DNSBunker

Hagezi's Pro list blocks known ad servers and tracking or telemetry domains across apps, smart TVs and browsers, not only web pages.

Hagezi's Threat Intelligence Feed adds phishing, malware and newly weaponised domains, updated continuously.

Wildcard and regular-expression rules catch generated and rotating hostnames that a plain domain list would miss.

If a legitimate domain is blocked, report it to the maintainers of the list that contains it. For Hagezi lists, the right place is the Hagezi issue tracker.

DNSBunker does not block answers that resolve to private or loopback addresses. Filtering those out indiscriminately breaks legitimate setups like split-horizon DNS, home automation and self-hosted services reached by their public hostname. Protection against DNS rebinding belongs on the client, which has the context to judge whether a private-IP answer makes sense.

DNSBunker does not keep a history of requested domains. Client IPs and query contents are not written to persistent storage, so the resolver cannot build a browsing profile from them.

When the resolver has to ask authoritative nameservers, it sends only the part of the name needed for that step (RFC 9156). Higher-level servers do not receive the full hostname if it is not necessary.

The infrastructure is located in Frankfurt, Germany. The project is operated under EU data protection law and the German legal pages linked below describe the processing details.

DNSBunker has no ad business, investor story or analytics product attached to it. It is a private, non-commercial resolver for people who want a stricter default without running the whole stack themselves.

Query dispatching runs on dnsdist, recursive resolution on Knot Resolver. Both are established open-source projects from the DNS infrastructure world, not a custom black box built for this project alone.

Every claim on this page is backed by a technical description in the Privacy Policy: what is processed, for how long, and why.

Queries are accepted exclusively over DoH, DoT and DoQ. Plain DNS on port 53 is closed to the outside, so lookups can't be read or altered in transit by a network sitting in between.

DNSSEC validation checks whether signed DNS answers still match their cryptographic chain. DNSBunker treats broken or invalid signatures as a failed answer instead of quietly falling back to unsigned trust.

DoH and DoH3 connections use Encrypted Client Hello, so the initial TLS handshake does not reveal in cleartext that a device is talking to DNSBunker specifically. Without ECH, that server name is visible to anyone watching the connection, even though the DNS traffic itself is encrypted.