0NDMgNw_pM00juOiBe9ZNN0x42xQvsI5EWe3DjleywHCz0eUdMi5kbnNjcnlwdC1jZXJ0LmRuc2J1bmtlci5vcmchttps://dnsbunker.org/dns-queryIntra
Free and open source, DoH only. Open the menu ☰, then Settings › Select DNS over HTTPS Server, choose Custom server URL, paste this address and confirm. Then turn Intra on from its home screen.
https://dnsbunker.org/dns-queryAdGuard
Paid; supports DoH, DoT, DoQ and DNSCrypt. Tap the shield icon at the bottom, then DNS protection › DNS server. Scroll to Custom servers, tap Add DNS server and paste this address into Server addresses. Tap Add, select the new server and tap Save and select.
https://dnsbunker.org/dns-queryWindows 11
- Right-click the Start button, open Settings and select Network & internet on the left.
- Click Wi-Fi › Hardware properties, or Ethernet if you're connected by cable. Next to DNS server assignment, click Edit and switch to Manual.
- Turn on IPv4 and enter this address under Preferred DNS:
185.250.250.61 - Set DNS over HTTPS to On (manual template) and paste this into the template field:
https://dnsbunker.org/dns-query - Turn Fallback to plaintext off. Otherwise Windows quietly switches back to unencrypted DNS when something goes wrong.
- Turn on IPv6 as well, repeat steps 3 to 5 with the address below and click Save:
2a0a:51c1:a:ea::
Check: the connection page now lists the DNS servers with (Encrypted). If you use both Wi-Fi and a cable, set up both. Undo: set DNS server assignment back to Automatic (DHCP), for example when the login page of a hotel Wi-Fi won't open.
Windows 10
Windows 10 can’t encrypt DNS by itself. The easiest option is to set up your browser instead (see the Browser tab). To protect the whole system, you need an extra program such as YogaDNS (below), or dnscrypt-proxy or Technitium from the DNS software tab.
YogaDNS
YogaDNS encrypts DNS for the whole of Windows; the free Basic version is enough. Open Configuration › DNS Servers, click Add…, then the sdns:// button, and paste one of these DNS stamps: the first uses DoH on port 443, the second DNSCrypt. Name the entry DNSBunker and save it. Then open Configuration › Rules, double-click the Default rule and set Action to Process and DNS Server to DNSBunker.
sdns://AgMAAAAAAAAADjE4NS4yNTAuMjUwLjYxAA1kbnNidW5rZXIub3JnCi9kbnMtcXVlcnksdns://AQMAAAAAAAAAEzE4NS4yNTAuMjUwLjYxOjg0NDMgNw_pM00juOiBe9ZNN0x42xQvsI5EWe3DjleywHCz0eUdMi5kbnNjcnlwdC1jZXJ0LmRuc2J1bmtlci5vcmcFor advanced users: command line
Run these two commands in a terminal opened as administrator. Windows then knows the DoH address for both IP addresses and never falls back to plain DNS. Afterwards, enter the IP addresses as DNS servers as described above and choose On (automatic template).
netsh dns add encryption server=185.250.250.61 dohtemplate=https://dnsbunker.org/dns-query autoupgrade=yes udpfallback=no
netsh dns add encryption server=2a0a:51c1:a:ea:: dohtemplate=https://dnsbunker.org/dns-query autoupgrade=yes udpfallback=noiPhone & iPad
- Open this page in Safari on your iPhone or iPad, tap the button and confirm with Allow.Download configuration profile
- Open Settings and tap Profile Downloaded near the top. If it's not there, go to General › VPN & Device Management.
- Tap Install in the top right, enter your device passcode and confirm with Install.
Check: under Settings › General › VPN & Device Management › DNS, DNSBunker DNS over HTTPS should be selected. Undo: in VPN & Device Management, tap the DNSBunker profile and choose Remove Profile.
Mac
- Click the button to download the profile.Download configuration profile
- Open System Settings and type Profiles into the search field. On macOS 15 and later they're under General › Device Management, on older versions under Privacy & Security › Profiles.
- Double-click the DNSBunker profile, click Install and enter your Mac password.
Undo: select the profile in the same place and remove it with the – button.
Good to know
The profile uses DoH and works on Wi-Fi and mobile data. If iCloud Private Relay is on, Safari sends its lookups through Private Relay instead; all other apps keep using DNSBunker. Before installing, iOS and macOS show what the profile contains: it should only point to https://dnsbunker.org/dns-query. You can also build your own profile with the generator below.
Firefox
A browser setting only protects that one browser, not your other apps. It's the right choice if you can't or don't want to change your device's settings.
- Open the menu ☰ in the top right and choose Settings.
- Click Privacy & Security on the left and scroll down to DNS over HTTPS.
- Choose Max Protection, set the provider to Custom and paste this address:
https://dnsbunker.org/dns-query
With Max Protection, Firefox never falls back to your regular DNS. If a page shows a secure DNS error, for example the login page of a hotel Wi-Fi, switch to Increased Protection for a moment.
Chrome & Brave
- Open the menu ⋮ in the top right (Brave: ☰) and choose Settings.
- Go to Privacy and security › Security and scroll down to Use secure DNS.
- Make sure it's switched on, pick Add custom DNS service provider from the list and paste this address:
https://dnsbunker.org/dns-query
Microsoft Edge
- Open the menu … in the top right and choose Settings.
- Go to Privacy, search, and services › Security and turn on Use secure DNS.
- Select Choose a service provider and paste this address:
https://dnsbunker.org/dns-query
systemd-resolved (default on Fedora and Ubuntu)
- Open a terminal, paste this whole block and press Enter. It creates a small configuration file and restarts the DNS service; you'll be asked for your password.
sudo mkdir -p /etc/systemd/resolved.conf.d sudo tee /etc/systemd/resolved.conf.d/dnsbunker.conf >/dev/null <<'EOF' [Resolve] DNS=185.250.250.61#dnsbunker.org 2a0a:51c1:a:ea::#dnsbunker.org DNSOverTLS=yes Domains=~. EOF sudo systemctl restart systemd-resolved - Check the result with this command. In the Global section, DNS Servers should list both addresses with #dnsbunker.org, and Protocols should include +DNSOverTLS:
resolvectl status
Why #dnsbunker.org? systemd-resolved needs the IP address to connect and the name to check the server's certificate. Without the name, the check fails and no lookups work. DNSOverTLS=yes rules out unencrypted fallback, and Domains=~. sends all lookups to DNSBunker instead of your router. Undo: run sudo rm /etc/systemd/resolved.conf.d/dnsbunker.conf, then restart the service as above.
Alternative: dnscrypt-proxy
systemd-resolved only speaks DoT on port 853, which some company and public networks block. dnscrypt-proxy also uses DoH on port 443 and DNSCrypt; the guide is in the DNS software tab.
AdGuard for Linux (AdGuard CLI)
The paid AdGuard ad blocker for the Linux command line. These commands turn on its DNS protection with DNSBunker as the server. Instead of the DoH address, quic://dnsbunker.org, tls://dnsbunker.org or a DNS stamp work too.
adguard-cli config set dns_filtering.enabled true
adguard-cli config set dns_filtering.upstream https://dnsbunker.org/dns-query
adguard-cli restartRouters & home networks
Set it up once on your router and every device at home uses DNSBunker, including smart TVs and game consoles that have no DNS setting of their own. Phones and laptops only benefit while they're at home, so it's worth setting those up directly as well. Local names and DHCP stay on your router; only public lookups go to DNSBunker.
FRITZ!Box (FRITZ!OS 7.20 or newer)
- Open fritz.box in your browser and log in.
- Go to Internet › Account Information and open the DNS Server tab.
- Select Use other DNSv4 servers and enter this address as preferred and alternative server:
185.250.250.61 - Select Use other DNSv6 servers and enter this address in the same way:
2a0a:51c1:a:ea:: - Tick Encrypted name resolution in the internet (DNS over TLS) and Enforce certificate check for encrypted name resolution in the internet. Under Resolution names of encrypted DNS servers, enter:
dnsbunker.org - Untick Allow fallback to unencrypted name resolution in the internet and click Apply.
Check: Internet › Online Monitor lists the DNS servers in use. Other routers with DNS over TLS, for example from ASUS, need the same three things: the IP address, port 853 and dnsbunker.org as hostname.
OPNsense & pfSense
OPNsense: under Services › Unbound DNS, add a DNS-over-TLS forwarder for each IP address with port 853 and dnsbunker.org as Verify CN (menu DNS over TLS or, on newer versions, Query Forwarding). pfSense: under System › General Setup, enter both IP addresses with dnsbunker.org as hostname, then enable DNS Query Forwarding and Use SSL/TLS for outgoing DNS Queries to Forwarding Servers under Services › DNS Resolver.
185.250.250.612a0a:51c1:a:ea::OpenWrt
The easiest way is the https-dns-proxy package. Log in to the router over SSH and install it: with the first line on OpenWrt 25.12, with the second on 24.10. The remaining commands switch the first preconfigured instance to DNSBunker and delete the second. https-dns-proxy registers itself with dnsmasq and also redirects lookups that devices on your network send to other DNS servers. It looks up the name dnsbunker.org once at startup through its preset bootstrap servers.
apk update && apk add https-dns-proxyopkg update && opkg install https-dns-proxyuci set https-dns-proxy.@https-dns-proxy[0].resolver_url='https://dnsbunker.org/dns-query'
uci delete https-dns-proxy.@https-dns-proxy[1]
uci commit https-dns-proxy
service https-dns-proxy restartMikroTik RouterOS
Open the terminal in WinBox or over SSH and paste these two commands. The first tells the router the address of dnsbunker.org, so it needs no other DNS server for it; the second turns on DoH with certificate checking and removes the previous DNS servers. Tested with RouterOS 7.24, which checks the certificate against its built-in root certificates.
/ip dns static add name=dnsbunker.org address=185.250.250.61 type=A
/ip dns set use-doh-server=https://dnsbunker.org/dns-query verify-doh-cert=yes servers=""Certificate error on older RouterOS versions?
Older versions lack the built-in root certificates. Import the root certificate of dnsbunker.org, DigiCert Global Root G2, with these commands.
/tool fetch url=https://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pem
/certificate import file-name=DigiCertGlobalRootG2.crt.pem passphrase=""Your own DNS software
If you run your own DNS software, for example on a Raspberry Pi, your router or a server, enter DNSBunker there once as the upstream server. Every device that uses it is then protected without being set up itself. Open your software below; the labels show which protocols the guide uses.
AdGuard Home
Under Settings › DNS settings › Upstream DNS servers, replace the existing entries with one of these lines and click Apply. https:// uses DoH, tls:// DoT and quic:// DoQ; if unsure, take DoH. AdGuard Home looks up the name through its Bootstrap DNS servers; alternatively, use the DNS stamps from the Endpoints section, which already contain the IP address.
https://dnsbunker.org/dns-querytls://dnsbunker.orgquic://dnsbunker.orgsdns://AQMAAAAAAAAAEzE4NS4yNTAuMjUwLjYxOjg0NDMgNw_pM00juOiBe9ZNN0x42xQvsI5EWe3DjleywHCz0eUdMi5kbnNjcnlwdC1jZXJ0LmRuc2J1bmtlci5vcmcWithout the web interface: AdGuardHome.yaml
Stop AdGuard Home first (as a service: sudo ./AdGuardHome -s stop), otherwise it may overwrite your change. In AdGuardHome.yaml, replace the entries under upstream_dns: in the dns: section with these lines, then start it again with sudo ./AdGuardHome -s start. AdGuard Home then uses both DoH and DoQ and prefers whichever answers faster.
upstream_dns:
- https://dnsbunker.org/dns-query
- quic://dnsbunker.orgBlocky
In Blocky’s config.yml, replace the upstreams and bootstrapDns sections with these lines and restart Blocky. With bootstrapDns, Blocky looks up the name dnsbunker.org over DoT directly at DNSBunker, so no other DNS server is involved. Keep the quotes around the IPv6 address; without them YAML misreads it.
upstreams:
groups:
default:
- https://dnsbunker.org/dns-query
- tcp-tls:dnsbunker.org:853
bootstrapDns:
- upstream: tcp-tls:dnsbunker.org:853
ips:
- 185.250.250.61
- '2a0a:51c1:a:ea::'CoreDNS
Put this block into your Corefile in place of the existing block for . and reload CoreDNS. forward sends every lookup over DoT to both DNSBunker addresses; tls_servername is the name used to check the certificate. In Kubernetes, only replace the line forward . /etc/resolv.conf with the forward block.
. {
forward . tls://185.250.250.61 tls://2a0a:51c1:a:ea:: {
tls_servername dnsbunker.org
}
cache
}dnscrypt-proxy
dnscrypt-proxy runs on Windows, macOS, Linux and routers such as OpenWrt, and can also sit in front of Pi-hole. With the lines below it uses DNSCrypt on port 8443 and DoH on port 443; if a network blocks one of them, it automatically uses the other. In dnscrypt-proxy.toml, put the first line near the top in place of the server_names line (it may be commented out with #), add the other lines at the very end of the file and restart dnscrypt-proxy. Then use 127.0.0.1, or the address dnscrypt-proxy listens on, as your DNS server.
server_names = ['dnsbunker-dnscrypt', 'dnsbunker-doh']
[static.'dnsbunker-dnscrypt']
stamp = 'sdns://AQMAAAAAAAAAEzE4NS4yNTAuMjUwLjYxOjg0NDMgNw_pM00juOiBe9ZNN0x42xQvsI5EWe3DjleywHCz0eUdMi5kbnNjcnlwdC1jZXJ0LmRuc2J1bmtlci5vcmc'
[static.'dnsbunker-doh']
stamp = 'sdns://AgMAAAAAAAAADjE4NS4yNTAuMjUwLjYxAA1kbnNidW5rZXIub3JnCi9kbnMtcXVlcnk'Optional: hide your IP address from DNSBunker as well
With Anonymized DNSCrypt, each query goes through a randomly chosen public relay. The relay sees your IP address but not the query; DNSBunker sees the query but only the relay’s address. Use the first line instead of the server_names line above, because DoH can’t be relayed, and put the second line into the existing [anonymized_dns] section, in place of the commented-out routes example.
server_names = ['dnsbunker-dnscrypt']routes = [ { server_name='dnsbunker-dnscrypt', via=['*'] } ]dnsproxy
dnsproxy by AdGuard is a small program without a user interface for Linux, macOS and Windows, also available as the Docker image adguard/dnsproxy. This command starts it on port 53 and sends everything to DNSBunker over DoQ and DoH. Both DNS stamps already contain the IP address, so dnsproxy needs no other DNS server. Use -l 0.0.0.0 instead of 127.0.0.1 to make it reachable from your whole network.
dnsproxy -l 127.0.0.1 -p 53 -u sdns://BAMAAAAAAAAADjE4NS4yNTAuMjUwLjYxAA1kbnNidW5rZXIub3Jn -u sdns://AgMAAAAAAAAADjE4NS4yNTAuMjUwLjYxAA1kbnNidW5rZXIub3JnCi9kbnMtcXVlcnkKnot Resolver
For Knot Resolver 6, add this section to /etc/knot-resolver/config.yaml and restart Knot Resolver. Knot also checks DNSSEC itself, so blocked domains reach you as SERVFAIL instead of NXDOMAIN; they’re blocked either way. Leave that check on: in forwarding mode, Knot would otherwise accept forged answers too.
forward:
- subtree: .
servers:
- address: [185.250.250.61, '2a0a:51c1:a:ea::']
transport: tls
hostname: dnsbunker.orgKnot Resolver 5 (for example in Debian 13)
Version 5 reads /etc/knot-resolver/kresd.conf. Add these lines there and restart the service, usually kresd@1.
policy.add(policy.all(policy.TLS_FORWARD({
{ '185.250.250.61', hostname = 'dnsbunker.org' },
{ '2a0a:51c1:a:ea::', hostname = 'dnsbunker.org' },
})))Pi-hole
Pi-hole can’t encrypt by itself. Run dnsproxy on the same device with this command, then in Pi-hole go to Settings › DNS, untick everything under Upstream DNS Servers, enter the second line under Custom DNS servers and click Save & Apply. Unbound works as well (see below); with the setup from the Pi-hole documentation, the entry is then 127.0.0.1#5335.
dnsproxy -l 127.0.0.1 -p 5053 -u sdns://BAMAAAAAAAAADjE4NS4yNTAuMjUwLjYxAA1kbnNidW5rZXIub3Jn -u sdns://AgMAAAAAAAAADjE4NS4yNTAuMjUwLjYxAA1kbnNidW5rZXIub3JnCi9kbnMtcXVlcnk127.0.0.1#5053stubby
In /etc/stubby/stubby.yml, replace the whole upstream_recursive_servers section, which lists several servers, with this one and restart stubby. The other defaults already fit: DoT only, with a mandatory certificate check. Keep the quotes around the IPv6 address.
upstream_recursive_servers:
- address_data: 185.250.250.61
tls_auth_name: "dnsbunker.org"
- address_data: "2a0a:51c1:a:ea::"
tls_auth_name: "dnsbunker.org"Technitium DNS Server
Technitium DNS Server runs on Windows, Linux, macOS and in Docker. In its web console, go to Settings › Proxy & Forwarders, enter the first line under Forwarders, select DNS-over-HTTPS under Forwarder Protocol and click Save Settings. The IP address in brackets saves Technitium the first lookup. For DoT, use the second line with DNS-over-TLS. With Enable DNSSEC Validation on, blocked domains appear as SERVFAIL; they’re blocked either way.
https://dnsbunker.org/dns-query (185.250.250.61)dnsbunker.org (185.250.250.61:853)Unbound
Add this to your Unbound configuration and restart Unbound. It forwards every lookup to DNSBunker over DoT; the part after # is again the name used to check the certificate. The path to the certificate bundle differs between systems (on OpenWrt, install the ca-bundle package). On most systems Unbound also checks DNSSEC itself; blocked domains then arrive as SERVFAIL instead of NXDOMAIN, but they’re blocked either way.
server:
tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
forward-zone:
name: "."
forward-tls-upstream: yes
forward-addr: 185.250.250.61@853#dnsbunker.org
forward-addr: 2a0a:51c1:a:ea::@853#dnsbunker.orgDone? Check that it worked.
Second opinion: dnscheck.tools shows which resolvers actually send your lookups. You should only see IP-Projects with 185.250.250.61 or 2a0a:51c1:a:ea:: (dnsbunker.org). Any other provider means some lookups bypass DNSBunker (a DNS leak).
This checks the DNS your browser is using right now. If the browser has its own “secure DNS” setting, the result applies to the browser only.
What other resolvers keep quiet about: requests from authorities, blocking orders and how the service is actually running. The figures below are aggregated totals and contain no personal data.
Operations, last 24 h
Queries by protocol
- Over IPv6
- –
- Answered from cache
- –
- Average response time
- –
- Blocked, by list
- –
Authorities and blocking orders
- Requests for user data
- 0
- Blocking orders (court, authority, CUII)
- 0
- Domains blocked for legal reasons
- none
As of October 2026. This list is updated whenever that changes. Since no query data is stored, there is nothing to hand over.
Found a security issue?
Please report it to security@dnsbunker.org, ideally encrypted with the PGP key. Good-faith research is protected by the disclosure policy; machine-readable details are in security.txt (RFC 9116).
How DNSBunker handles data is documented in the signed privacy audit (October 2026, in English), together with the server configuration, redacted only where security requires it.
The key standards DNSBunker implements, each checked against the live service (as of 14 October 2026).
RFC
Topic
How DNSBunker implements it
RFC 7858
DNS over TLS
Port 853, TLS 1.3 and 1.2 (ECDHE with AEAD ciphers only), ALPN
dot.RFC 8484 · 9114
DNS over HTTPS
/dns-query with GET and POST, over HTTP/2 and HTTP/3.RFC 9250
DNS over QUIC
Port 853/UDP, ALPN
doq, one stream per query.DNSCrypt v2
DNSCrypt
Port 8443/UDP and TCP, X25519 key exchange with XChaCha20-Poly1305, certificates renewed every 12 hours.
RFC 7766
DNS over TCP
Many queries per connection, answered out of order: a slow lookup never holds up the ones behind it.
RFC 9849 · 9460
Encrypted Client Hello
The ECH keys are published in the DNSSEC-signed HTTPS record of dnsbunker.org.
RFC 7830 · 8467
EDNS(0) padding
Answers to EDNS queries are padded to blocks of 468 bytes on every encrypted transport.
RFC 9156
QNAME minimisation
Each authoritative server only learns the part of the name it is responsible for.
RFC 7871
EDNS Client Subnet
Deliberately not used: no part of your IP address leaves the resolver.
RFC 4033–4035 · 5155
DNSSEC
Strict validation including NSEC3: bogus answers become SERVFAIL with an explanation (EDE).
RFC 8198
Aggressive NSEC/NSEC3 caching
Names that provably don't exist are answered from signed gaps already in the cache, without asking again.
RFC 8806 · 8976
Local root and arpa zones
Copies of the root zone (verified with ZONEMD and DNSSEC) and of arpa, in-addr.arpa and ip6.arpa (verified with DNSSEC) are kept in memory and refreshed every four hours, so root and reverse-lookup servers aren’t asked at all.
RFC 6303
Locally served zones
Reverse lookups for private address ranges (e.g. 192.168.x.x, 10.x.x.x) are answered locally and never leave the resolver.
RFC 6761 · 7686 · 8375
Special-use names
localhost resolves locally to 127.0.0.1; .invalid, .onion and home.arpa get NXDOMAIN.RFC 8914
Extended DNS Errors
Errors and blocks carry a reason, for example EDE 15 “Blocked” for filtered domains.
RFC 2308 · 8767
Negative caching & serve-stale
NXDOMAIN and NODATA carry the SOA for correct caching; if a domain's name servers fail, expired answers are served for up to 24 hours.
RFC 6891
EDNS(0)
Unknown options are ignored, unknown EDNS versions get BADVERS.
RFC 8482
ANY queries
Declined with NOTIMP and EDE 21 instead of producing oversized answers.