1---
 2layout: page
 3title: DNS
 4description: Uncensored public DNS servers running on NixNet
 5subtitle: Uncensored public DNS servers
 6permalink: /dns/
 7cover: /assets/pages/dns.png
 8---
 9# Preamble
10Before going through and setting every device to use my DNS servers, I recommend you read sections 1 - 2 of a [previous post](/blog/dns-and-root-certificates-what-you-need-to-know/#1-what-is-dns-and-why-does-it-concern-you) so you actually understand what's happening and what you're doing. DNS is set up on the same servers as my [Tor exits](/tor-nodes/) so, if you're in a country that actively blocks Tor, you could run into issues unless you use the Anycast IP/hostname.
11
12# Features
13* Uncensored (the backend is [Unbound](https://en.wikipedia.org/wiki/Unbound_(DNS_server)))
14* No logging (see [Privacy Policy](/privacy))
15* [Anycast](https://en.wikipedia.org/wiki/Anycast)
16* [DNS-over-TLS](https://en.wikipedia.org/wiki/DNS_over_TLS)
17* [QNAME minimisation](https://tools.ietf.org/html/rfc7816)
18* [DNSSEC validation](https://www.icann.org/resources/pages/dnssec-what-is-it-why-important-2019-03-05-en)
19* Optional adblock w/ [Pi-Hole](https://pi-hole.net/) using my [hosts.txt](/hosts.txt)
20
21# IPs & Hostnames
22For simplicity's sake, I recommend using the [Anycast](https://en.wikipedia.org/wiki/Anycast) hostname as your primary, the location normally nearest to you as secondary, and a different provider for your tertiary DNS. With Anycast, you'll automatically use the server geographically nearest (the one with the lowest latency) and it will be secured with TLS. For more technical information on Anycast, click the link above. The second Anycast IP address is for plaintext DNS (**not recommended**); everything else is DNS-over-TLS. If you don't know what those are, the next section explains a bit more.
23
24Anycast
25* `uncensored.any.dns.nixnet.xyz`
26* `adblock.any.dns.nixnet.xyz`
27* `198.251.90.114:853` **(DoT)**
28* `198.251.90.114` **(plaintext)**
29
30Las Vegas
31* `uncensored.lv1.dns.nixnet.xyz`
32* `adblock.lv1.dns.nixnet.xyz`
33* `209.141.34.95:853` **(DoT)**
34
35New York
36* `uncensored.ny1.dns.nixnet.xyz`
37* `adblock.ny1.dns.nixnet.xyz`
38* `199.195.251.84:853` **(DoT)**
39
40Luxembourg
41* `uncensored.lux1.dns.nixnet.xyz`
42* `adblock.lux1.dns.nixnet.xyz`
43* `104.244.78.231:853` **(DoT)**
44
45After setting them, you can test your connection with [ipleak.net](https://ipleak.net). If you have JavaScript enabled, the line below will tell you which server you'll connect to with Anycast at the moment. If you travel a lot, that server will change depending on your location.
46
47<code id="server">This element requires JavaScript to be enabled</code>
48
49\* Please note that your DNS-over-TLS client must support [SNI](https://en.wikipedia.org/wiki/Server_Name_Indication) (Server Name Indication).
50
51# Recommendations
52I recommend setting fallbacks with other providers (such as [Lelux.fi's](https://lelux.fi/resolver/)) in case mine are down for some reason. Redundancy is always a good thing. A friend of mine has a page with a list of [DNS resolvers](https://wiki.lelux.fi/dns/resolvers/) on it that you can peruse as well. I highly recommend DNS-over-TLS (DoT). Plaintext is . . . well . . . plaintext; anyone can snoop on your traffic. DoT is end-to-end encrypted so no one but you and the DNS server can see your queries. DNS-over-HTTPS (DoH) is just as secure but it's supported by far fewer devices and applications. It's also more difficult to set up 😅
53
54The best thing to do, in my opinion, is set your DNS at the OS level with [Stubby](https://wiki.archlinux.org/index.php/Stubby) or [Unbound](https://wiki.archlinux.org/index.php/Unbound), for example, and not at the application level i.e. with Firefox's DoH implementation. For more information about configuring custom DNS servers on various devices, read the related [blog post](/blog/setting-dns-on-mobile-and-desktop/).
55
56If you don't want to use DNS for blocking ads, take a look at my post on doing it [locally](/blog/blocking-ads-on-mobile-and-desktop/). There are solutions for most&trade; devices and none of the guides are *particularly* difficult to implement.
57
58# "Source"
59All the software running the backend is open source so the configs are really the only unique parts about my setup. They can be found at [NixNet/dns](https://git.nixnet.xyz/NixNet/dns) on my Gitea instance. If you have any questions, simply [contact me](/contact) somewhere!
60
61<script>
62fetch("https://check.any.dns.nixnet.xyz/check")
63  .then((response) => response.text())
64  .then((server) => document.getElementById("server").innerHTML = server)
65</script>