dns.dws.rip

Free, private, recursive DNS with ad blocking. Encrypted via DoH, DoT, and DoQ. DNSSEC on every query. No logging. No PII. 190K domains blocked, list refreshed daily.

IPv4 anycast: 157.254.184.53 · IPv6 anycast: 2602:f4e8::53

Servers

Four anycast edges. Internet routing delivers your query to the nearest node automatically.

NodeIPv4Location
US-04173.199.127.44United States
EU-10118.91.187.140Netherlands
NL-1145.157.118.160Netherlands
FR-12185.10.17.176France

Connect

ProtocolAddressPort
Anycast DNS157.254.184.5353
Anycast IPv62602:f4e8::5353
DoTdns.dws.rip853
DoHdns.dws.rip/dns-query8443
DoQdns.dws.rip8853
Apple profiledws-dns.mobileconfig—

DNS-over-QUIC: almost nobody offers public DoQ. Cloudflare, Google, and Quad9 don't. We do.

Setup

Linux (systemd-resolved)

# /etc/systemd/resolved.conf.d/dws.conf
[Resolve]
DNS=157.254.184.53#dns.dws.rip
FallbackDNS=173.199.127.44#dns.dws.rip
DNSOverTLS=yes

$ sudo systemctl restart systemd-resolved

Plain DNS (no encryption): DNS=157.254.184.53 173.199.127.44, DNSOverTLS=no

Linux (NetworkManager)

nmcli con mod "Wired" ipv4.dns "157.254.184.53"
nmcli con mod "Wired" ipv4.dns-over-tls yes
nmcli con up "Wired"

Android 9+

Private DNS (DoT — recommended): Settings > Network > Private DNS > dns.dws.rip. Plain DNS: Settings > Network > Wi-Fi > Advanced > DNS > 157.254.184.53

iOS / macOS

DoH profile (recommended): download dws-dns.mobileconfig, then Settings > General > VPN & Device Management > Install. Manual: System Settings > Network > DNS > Add Server > 157.254.184.53

Windows 10/11

DoH (recommended): Settings > Network > DNS > Manual. Preferred: 157.254.184.53, DNS over HTTPS: On (automatic template).

Browser (DoH)

Firefox: Settings > Privacy > DNS over HTTPS > Custom. Chrome: Settings > Privacy > Use Secure DNS > Custom. Enter: https://dns.dws.rip:8443/dns-query

Router

DHCP/DNS servers: 157.254.184.53. OpenWrt DoT via stubby:

upstream_recursive_servers:
  - address_data: 157.254.184.53
    tls_auth_name: "dns.dws.rip"

DNS over QUIC

DoQ on port 8853. Client support is emerging: kdig +quic -p 8853 @dns.dws.rip example.com

Blocklist

190,859 domains from the HaGeZi Multi feed, refreshed every 24h at 03:00 UTC. dnsdist validates each update atomically before it goes live. Sources at code.dws.rip.

Infrastructure

IPv4 and IPv6 anycast announced via BGP from four edges (US-04, EU-10, NL-11, FR-12) across three transit providers: Vultr AS20473, Virtua AS35661, bgp.exchange AS24381. dnsdist 1.9 front end — packet cache, rate limiting, ad blocking. Unbound back end — DNSSEC, QNAME minimisation, recursion. DoQ is served natively by dnsdist.