Terms of
Service

DNSBunker is a private, non-commercial project. Anyone may use it free of charge, without registering.

The Hagezi block lists apply to all users and can't be switched off individually. Occasionally a legitimate site is blocked by mistake, and the filter doesn't replace security software.

There's no uptime guarantee, and the service may change or end at any time. If you depend on DNS always working, keep a second encrypted DNS provider as a backup where your device allows it.

Attacks, automated mass queries, DNS tunnel abuse, probing the infrastructure and illegal use are prohibited. Addresses that do this can be blocked without notice.

Because nothing is stored, DNSBunker can't hand over lookups or IP addresses to anyone, authorities included. Your internet provider can still see that you connect to DNSBunker, just not what you look up.

DNSBunker is a non-commercial, privacy-oriented public recursive DNS resolver operated as a private project from Germany. It is provided free of charge, without registration, and without creating a user account. The service performs DNS resolution on behalf of clients and applies DNS-based content filtering. It is not a commercial service, does not generate revenue, and does not offer service level guarantees.

DNSBunker accepts DNS queries exclusively via encrypted protocols: DNS-over-TLS (DoT, port 853), DNS-over-HTTPS (DoH, https://dnsbunker.org/dns-query), and DNS-over-QUIC (DoQ, port 853). Unencrypted queries on port 53 are not answered. Users are responsible for configuring a DNS client that supports one of these protocols. Use of the service over a proxy, VPN exit node, or shared infrastructure that alters the source IP is permitted but may affect abuse detection behaviour.

DNSBunker applies DNS-based content filtering using the Hagezi blocklist suite (github.com/hagezi/dns-blocklists). Domains classified as malicious, phishing-related, tracking, advertising, or otherwise undesirable by these lists receive a NXDOMAIN (non-existent domain) response. The following apply: Filtering is applied uniformly to all users, with no opt-out and no per-client disable mechanism. Blocklists are updated regularly (typically multiple times per day) and filtered domains may change without notice. DNSBunker makes no warranty as to the completeness, accuracy, or up-to-date status of filtering decisions. Legitimate domains may occasionally appear on blocklists (false positives); if you believe a domain is incorrectly blocked, report it to the maintainers of the list that contains it. Content filtering is provided as a feature, not a security guarantee, and does not replace dedicated security software.

DNSBunker performs DNSSEC validation for all resolved domains where DNSSEC records are present. Responses that fail DNSSEC validation are not forwarded to clients. This provides protection against DNS cache poisoning and certain forms of DNS spoofing. DNSSEC validation does not guarantee the content of the resolved resource, only the integrity of the DNS response itself.

The DNS resolver is provided on an "as is" and "as available" basis. No service level agreement, uptime guarantee, or warranty of any kind is offered. Interruptions may occur due to maintenance, infrastructure failure, upstream issues, or events outside the operator's control. DNSBunker reserves the right to modify, restrict, suspend, or permanently discontinue the service at any time and without notice. Users are advised to configure a fallback DNS resolver in their network settings.

DNSBunker is intended for use as a general-purpose DNS resolver by individuals and organisations who wish to benefit from encrypted DNS transport, content filtering, and DNSSEC validation. No registration is required. Use is open to anyone who accepts these Terms.

The following uses are prohibited: deliberate resource exhaustion or denial-of-service attacks, automated high-volume querying that exceeds reasonable use, use in violation of applicable law, probing or exploiting the service infrastructure, and unlawful circumvention of content filtering. DNSBunker reserves the right to block access from IP addresses or ranges engaged in prohibited use, without notice and without liability.

DNSBunker does not store, log, or retain any personal data about users of the DNS resolver beyond the immediate in-memory processing required to answer a query. No query logs, no IP address logs, no session identifiers, and no usage histories are written to any persistent medium. For a full technical description, see the Privacy Policy.

Since no personal data is retained by DNSBunker, it is not possible to comply with any request, judicial, administrative or otherwise, for user data, query logs, or connection records. This is not a policy position or a refusal to cooperate with lawful authority. It is a factual consequence of the service's technical architecture: the data does not exist and cannot be produced. Any legally valid request for user data would necessarily receive a response confirming that no responsive data is held.

Germany's prior data retention regime (Vorratsdatenspeicherung) was declared incompatible with EU law by the Court of Justice of the European Union (CJEU) in its judgment of September 2022. As of the date of this policy, no general obligation to retain DNS query data exists under German or EU law applicable to a non-commercial DNS resolver of this nature. Should such an obligation be introduced in future, this policy will be updated accordingly.

While DNSBunker is designed to minimise data retention, users with strong anonymity requirements should be aware of limitations inherent to any DNS resolver, including visibility of the server's IP to authoritative nameservers and to the user's own ISP. For maximum anonymity, routing DNS traffic through a trustworthy VPN or Tor before reaching DNSBunker is outside the scope of what this service can guarantee on its own.

To the extent permitted by applicable law, DNSBunker and its operator accept no liability for damages arising from use of or inability to use the service, including but not limited to: service interruptions, incorrect or missing DNS responses, filtering decisions, DNSSEC validation failures, security incidents, or reliance on the service for critical infrastructure. This limitation does not apply to damages caused by intent or gross negligence, nor to liability for personal injury, nor to claims under the German Product Liability Act (Produkthaftungsgesetz).

This website may contain links to external third-party sites. DNSBunker has no control over their content, availability, or privacy practices and accepts no liability for them. Responsibility for external content rests solely with the respective operators. Links found to be unlawful will be removed promptly upon notification.

All content created by DNSBunker, including website text, design and documentation, is subject to applicable copyright law. Reproduction, modification, or distribution beyond the scope permitted by law requires prior written authorisation from the operator.

These Terms are governed by the laws of the Federal Republic of Germany, excluding conflict of law provisions. For users who are consumers within the European Union, the mandatory consumer protection provisions of the country of habitual residence apply in addition and take precedence where they provide greater protection. The place of jurisdiction is, to the extent legally permissible, Freiberg, Saxony, Germany (Amtsgericht / Landgericht Freiberg). DNSBunker is not obligated to participate in consumer arbitration proceedings under the VSBG (Verbraucherstreitbeilegungsgesetz) and does not voluntarily participate.

DNSBunker reserves the right to amend these Terms at any time. Continued use of the service following publication of amended Terms constitutes acceptance. The current version is always the one published at this URL. For material changes, an updated date will appear at the bottom of this page.

Should any provision of these Terms be found invalid or unenforceable by a court of competent jurisdiction, the remaining provisions remain in full force and effect. The invalid provision shall be replaced by the legally permissible provision that most closely reflects the original intent of the parties.