dns.dws.rip

Free, private, recursive DNS with ad blocking.

Encrypted via DoH, DoT, and DoQ. DNSSEC on every query. No logging. No PII. 190K domains blocked, list refreshed daily.

ipv4 anycast
157.254.184.53
ipv6 anycast
2602:f4e8::53
domains blocked
190K
anycast edges
4
encrypted transports
3
queries logged
0
Fig. 1 DoH, DoT and DoQ, with DNSSEC on every query.

01Servers.

Four anycast edges. Internet routing delivers your query to the nearest node automatically.

NodeIPv4Location
US-04173.199.127.44United States
EU-10118.91.187.140Netherlands
NL-1145.157.118.160Netherlands
FR-12185.10.17.176France
Fig. 2 The four anycast edges.

02Connect.

ProtocolAddressPort
Anycast DNS157.254.184.5353
Anycast IPv62602:f4e8::5353
DoTdns.dws.rip853
DoHdns.dws.rip/dns-query8443
DoQdns.dws.rip8853
Apple profiledws-dns.mobileconfig—

DNS-over-QUIC: almost nobody offers public DoQ. Cloudflare, Google, and Quad9 don't. We do.

ResolverDoQ
dns.dws.ripyes
Cloudflareno
Googleno
Quad9no
Fig. 3 Public DNS over QUIC, port 8853.

03Setup.

Linux (systemd-resolved)

# /etc/systemd/resolved.conf.d/dws.conf
[Resolve]
DNS=157.254.184.53#dns.dws.rip
FallbackDNS=173.199.127.44#dns.dws.rip
DNSOverTLS=yes

$ sudo systemctl restart systemd-resolved

Plain DNS (no encryption): DNS=157.254.184.53 173.199.127.44, DNSOverTLS=no

Linux (NetworkManager)

nmcli con mod "Wired" ipv4.dns "157.254.184.53"
nmcli con mod "Wired" ipv4.dns-over-tls yes
nmcli con up "Wired"

Android 9+

Private DNS (DoT — recommended): Settings > Network > Private DNS > dns.dws.rip. Plain DNS: Settings > Network > Wi-Fi > Advanced > DNS > 157.254.184.53

iOS / macOS

DoH profile (recommended): download dws-dns.mobileconfig, then Settings > General > VPN & Device Management > Install. Manual: System Settings > Network > DNS > Add Server > 157.254.184.53

Windows 10/11

DoH (recommended): Settings > Network > DNS > Manual. Preferred: 157.254.184.53, DNS over HTTPS: On (automatic template).

Browser (DoH)

Firefox: Settings > Privacy > DNS over HTTPS > Custom. Chrome: Settings > Privacy > Use Secure DNS > Custom. Enter: https://dns.dws.rip:8443/dns-query

Router

DHCP/DNS servers: 157.254.184.53. OpenWrt DoT via stubby:

upstream_recursive_servers:
  - address_data: 157.254.184.53
    tls_auth_name: "dns.dws.rip"

DNS over QUIC

DoQ on port 8853. Client support is emerging: kdig +quic -p 8853 @dns.dws.rip example.com

plain
157.254.184.53
ipv6
2602:f4e8::53
dot
dns.dws.rip
doh
https://dns.dws.rip:8443/dns-query
doq
dns.dws.rip:8853
Fig. 4 Whatever the settings screen asks for, it's one of these.

04Blocklist.

190,859 domains from the HaGeZi Multi feed, refreshed every 24h at 03:00 UTC. dnsdist validates each update atomically before it goes live. Sources at code.dws.rip.

domains
190,859
feed, HaGeZi Multi
1
refresh
24h
utc, daily
03:00
Fig. 5 The blocklist. A bad update never goes live.

05Infrastructure.

IPv4 and IPv6 anycast announced via BGP from four edges (US-04, EU-10, NL-11, FR-12) across three transit providers: Vultr AS20473, Virtua AS35661, bgp.exchange AS24381. dnsdist 1.9 front end — packet cache, rate limiting, ad blocking. Unbound back end — DNSSEC, QNAME minimisation, recursion. DoQ is served natively by dnsdist.

  1. 1157.254.184.53anycast, nearest of four edges
  2. 2dnsdist 1.9packet cache, rate limiting, ad blocking, DoQ
  3. 3UnboundDNSSEC, QNAME minimisation, recursion
Fig. 6 A query's path. Blocked names stop at step 2.