#### Need some coffees (25 EUR/ per month) for servers to keep this project healthy.

## Announcements

No logs | No EDNS Client-Subnet | OpenNIC support | Ethereum Name Service | DNSSEC ready | Yggdrasil | Filtered ads, trackers, malware, prevent CNAME Cloacking

- Germany server is move to a new server with new IP address ( 2020/11/1 19:15 CST)
- Google Analytics tracking script url: www.google-analytics.com is blocked, but Admin panel for site admin is not blocked: analytics.google.
- DoH CDN (adblock) https://doh1.blahdns.com/dns-query | https://doh2.blahdns.com/dns-query
- DoH CDN (uncensor) https://doh1.blahdns.com/uncensor | https://doh2.blahdns.com/uncensor
- Yggdrasil network DNS-over-TLS Github
- DNS-over-TLS, DNS-over-HTTPS on PORT 443 will require strict SNI, without SNI will be dropped by default.
- Server status
- If you encounter a problem, please submit it on Github

## Our servers

### Japan 🇯🇵

- ### DNS-over-HTTPS

  https://doh-jp.blahdns.com/dns-query

  IPv4-stamp:

  sdns://AgMAAAAAAAAACzQ1LjMyLjU1Ljk0ABJkb2gtanAuYmxhaGRucy5jb20KL2Rucy1xdWVyeQ

  IPv6-stamp:

  sdns://AgMAAAAAAAAAKVsyMDAxOjE5ZjA6NzAwMTozMjU5OjU0MDA6MDJmZjpmZTcxOjBiYzldABJkb2gtanAuYmxhaGRucy5jb20KL2Rucy1xdWVyeQ

  ### DNS-over-TLS

  IP address:
  45.32.55.94
  2001:19f0:7001:3259:5400:02ff:fe71:0bc9

  tls_auth_name:
  dot-jp.blahdns.comport: 853, 443 (Strict SNI, without SNI will drop)

  ### DNSCrypt v2

  port: 8443

  IPv4 - DNSStamp:
  sdns://AQMAAAAAAAAAEDQ1LjMyLjU1Ljk0Ojg0NDMgU4ToFEMUKT5W3RsUCh7xcq1HvboXmciVcpSVPQNOtccbMi5kbnNjcnlwdC1jZXJ0LmJsYWhkbnMuY29t

  IPv6 - DNSStamp:
  sdns://AQMAAAAAAAAALlsyMDAxOjE5ZjA6NzAwMTozMjU5OjU0MDA6MDJmZjpmZTcxOjBiYzldOjg0NDMgU4ToFEMUKT5W3RsUCh7xcq1HvboXmciVcpSVPQNOtccbMi5kbnNjcnlwdC1jZXJ0LmJsYWhkbnMuY29t

### Singapore 🇸🇬

- ### DNS-over-HTTPS

  https://doh-sg.blahdns.com/dns-query

  IPv4-stamp:

  sdns://AgMAAAAAAAAADjEzOS4xODAuMTQxLjU3ABJkb2gtc2cuYmxhaGRucy5jb20KL2Rucy1xdWVyeQ

  IPv6-stamp:

  sdns://AgMAAAAAAAAAKFsyMDAxOjE5ZjA6NDQwMDo2YmVkOjU0MDA6MmZmOmZlYjE6ZjlmYV0AEmRvaC1zZy5ibGFoZG5zLmNvbQovZG5zLXF1ZXJ5

  ### DNS-over-TLS

  IP address:
  139.180.141.57
  2001:19f0:4400:6bed:5400:2ff:feb1:f9fa

  tls_auth_name:
  dot-sg.blahdns.comport: 853, 443 (Strict SNI, without SNI will drop)

  ### DNSCrypt v2

  port: 8443

  IPv4 - DNSStamp:
  sdns://AQMAAAAAAAAAEzEzOS4xODAuMTQxLjU3Ojg0NDMgU4ToFEMUKT5W3RsUCh7xcq1HvboXmciVcpSVPQNOtccbMi5kbnNjcnlwdC1jZXJ0LmJsYWhkbnMuY29t

  IPv6 - DNSStamp:
  sdns://AQMAAAAAAAAALVsyMDAxOjE5ZjA6NDQwMDo2YmVkOjU0MDA6MmZmOmZlYjE6ZjlmYV06ODQ0MyBThOgUQxQpPlbdGxQKHvFyrUe9uheZyJVylJU9A061xxsyLmRuc2NyeXB0LWNlcnQuYmxhaGRucy5jb20

### Germany 🇩🇪

- ### DNS-over-HTTPS

  https://doh-de.blahdns.com/dns-query

  IPv4-stamp:

  sdns://AgMAAAAAAAAADTc4LjQ2LjI0NC4xNDMAEmRvaC1kZS5ibGFoZG5zLmNvbQovZG5zLXF1ZXJ5

  IPv6-stamp:

  sdns://AgMAAAAAAAAAFlsyYTAxOjRmODpjMTc6ZWM2Nzo6MV0AEmRvaC1kZS5ibGFoZG5zLmNvbQovZG5zLXF1ZXJ5

  ### DNS-over-TLS

  IP address:
  78.46.244.143
  2a01:4f8:c17:ec67::1

  tls_auth_name:
  dot-de.blahdns.comport: 853, 443 (Strict SNI, without SNI will drop)

  ### DNSCrypt v2

  port: 8443

  IPv4 - DNSStamp:
  sdns://AQMAAAAAAAAAEjc4LjQ2LjI0NC4xNDM6ODQ0MyBThOgUQxQpPlbdGxQKHvFyrUe9uheZyJVylJU9A061xxsyLmRuc2NyeXB0LWNlcnQuYmxhaGRucy5jb20

  IPv6 - DNSStamp:
  sdns://AQMAAAAAAAAAG1syYTAxOjRmODpjMTc6ZWM2Nzo6MV06ODQ0MyBThOgUQxQpPlbdGxQKHvFyrUe9uheZyJVylJU9A061xxsyLmRuc2NyeXB0LWNlcnQuYmxhaGRucy5jb20

### Finland 🇫🇮

- ### DNS-over-HTTPS

  https://doh-fi.blahdns.com/dns-query

  IPv4-stamp:

  sdns://AgMAAAAAAAAADjk1LjIxNi4yMTIuMTc3ABJkb2gtZmkuYmxhaGRucy5jb20KL2Rucy1xdWVyeQ

  IPv6-stamp:

  sdns://AgMAAAAAAAAAF1syYTAxOjRmOTpjMDEwOjQzY2U6OjFdABJkb2gtZmkuYmxhaGRucy5jb20KL2Rucy1xdWVyeQ

  ### DNS-over-TLS

  IP address:
  95.216.212.177
  2a01:4f9:c010:43ce::1

  tls_auth_name:
  dot-fi.blahdns.comport: 853, 443 (Strict SNI, without SNI will drop)

  ### DNSCrypt v2

  port: 8443

  IPv4 - DNSStamp:
  sdns://AQMAAAAAAAAAEzk1LjIxNi4yMTIuMTc3Ojg0NDMgU4ToFEMUKT5W3RsUCh7xcq1HvboXmciVcpSVPQNOtccbMi5kbnNjcnlwdC1jZXJ0LmJsYWhkbnMuY29t

  IPv6 - DNSStamp:
  sdns://AQMAAAAAAAAAHFsyYTAxOjRmOTpjMDEwOjQzY2U6OjFdOjg0NDMgU4ToFEMUKT5W3RsUCh7xcq1HvboXmciVcpSVPQNOtccbMi5kbnNjcnlwdC1jZXJ0LmJsYWhkbnMuY29t

## News

Domain Name

### DNSCrypt v2

- Simple DNSCrypt (Windows)
- dnscrypt-proxy (macOS, Linux)
- DNSCloak (iOS)

### DNS-over-TLS

- Stubby (Linux, Windows, macOS)
- Nebulo (DoT, DoH) -- Android
- Unbound

### DNS-over-HTTPS

- Nebulo (DoT, DoH) -- Android
- Simple DNSCrypt (Windows)
- dnscrypt-proxy (macOS, Linux)
- DNSCloak (iOS)
- Intra (Android)
- Mozilla Firefox (v66 above)

Thanks to these great projects, Blahdns was born.
1. knot-resolver: Go
2. Dnsdist: Go
3. HAProxy: Go
4. dns-over-https: Go

DNS leak verification
1. DNSSEC validation: Go
2. Internet.nl: Go
3. DNSSEC resolver algorithm test: Go
4. Cloudflare tools: Go | Go
5. Check my DNS: Go
6. DNS randomness: Go
7. DNS Spoofability test: Go
8. DNSTrace: Go
9. Threats search: Go
10. Whoer.net Go
11. EDNS test Go
12. Cloudflare SNI Test Go .. You should have DNSSEC + TLS1.3 section in Green color.
13. DNS Check Go
Browser or Device privacy leaks test
1. Browserleaks: Go
2. Device leak: Go
3. Creepy JS: Go
4. Webbkoll: Go
5. Hardenize Report: Go
6. STARTTLS check: Go
7. SSL Test: Go
8. DKIM, SPF, SpamAssassin Email Validator Go

DNS over HTTPS (DoH)
DNS over HTTPS is a new protocol designed to encrypt and secure DNS traffic over HTTPS.
It prevents DNS hijacking and ISPs from sniffing your traffic.
You can use will Infra on Android Phone, Mozilla firefox nightly, Chrome coming soon.
DNSCrypt v2 client does support DoH, see dnscrypt configuration example on Windows, macOS, iOS (DNSCloak)

Encrypted DNS - DNS over TLS
DNS over TLS support is available on all our services through port 853 (standard port, some service may support 443).
DNS over TLS encrypts and authenticates all your DNS traffic to protect your privacy and prevent DNS hijacking and sniffing.
Client software: Stubby | Unbound
How to get SPKI
Be sure you already install package apt install gnutls-bin
`gnutls-cli --print-cert -p 853 45.32.55.94 | grep "pin-sha256" | head -1`
OR `kdig -d @45.32.55.94 +tls-ca +tls-host=dot-jp.blahdns.com blahdns.com`
TLS1.3 support check
`openssl s_client -connect 45.32.55.94:853`
Will return message: `New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 Server public key is 2048 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 0 (ok) --- --- Post-Handshake New Session Ticket arrived: SSL-Session: Protocol : TLSv1.3 Cipher : TLS_AES_256_GCM_SHA384` For troubleshooting go HERE

The Domain Name System (DNS) is the phonebook of the Internet. Humans access information online through domain names, like nytimes.com or espn.com. Web browsers interact through Internet Protocol (IP) addresses. DNS translates domain names to IP addresses so browsers can load Internet resources.

Each device connected to the Internet has a unique IP address which other machines use to find the device. DNS servers eliminate the need for humans to memorize IP addresses such as 192.168.1.1 (in IPv4), or more complex newer alphanumeric IP addresses such as 2400:cb00:2048:1::c629:d7a2 (in IPv6).

## FAQ

- How to fix Chrome on Android phone leaking DNS, check HERE
- Supported TLS v1.3, 1.2
- We drop ANY type.
- Why you building this porject? I started this project around 2016. During that time, with my private dns, I need an easy way to filter ads and tracker, so I rent a server and learn how to achive this.
- Why you dont like huge traffic? I'm still a student. and I run this service with my pocket money and spare time. Just as a hobby to learn somehting new. buying big server or Anti-DDOS service will cost lot.

- Testing Firefox DoH Without Cloudflare, pfblockerNG, DNS Filtering, and Site Blocking Discussion @ Lawrence Systems / PC Pickup
- Block Ads on Samsung Galaxy without third-party applications [No root required]
- Here is how to block Ads on Android Pie without root on the S8. NO APPS NEEDED! New option in Pie.
- Blocking ads without additional software in Android 9.0 Pie (finally :D)
- How to Block Ads using Private DNS (DNS over TLS) Feature on Android 9.0 Pie or later without root https://www.androidsage.com/2018/12/25/how-to-block-ads-using-private-dns-dns-over-tls-feature/

DNSSEC validation: https://dnssec.vs.uni-due.de

curl -H 'content-type: application/dns-message' -vL -v 'https://doh-jp.blahdns.com/dns-query?dns=AAABAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB' | hexdump -C

kdig google.com @2001:19f0:7001:1ded:5400:1ff:fe90:945b +tls -p 443

kdig google.com @45.32.55.94

https://gist.github.com/meanevo/e70ca58e361fb4d1a9d262a8f12b173a (HAProxy) https://stuff-things.net/2016/11/30/haproxy-sni/ https://pre-prod.chown.me/blog/running-dot-on-openbsd.html https://www.haproxy.com/blog/introduction-to-haproxy-acls/

Does Blahdns block CNAME Cloacking? Yes, click here to read more.

- Thanks for Adam Srxxx for 2 USD
- Thanks for Slawomir Mxxx for 5 USD
- Thanks for Giuseppe Macxxx for 5 USD
- Thanks for Austin Sarxxx for 25 USD
- Thanks for Jonni Rauhxxx for 25 USD
- Thanks for Regin Jaxxx for 50 EUR
- Thanks for Kristian NyXXXard JenXXXX for 5 USD and 10 EUR
- Thanks for Martin LohrXXXrg for 10 EUR
- Thanks for Ferdinand MuXXXch for 3 USD
- Thanks for MarsXXXn for 5 USD
- Thanks for Lawerence LeXXXng for 20 AUD
- Thanks for 優樹 XX下 for 3 USD
- Thanks for Ardi KaXXXin for 5 SGD
- Thanks for Kung JXXXe for 3 USD
- Thanks for Braian KapXXXan for 9 USD
- Thanks for Lorenzo OXXXi for 20 USD
- Thanks for Felix HungXXXberg for 3 USD
- Thanks for Marco GXXXze for 10 USD
- Thanks for mikXXXla for 10 EUR
- Thanks for Tim 331 for 20 TWD