5.1 KiB
| layout | title | description | subtitle | permalink | cover |
|---|---|---|---|---|---|
| page | DNS | Public and unlogged DNS servers with Anycast, DoT, and DoH running on NixNet | Public but private DNS | /dns/ | /assets/pages/dns.png |
Preamble
Before going through and setting every device to use my DNS servers, I recommend you read sections 1 - 2 of a previous post so you actually understand what's happening and what you're doing. DNS is set up on the same servers as my Tor exits so, if you're in a country that actively blocks Tor, you could run into issues unless you use the Anycast IP/hostname.
Features
- Uncensored (the backend is Unbound)
- No logging (see Privacy Policy)
- Anycast
- DNS-over-TLS
- QNAME minimisation
- DNSSEC validation
- Optional adblock w/ Pi-Hole using my hosts.txt
IPs & Hostnames
For simplicity's sake, I recommend using the Anycast hostname as your primary, the location normally nearest to you as secondary, and a different provider for your tertiary DNS. With Anycast, you'll automatically use the server geographically nearest (the one with the lowest latency) and it will be secured with TLS. For more technical information on Anycast, click the link above. The second Anycast IP address is for plaintext DNS (not recommended); everything else is DNS-over-TLS. If you don't know what those are, the next section explains a bit more.
Uncensored Anycast
uncensored.any.dns.nixnet.xyz198.251.90.114:853(DoT)https://uncensored.any.dns.nixnet.xyz/dns-query(DoH)198.251.90.114(plaintext)
Adblock Anycast
adblock.any.dns.nixnet.xyz198.251.90.89:853(DoT)https://adblock.any.dns.nixnet.xyz/dns-query(DoH)198.251.90.89(plaintext)
Las Vegas
uncensored.lv1.dns.nixnet.xyzadblock.lv1.dns.nixnet.xyz209.141.34.95:853(DoT)https://uncensored.lv1.dns.nixnet.xyz/dns-query(DoH)https://adblock.lv1.dns.nixnet.xyz/dns-query(DoH)
New York
uncensored.ny1.dns.nixnet.xyzadblock.ny1.dns.nixnet.xyz199.195.251.84:853(DoT)https://uncensored.ny1.dns.nixnet.xyz/dns-query(DoH)https://adblock.ny1.dns.nixnet.xyz/dns-query(DoH)
Luxembourg
uncensored.lux1.dns.nixnet.xyzadblock.lux1.dns.nixnet.xyz104.244.78.231:853(DoT)https://uncensored.lux1.dns.nixnet.xyz/dns-query(DoH)https://adblock.lux1.dns.nixnet.xyz/dns-query(DoH)
After setting them, you can test your connection with ipleak.net. If you have JavaScript enabled, the line below will tell you which server you'll connect to with Anycast at the moment. If you travel a lot, that server will change depending on your location.
This element requires JavaScript to be enabled
* Please note that your DNS-over-TLS client must support SNI (Server Name Indication).
Recommendations
I recommend setting fallbacks with other providers (such as Lelux.fi's) in case mine are down for some reason. Redundancy is always a good thing. A friend of mine has a page with a list of DNS resolvers on it that you can peruse as well. I highly recommend DNS-over-TLS (DoT). Plaintext is . . . well . . . plaintext; anyone can snoop on your traffic. DoT is end-to-end encrypted so no one but you and the DNS server can see your queries. DNS-over-HTTPS (DoH) is just as secure but it's supported by far fewer devices and applications. It's also more difficult to set up 😅
The best thing to do, in my opinion, is set your DNS at the OS level with Stubby or Unbound, for example, and not at the application level i.e. with Firefox's DoH implementation. For more information about configuring custom DNS servers on various devices, read the related blog post.
If you don't want to use DNS for blocking ads, take a look at my post on doing it locally. There are solutions for most™ devices and none of the guides are particularly difficult to implement.
"Source"
All the software running the backend is open source so the configs are really the only unique parts about my setup. They can be found at NixNet/dns on my Gitea instance. If you have any questions, simply contact me somewhere!