1---
 2layout: page
 3title: DNS
 4description: Public and unlogged DNS servers with Anycast, DoT, and DoH running on NixNet
 5subtitle: Public but private DNS
 6permalink: /dns/
 7cover: /assets/pages/dns.png
 8---
 9# Preamble
10Before going through and setting every device to use my DNS servers, I recommend you read sections 1 - 2 of a [previous post](/blog/dns-and-root-certificates-what-you-need-to-know/#1-what-is-dns-and-why-does-it-concern-you) so you actually understand what's happening and what you're doing. DNS is set up on the same servers as my [Tor exits](/tor-nodes/) so, if you're in a country that actively blocks Tor, you could run into issues unless you use the Anycast IP/hostname.
11
12# Features
13* Uncensored (the backend is [Unbound](https://en.wikipedia.org/wiki/Unbound_(DNS_server)))
14* No logging (see [Privacy Policy](/privacy))
15* [Anycast](https://en.wikipedia.org/wiki/Anycast)
16* [DNS-over-TLS](https://en.wikipedia.org/wiki/DNS_over_TLS)
17* [QNAME minimisation](https://tools.ietf.org/html/rfc7816)
18* [DNSSEC validation](https://www.icann.org/resources/pages/dnssec-what-is-it-why-important-2019-03-05-en)
19* Optional adblock w/ [Pi-Hole](https://pi-hole.net/) using my [hosts.txt](/hosts.txt)
20
21# IPs & Hostnames
22For simplicity's sake, I recommend using the [Anycast](https://en.wikipedia.org/wiki/Anycast) hostname as your primary, the location normally nearest to you as secondary, and a different provider for your tertiary DNS. With Anycast, you'll automatically use the server geographically nearest (the one with the lowest latency) and it will be secured with TLS. For more technical information on Anycast, click the link above. The second Anycast IP address is for plaintext DNS (**not recommended**); everything else is DNS-over-TLS. If you don't know what those are, the next section explains a bit more.
23
24Uncensored Anycast
25* `uncensored.any.dns.nixnet.xyz`
26* `198.251.90.114:853` **(DoT)**
27* `https://uncensored.any.dns.nixnet.xyz/dns-query` **(DoH)**
28* `198.251.90.114` **(plaintext)**
29
30Adblock Anycast
31* `adblock.any.dns.nixnet.xyz`
32* `198.251.90.89:853` **(DoT)**
33* `https://adblock.any.dns.nixnet.xyz/dns-query` **(DoH)**
34* `198.251.90.89` **(plaintext)**
35
36Las Vegas
37* `uncensored.lv1.dns.nixnet.xyz`
38* `adblock.lv1.dns.nixnet.xyz`
39* `209.141.34.95:853` **(DoT)**
40* `https://uncensored.lv1.dns.nixnet.xyz/dns-query` **(DoH)**
41* `https://adblock.lv1.dns.nixnet.xyz/dns-query` **(DoH)**
42
43New York
44* `uncensored.ny1.dns.nixnet.xyz`
45* `adblock.ny1.dns.nixnet.xyz`
46* `199.195.251.84:853` **(DoT)**
47* `https://uncensored.ny1.dns.nixnet.xyz/dns-query` **(DoH)**
48* `https://adblock.ny1.dns.nixnet.xyz/dns-query` **(DoH)**
49
50Luxembourg
51* `uncensored.lux1.dns.nixnet.xyz`
52* `adblock.lux1.dns.nixnet.xyz`
53* `104.244.78.231:853` **(DoT)**
54* `https://uncensored.lux1.dns.nixnet.xyz/dns-query` **(DoH)**
55* `https://adblock.lux1.dns.nixnet.xyz/dns-query` **(DoH)**
56
57After setting them, you can test your connection with [ipleak.net](https://ipleak.net). If you have JavaScript enabled, the line below will tell you which server you'll connect to with Anycast at the moment. If you travel a lot, that server will change depending on your location.
58
59<code id="server">This element requires JavaScript to be enabled</code>
60
61\* Please note that your DNS-over-TLS client must support [SNI](https://en.wikipedia.org/wiki/Server_Name_Indication) (Server Name Indication).
62
63# Recommendations
64I recommend setting fallbacks with other providers (such as [Lelux.fi's](https://lelux.fi/resolver/)) in case mine are down for some reason. Redundancy is always a good thing. A friend of mine has a page with a list of [DNS resolvers](https://wiki.lelux.fi/dns/resolvers/) on it that you can peruse as well. I highly recommend DNS-over-TLS (DoT). Plaintext is . . . well . . . plaintext; anyone can snoop on your traffic. DoT is end-to-end encrypted so no one but you and the DNS server can see your queries. DNS-over-HTTPS (DoH) is just as secure but it's supported by far fewer devices and applications. It's also more difficult to set up 😅
65
66The best thing to do, in my opinion, is set your DNS at the OS level with [Stubby](https://wiki.archlinux.org/index.php/Stubby) or [Unbound](https://wiki.archlinux.org/index.php/Unbound), for example, and not at the application level i.e. with Firefox's DoH implementation. For more information about configuring custom DNS servers on various devices, read the related [blog post](/blog/setting-dns-on-mobile-and-desktop/).
67
68If you don't want to use DNS for blocking ads, take a look at my post on doing it [locally](/blog/blocking-ads-on-mobile-and-desktop/). There are solutions for most&trade; devices and none of the guides are *particularly* difficult to implement.
69
70# "Source"
71All the software running the backend is open source so the configs are really the only unique parts about my setup. They can be found at [NixNet/dns](https://git.nixnet.xyz/NixNet/dns) on my Gitea instance. If you have any questions, simply [contact me](/contact) somewhere!
72
73<script>
74fetch("https://check.any.dns.nixnet.xyz/check")
75  .then((response) => response.text())
76  .then((server) => document.getElementById("server").innerHTML = server)
77</script>