Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

These are currently listed on the DNS Privacy Public Resolvers page and also the list maintained on the curl wiki. For any servers below with the note 'also does DoH' check these pages or the website of the service for the DoH endpoint.

DoT servers

The following servers are experimental DNS-over-TLS servers.

...

Hosted byIP addressesTLS PortsHostname for TLS
authentication
Base 64 encoded form of SPKI pin(s) for TLS
authentication (RFC7858)
TLSA record publishedLoggingSoftwareNotes
UncensoredDNS89.233.43.71 
2a01:3a0:53:53::0
853unicast.censurfridns.dkwikE3jYAA6jQmXYTr/rbHeEPmC78dQwZbQp6WdrseEs=YTraffic volume only
See https://blog.uncensoreddns.org/

Fondation RESTENA
(NREN for Luxemburg)

158.64.1.29
2001:a18:1::29

853kaitain.restena.lu7ftvIkA+UeN/ktVkovd/7rPZ6mbkhVI7/8HnFJIiLa4=
Traffic volume onlyUnboundConfigured with qname-minimisation, use-caps-for-id, aggressive-nsec,

prefetch, harden-below-nxdomain and the newest auth-zone for local root
zone caching.

Surfnet145.100.185.18
2001:610:1:40ba:145:100:185:18
853dnsovertls3.sinodun.com5SpFz7JEPzF71hditH1v2dBhSErPUMcLPJx1uk2svT8=YTraffic volume onlyHAProxy + BIND 9.12Supports TLS 1.3 and TLS 1.2. Our initial stability problems are solved... see here for details.
Surfnet145.100.185.17
2001:610:1:40ba:145:100:185:17
853dnsovertls2.sinodun.comNAXBESvpjZMnPWQcrxa2KFIkHV/pDEIjRkA3hLWogSg=YTraffic volume onlyKnot Resolver
dkg199.58.81.218
2001:470:1c:76d::53
853 443dns.cmrg.net3IOHSS48KOc/zlkKGtI46a9TY9PPKDVGhE3W2ZS4JZo=
5zFN3smRPuHIlM/8L+hANt99LW26T97RFHqHv90awjo=

NoneKnot ResolverSee https://dns.cmrg.net/ Note that on port 443 this server can serve both HTTP 1.1 traffic (to securely access the nameserver credentials) on TLS connections and DNS-over-TLS on separate TLS connections due to some nifty, experimental demultiplexing of traffic, described here.Has some issues with DNSSEC responses - this is under investigation.
dns.larsdebruin.net (Previously dns1.darkmoon.is)51.15.70.167853UPDATED on 30 Jan 2018
dns.larsdebruin.net
UPDATED on 30 Jan 2018 AAT+rHoKx5wQkWhxlfrIybFocBu3RBrPD2/ySwIwmvA=
Traffic volume onlyUnbound
securedns.eu146.185.167.43
2a03:b0c0:0:1010::e9a:3001
853dot.securedns.euh3mufC43MEqRD6uE4lz6gAgULZ5/riqH/E+U+jE3H8g=
NoneHaProxy + BindNOTE 1: SecureDNS has support for additional TLDs of OpenNIC, Emercoin, and NamecoinNOTE 2: While both secure.eu and dot.secure.eu are running pin only validation for dot.secure.eu will not work!
dns-tls.bitwiseshift.net81.187.221.24
2001:8b0:24:24::24
853dns-tls.bitwiseshift.netYmcYWZU5dd2EoblZHNf1jTUPVS+uK3280YYCdz4l4wo=
NoneUnbound
ns1.dnsprivacy.at94.130.110.185
2a01:4f8:c0c:3c03::2
853ns1.dnsprivacy.atvqVQ9TcoR9RDY3TpO0MTXw1YQLjF44zdN3/4PkLwtEY=
NoneUnboundSee https://dnsprivacy.at/
ns2.dnsprivacy.at94.130.110.178
2a01:4f8:c0c:3bfc::2
853ns2.dnsprivacy.ats5Em89o0kigwfBF1gcXWd8zlATSWVXsJ6ecZfmBDTKg=
NoneUnbound
dns.bitgeek.in (India)139.59.51.46853dns.bitgeek.inFndaG4ezEBQs4k0Ya3xt3z4BjFEyQHd7B75nRyP1nTs=
Traffic volume onlyNginx + BIND
Lorraine Data Network80.67.188.188
2001:913::8
853
443

WaG0kHUS5N/ny0labz85HZg+v+f0b/UQ73IZjFep0nM=
Traffic volume onlystunnel 4 + BINDSee https://ldn-fai.net/serveur-dns-recursif-ouvert/ (note, logging of IP address at stunnel no longer performed).
A self-signed certificate is used, so SPKI pinning is must be used.
dns.neutopia.org89.234.186.112
2a00:5884:8209::2
853
443
dns.neutopia.orgwTeXHM8aczvhRSi0cv2qOXkXInoDU+2C+M8MpRyT3OI=
No loggingKnot resolver
BlahDNS108.61.201.119
2001:19f0:7001:1ded:5400:01ff:fe90:945b

853
443

dot-jp.blahdns.com

No logging

https://blahdns.com/

NOTE1: Located in Japan. Also does DoH.
NOTE2: Note that port 443 REQUIRES an authentication name

UPDATED 22nd JAN 2018: note the authentication name has changed

BlahDNS159.69.198.101
2a01:4f8:1c1c:6b4b::1

853
443

dot-de.blahdns.com

No logging

https://blahdns.com/

NOTE1: Located in Frankfurt. Also does DoH.
NOTE2: Note that port 443 REQUIRES an authentication name

Go6Lab2001:67c:27e4::35853privacydns.go6lab.sig5lqtwHia/plKqWU/Fe2Woh4+7MO3d0JYqYJpj/iYAw=
No loggingUnbound
Tenta 99.192.182.200, 66.244.159.200853

iana.tenta.io




Traffic volume onlyTentahttps://tenta.com/privacy-policy
Tenta 99.192.182.100, 66.244.159.100853opennic.tenta.io

Traffic volume onlyTenta

NOTE: Uses OpenNIC Root!


dns.233py.comVarious, see notes853 dns.233py.com

No loggingUnbound + DOH C/S

https://dns.233py.com (Chinese language version)

Shanghai (Eastern China): 47.101.136.37/edns.233py.com
Chongqing (Western China): 118.24.208.197/wdns.233py.com
Beijing (North China): 114.115.240.175/ndns.233py.com
Guangzhou (Southern China): 119.29.107.85/sdns.233py.com

NOTE: Blocks ads and trackers. Also support DoH (see website)

Secure DNS Project by PumpleX51.38.83.141
2001:41d0:801:2000::d64
853dns.oszx.coP/Auj1pm8MiUpeIxGcrEuMJOQV+pgPY0MR4awpclvT4=
No logging
https://dns.oszx.co
NOTE1: Also does DoH and dnscrypt
NOTE2: Performs ad blocking
Foundation for Applied Privacy37.252.185.232
2a00:63c1:a:229::3

853
443

dot1.appliedprivacy.net
YOnly aggregated logging, no PIIunbound

https://appliedprivacy.net/services/dns/

NOTE: Also does DoH and has an .onion endpoint

ibksturm.synology.me

217.162.206.220

853ibksturm.synology.me

No loggingnginx + unbound

https://github.com/ibksturm/dnscrypt-switzerland

NOTE: Also does DoH and dnscrypt
no filters, opennic root copy

DNS Warden


116.203.70.156
2a01:4f8:1c1c:75b4::1


853dot1.dnswarden.com

No loggingdnsdist

DETAILS UPDATED 18th Mar 2019

Website is a work in progress: dnswarden.com

NOTE1: These servers have ad and tracker blocking with return of NXDOMAIN for bad domains.

NOTE2: Also supports OpenNIC TLDs. Also does DoH.

DNS Warden


116.203.35.255
2a01:4f8:1c1c:5e77::1


853dot2.dnswarden.com

No loggingdnsdist

...