Update blacklist.txt

Update Unbound conf

FAQ.md

@@ -82,7 +82,7 @@ openssl s_client -state -debug -msg -connect doh-jp.blahdns.com:443 -tls1_3
 ## DNSSEC validation test
 
 1. [https://www.dnssec.cz/](https://www.dnssec.cz/)
-2. [https://dnssec.vs.uni-due.de/](https://dnssec.vs.uni-due.de/)
+2. [https://wander.science/projects/dns/dnssec-resolver-test/](https://wander.science/projects/dns/dnssec-resolver-test/)
 
 Use `dig` to test, this will return with header `AD`
 

LICENSE

@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published
+    by the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.

README.md

@@ -6,16 +6,20 @@
 
 ## Announcements
 
+* Singapore server has been migrated to Contabo provider to serve more bandwidth.
+
+**We will discotinue Japan, Switzerland, Finland by Jul 15, 2024** | Thanks again for all supporters and users 🥰🙏
+
 * Beta support `alfis.name` tld. `.anon, .btn, .conf, .index, .merch, .mirror, .mob, .screen, .srv, .ygg`
 * For more old announcements, go [here](https://github.com/ookangzheng/blahdns/issues/36)
-* Temporary disable uncensored and CDN DoH, will spin another machine to handle those request
+
 
 ## Our features
 
 * Block Trackers, Ads, Malwares, Phishing
 * No ECS, DNSSEC ready, No logs, OpenNIC, Eth TLD, Yggdrasil 
 * Support http://matoken.eth/ | http://mesh.ygg/ | http://i2pd.ygg/ | http://blahdns.oss/ | https://i❤.ws/
-* BlahDNS status [Status Page](https://stats.blahdns.com) | [Dnsprivacy.org](https://dnsprivacy.org/jenkins/job/dnsprivacy-monitoring/)
+* BlahDNS status [Status Page](https://stats.blahdns.com) | [Dnsprivacy.org]([https://dnsprivacy.org/jenkins/job/dnsprivacy-monitoring/](https://monitor.dnsprivacy.org/jenkins/job/dnsprivacy-monitoring/))
 
 
 ## How to setup / config DoH DoT Dnscrypt 👇
@@ -25,16 +29,14 @@ Config: [HERE for more details](https://github.com/ookangzheng/blahdns/tree/mast
 ## Server architecture
 
 ```bash
-Server (Switzerland, Germany, Finland, Japan, Singapore)
+Server
 
 |-- Knot-resolver (DNS resolver, OpenNIC, ICANN, Alfis)
 |-- Dnsdist (cache)
-|   |   |-- DNSCryptv2 (encrypted-dns-server, port 8443)
-|   |   |-- Dnsproxy (DoQ, port 784)
-|   |-- DoH/http3 (port 443/udp)
-|   |-- doh-server (DoH, GET, POST -- m13253)
-|   |   |-- |-- DoH (HAProxy, port 443, TLS 1.3, require SNI)
-|-- DoT (HAProxy, port 853, TLS 1.3, require SNI)
+|   |   |-- DNSCryptv2 (encrypted-dns-server, port 8443 TCP/UDP)
+|   |   |-- DoQ, port 784
+|   |-- DoH/http3 (port 443/TCP/UDP port 443, tls version >= 1.2, require SNI)
+|-- DoT (HAProxy, port 853, tls version >=1.2, require SNI)
 
 ```
 

client-conf/README.md

@@ -27,32 +27,7 @@ policy.add(policy.all(policy.TLS_FORWARD({{'139.162.112.47@853', hostname='dot-j
 
 ## Unbound 
 
-```bash
-# /etc/unbound/unbound.conf
-
-    include: "/etc/unbound/unbound.conf.d/*.conf"
-    verbosity: 1
-    tls-cert-bundle: "/etc/ssl/certs/ca-certificates.crt"
-    interface: 127.0.0.1@53
-    interface: 0::1@53
-    harden-dnssec-stripped: no # disable DNSSEC
-    do-not-query-localhost: no
-
-forward-zone:
-  name: "."
-  forward-tls-upstream: yes
-  forward-addr: 95.216.212.177@443#dot-fi.blahdns.com
-  forward-addr: 2a01:4f9:c010:43ce::1@853#dot-fi.blahdns.com
-  forward-addr: 139.162.112.47@853#dot-jp.blahdns.com
-  forward-addr: 2001:19f0:7001:3259:5400:02ff:fe71:0bc9@443#dot-jp.blahdns.com
-  forward-addr: 78.46.244.143@853#dot-de.blahdns.com
-  forward-addr: 2a01:4f8:c17:ec67::1@853#dot-de.blahdns.com
-  forward-addr: 45.91.92.121@853#dot-ch.blahdns.com
-  forward-addr: 2a0e:dc0:6:23::2@853#dot-ch.blahdns.com
-  forward-addr: 192.53.175.149@853#dot-sg.blahdns.com
-  forward-addr: 2400:8901::f03c:92ff:fe27:870a@853#dot-sg.blahdns.com
-  
-```
+Go [HERE](https://github.com/zoonderkins/blahdns/blob/master/client-conf/unbound.conf)
 
 ## Stubby
 

client-conf/dnscrypt/dnscrypt-proxy.toml

@@ -1,10 +1,10 @@
-server_names = ['blahdns-jp-dnscrypt-v4']
+server_names = ['blahdns-de-dnscrypt-v4']
 listen_addresses = ['127.0.0.1:53', '[::1]:53']
 max_clients = 300
 force_tcp = false
 timeout = 2000
 keepalive = 30
-bootstrap_resolvers = ['1.1.1.2:53','8.8.8.8:53', '9.9.9.9:53']
+bootstrap_resolvers = ['8.8.8.8:53', '9.9.9.9:53']
 ignore_system_dns = true
 netprobe_timeout = 30
 cache = false
@@ -15,41 +15,9 @@ cache_neg_min_ttl = 10
 cache_neg_max_ttl = 300
 
 [static]
-# Singapore DoH
-[static.'blahdns-sg-doh']
-stamp = 'sdns://AgMAAAAAAAAADjE5Mi41My4xNzUuMTQ5ABJkb2gtc2cuYmxhaGRucy5jb20KL2Rucy1xdWVyeQ'
-[static.'blahdns-sg-doh-v6']
-stamp = 'sdns://AgMAAAAAAAAAIFsyNDAwOjg5MDE6OmYwM2M6OTJmZjpmZTI3Ojg3MGFdABJkb2gtc2cuYmxhaGRucy5jb20KL2Rucy1xdWVyeQ'
 
-# Singapore Dnscrypt
-[static.'blahdns-sg-dnscrypt-v4']
-stamp = 'sdns://AQMAAAAAAAAAEzE5Mi41My4xNzUuMTQ5Ojg0NDMghROpa8Tgg0uVDWO1AujT4tVNBJZrJgKTNOkHHboj_CsbMi5kbnNjcnlwdC1jZXJ0LmJsYWhkbnMuY29t'
-[static.'blahdns-sg-dnscrypt-v6']
-stamp = 'sdns://AQMAAAAAAAAAJVsyNDAwOjg5MDE6OmYwM2M6OTJmZjpmZTI3Ojg3MGFdOjg0NDMghROpa8Tgg0uVDWO1AujT4tVNBJZrJgKTNOkHHboj_CsbMi5kbnNjcnlwdC1jZXJ0LmJsYWhkbnMuY29t'
-
-# Finland DoH
-[static.'blahdns-fi-doh']
-stamp = 'sdns://AgMAAAAAAAAADjk1LjIxNi4yMTIuMTc3ABJkb2gtZmkuYmxhaGRucy5jb20KL2Rucy1xdWVyeQ'
-[static.'blahdns-fi-doh-v6']
-stamp = 'sdns://AgMAAAAAAAAAF1syYTAxOjRmOTpjMDEwOjQzY2U6OjFdABJkb2gtZmkuYmxhaGRucy5jb20KL2Rucy1xdWVyeQ'
-
-# Finland Dnscrypt
-[static.'blahdns-fi-dnscrypt-v4']
-stamp = 'sdns://AQMAAAAAAAAAEzk1LjIxNi4yMTIuMTc3Ojg0NDMghROpa8Tgg0uVDWO1AujT4tVNBJZrJgKTNOkHHboj_CsbMi5kbnNjcnlwdC1jZXJ0LmJsYWhkbnMuY29t'
-[static.'blahdns-fi-dnscrypt-v6']
-stamp = 'sdns://AQMAAAAAAAAAHFsyYTAxOjRmOTpjMDEwOjQzY2U6OjFdOjg0NDMghROpa8Tgg0uVDWO1AujT4tVNBJZrJgKTNOkHHboj_CsbMi5kbnNjcnlwdC1jZXJ0LmJsYWhkbnMuY29t'
-
-# Japan DoH
-[static.'blahdns-jp-doh']
-stamp = 'sdns://AgMAAAAAAAAADjEzOS4xNjIuMTEyLjQ3ABJkb2gtanAuYmxhaGRucy5jb20KL2Rucy1xdWVyeQ'
-[static.'blahdns-jp-doh-v6']
-stamp = 'sdns://AgMAAAAAAAAAIFsyNDAwOjg5MDI6OmYwM2M6OTJmZjpmZTI3OjM0NGJdABJkb2gtanAuYmxhaGRucy5jb20KL2Rucy1xdWVyeQ'
-
-# Japan Dnscrypt
-[static.'blahdns-jp-dnscrypt-v4']
-stamp = 'sdns://AQMAAAAAAAAAEzEzOS4xNjIuMTEyLjQ3Ojg0NDMghROpa8Tgg0uVDWO1AujT4tVNBJZrJgKTNOkHHboj_CsbMi5kbnNjcnlwdC1jZXJ0LmJsYWhkbnMuY29t'
-[static.'blahdns-jp-dnscrypt-v6']
-stamp = 'sdns://AQMAAAAAAAAAJVsyNDAwOjg5MDI6OmYwM2M6OTJmZjpmZTI3OjM0NGJdOjg0NDMghROpa8Tgg0uVDWO1AujT4tVNBJZrJgKTNOkHHboj_CsbMi5kbnNjcnlwdC1jZXJ0LmJsYWhkbnMuY29t'
+# Provider public key: 7b8bf43c61a5207cecf803627e2497d327557585837a85b87e8700e8d989ad87
+# Provider name: 2.dnscrypt-cert.blahdns.com
 
 # Gearmany DoH
 [static.'blahdns-de-doh']
@@ -63,14 +31,15 @@ stamp = 'sdns://AQMAAAAAAAAAEjc4LjQ2LjI0NC4xNDM6ODQ0MyCFE6lrxOCDS5UNY7UC6NPi1U0E
 [static.'blahdns-de-dnscrypt-v6']
 stamp = 'sdns://AQMAAAAAAAAAG1syYTAxOjRmODpjMTc6ZWM2Nzo6MV06ODQ0MyCFE6lrxOCDS5UNY7UC6NPi1U0ElmsmApM06QcduiP8KxsyLmRuc2NyeXB0LWNlcnQuYmxhaGRucy5jb20'
 
-# Switzerland DoH
-[static.'blahdns-ch-doh']
-stamp = 'sdns://AgMAAAAAAAAAEDQ1LjkxLjkyLjEyMTo0NDMAEmRvaC1jaC5ibGFoZG5zLmNvbQovZG5zLXF1ZXJ5'
-[static.'blahdns-ch-doh-v6']
-stamp = 'sdns://AgMAAAAAAAAAFlsyYTBlOmRjMDo2OjIzOjoyXTo0NDMAEmRvaC1jaC5ibGFoZG5zLmNvbQovZG5zLXF1ZXJ5'
 
-# Switzerland Dnscrypt
-[static.'blahdns-ch-dnscrypt-v4']
-stamp = 'sdns://AQMAAAAAAAAAETQ1LjkxLjkyLjEyMTo4NDQzIIUTqWvE4INLlQ1jtQLo0-LVTQSWayYCkzTpBx26I_wrGzIuZG5zY3J5cHQtY2VydC5ibGFoZG5zLmNvbQ'
-[static.'blahdns-ch-dnscrypt-v6']
-stamp = 'sdns://AQMAAAAAAAAAF1syYTBlOmRjMDo2OjIzOjoyXTo4NDQzIIUTqWvE4INLlQ1jtQLo0-LVTQSWayYCkzTpBx26I_wrGzIuZG5zY3J5cHQtY2VydC5ibGFoZG5zLmNvbQ'
+# Singapore DoH
+[static.'blahdns-sg-doh']
+stamp = 'sdns://AgMAAAAAAAAADjQ2LjI1MC4yMjYuMjQyABJkb2gtc2cuYmxhaGRucy5jb20KL2Rucy1xdWVyeQ'
+[static.'blahdns-sg-doh-v6']
+stamp = 'sdns://AgMAAAAAAAAAGFsyNDA3OjM2NDA6MjIwNToxNjY4OjoxXQASZG9oLXNnLmJsYWhkbnMuY29tCi9kbnMtcXVlcnk'
+
+# Singapore Dnscrypt
+[static.'blahdns-sg-dnscrypt-v4']
+stamp = 'sdns://AQMAAAAAAAAAEzQ2LjI1MC4yMjYuMjQyOjg0NDMge4v0PGGlIHzs-ANifiSX0ydVdYWDeoW4focA6NmJrYcbMi5kbnNjcnlwdC1jZXJ0LmJsYWhkbnMuY29t'
+[static.'blahdns-sg-dnscrypt-v6']
+stamp = 'sdns://AQMAAAAAAAAAHVsyNDA3OjM2NDA6MjIwNToxNjY4OjoxXTo4NDQzIHuL9DxhpSB87PgDYn4kl9MnVXWFg3qFuH6HAOjZia2HGzIuZG5zY3J5cHQtY2VydC5ibGFoZG5zLmNvbQ'

client-conf/stubby/stubby.yml

@@ -13,33 +13,8 @@ listen_addresses:
   - 0::1@5353
 
 upstream_recursive_servers:
-  # BlahDNS servers both with `tls_port: 853` and `tls_port: 443`
-  - address_data: 139.180.141.57
-    tls_auth_name: "dot-sg.blahdns.com"
-    
-  - address_data: 45.32.55.94
-    tls_auth_name: "dot-jp.blahdns.com"
-
   - address_data: 78.46.244.143
     tls_auth_name: "dot-de.blahdns.com"
     
-  - address_data: 95.216.212.177
-    tls_auth_name: "dot-fi.blahdns.com"
-    
-  - address_data: 45.91.92.121
-    tls_auth_name: "dot-ch.blahdns.com"
-        
-  - address_data: 2001:19f0:4400:6bed:5400:2ff:feb1:f9fa
-    tls_auth_name: "dot-sg.blahdns.com"
-    
-  - address_data: 2001:19f0:7001:3259:5400:02ff:fe71:0bc9
-    tls_auth_name: "dot-jp.blahdns.com"
-
   - address_data: 2a01:4f8:c17:ec67::1
     tls_auth_name: "dot-de.blahdns.com"
-    
-  - address_data: 2a01:4f9:c010:43ce::1
-    tls_auth_name: "dot-fi.blahdns.com"
-    
-  - address_data: 2a0e:dc0:6:23::2
-    tls_auth_name: "dot-ch.blahdns.com"

client-conf/unbound.conf

@@ -0,0 +1,336 @@
+server:
+    ###########################################################################
+    # BASIC SETTINGS
+    ###########################################################################
+    # Time to live maximum for RRsets and messages in the cache. If the maximum
+    # kicks in, responses to clients still get decrementing TTLs based on the
+    # original (larger) values. When the internal TTL expires, the cache item
+    # has expired. Can be set lower to force the resolver to query for data
+    # often, and not trust (very large) TTL values.
+    cache-max-ttl: 86400
+
+    # Time to live minimum for RRsets and messages in the cache. If the minimum
+    # kicks in, the data is cached for longer than the domain owner intended,
+    # and thus less queries are made to look up the data. Zero makes sure the
+    # data in the cache is as the domain owner intended, higher values,
+    # especially more than an hour or so, can lead to trouble as the data in
+    # the cache does not match up with the actual data any more.
+    cache-min-ttl: 300
+
+    # Set the working directory for the program.
+    directory: "/opt/unbound/etc/unbound"
+
+    # RFC 6891. Number of bytes size to advertise as the EDNS reassembly buffer
+    # size. This is the value put into datagrams over UDP towards peers.
+    # 4096 is RFC recommended. 1472 has a reasonable chance to fit within a
+    # single Ethernet frame, thus lessing the chance of fragmentation
+    # reassembly problems (usually seen as timeouts). Setting to 512 bypasses
+    # even the most stringent path MTU problems, but is not recommended since
+    # the amount of TCP fallback generated is excessive.
+    edns-buffer-size: 1472
+
+    # Listen to for queries from clients and answer from this network interface
+    # and port.
+    interface: 0.0.0.0@53
+
+    # Rotates RRSet order in response (the pseudo-random number is taken from
+    # the query ID, for speed and thread safety).
+    rrset-roundrobin: yes
+
+    # Drop user  privileges after  binding the port.
+    username: "_unbound"
+
+    ###########################################################################
+    # LOGGING
+    ###########################################################################
+
+    # Do not print log lines to inform about local zone actions
+    log-local-actions: no
+
+    # Do not print one line per query to the log
+    log-queries: no
+
+    # Do not print one line per reply to the log
+    log-replies: no
+
+    # Do not print log lines that say why queries return SERVFAIL to clients
+    log-servfail: no
+
+    # Further limit logging
+    logfile: /dev/null
+
+    # Only log errors
+    verbosity: 0
+
+    ###########################################################################
+    # PRIVACY SETTINGS
+    ###########################################################################
+
+    # RFC 8198. Use the DNSSEC NSEC chain to synthesize NXDO-MAIN and other
+    # denials, using information from previous NXDO-MAINs answers. In other
+    # words, use cached NSEC records to generate negative answers within a
+    # range and positive answers from wildcards. This increases performance,
+    # decreases latency and resource utilization on both authoritative and
+    # recursive servers, and increases privacy. Also, it may help increase
+    # resilience to certain DoS attacks in some circumstances.
+    aggressive-nsec: yes
+
+    # Extra delay for timeouted UDP ports before they are closed, in msec.
+    # This prevents very delayed answer packets from the upstream (recursive)
+    # servers from bouncing against closed ports and setting off all sort of
+    # close-port counters, with eg. 1500 msec. When timeouts happen you need
+    # extra sockets, it checks the ID and remote IP of packets, and unwanted
+    # packets are added to the unwanted packet counter.
+    delay-close: 10000
+
+    # Prevent the unbound server from forking into the background as a daemon
+    do-daemonize: no
+
+    # Add localhost to the do-not-query-address list.
+    do-not-query-localhost: no
+
+    # Number  of  bytes size of the aggressive negative cache.
+    neg-cache-size: 4M
+
+    # Send minimum amount of information to upstream servers to enhance
+    # privacy (best privacy).
+    qname-minimisation: yes
+
+    ###########################################################################
+    # SECURITY SETTINGS
+    ###########################################################################
+    # Only give access to recursion clients from LAN IPs
+    access-control: 127.0.0.1/32 allow
+    access-control: 192.168.0.0/16 allow
+    access-control: 172.16.0.0/12 allow
+    access-control: 10.0.0.0/8 allow
+    # access-control: fc00::/7 allow
+    # access-control: ::1/128 allow
+
+    # File with trust anchor for  one  zone, which is tracked with RFC5011
+    # probes.
+    auto-trust-anchor-file: "var/root.key"
+
+    # Enable chroot (i.e, change apparent root directory for the current
+    # running process and its children)
+    chroot: "/opt/unbound/etc/unbound"
+
+    # Harden against algorithm downgrade when multiple algorithms are
+    # advertised in the DS record.
+    harden-algo-downgrade: yes
+
+    # RFC 8020. returns nxdomain to queries for a name below another name that
+    # is already known to be nxdomain.
+    harden-below-nxdomain: yes
+
+    # Require DNSSEC data for trust-anchored zones, if such data is absent, the
+    # zone becomes bogus. If turned off you run the risk of a downgrade attack
+    # that disables security for a zone.
+    harden-dnssec-stripped: yes
+
+    # Only trust glue if it is within the servers authority.
+    harden-glue: yes
+
+    # Ignore very large queries.
+    harden-large-queries: yes
+
+    # Perform additional queries for infrastructure data to harden the referral
+    # path. Validates the replies if trust anchors are configured and the zones
+    # are signed. This enforces DNSSEC validation on nameserver NS sets and the
+    # nameserver addresses that are encountered on the referral path to the 
+    # answer. Experimental option.
+    harden-referral-path: no
+
+    # Ignore very small EDNS buffer sizes from queries.
+    harden-short-bufsize: yes
+
+    # Refuse id.server and hostname.bind queries
+    hide-identity: yes
+
+    # Refuse version.server and version.bind queries
+    hide-version: yes
+
+    # Report this identity rather than the hostname of the server.
+    identity: "DNS"
+
+    # These private network addresses are not allowed to be returned for public
+    # internet names. Any  occurrence of such addresses are removed from DNS
+    # answers. Additionally, the DNSSEC validator may mark the  answers  bogus.
+    # This  protects  against DNS  Rebinding
+    private-address: 10.0.0.0/8
+    private-address: 172.16.0.0/12
+    private-address: 192.168.0.0/16
+    private-address: 169.254.0.0/16
+    # private-address: fd00::/8
+    # private-address: fe80::/10
+    # private-address: ::ffff:0:0/96
+
+    # Enable ratelimiting of queries (per second) sent to nameserver for
+    # performing recursion. More queries are turned away with an error
+    # (servfail). This stops recursive floods (e.g., random query names), but
+    # not spoofed reflection floods. Cached responses are not rate limited by
+    # this setting. Experimental option.
+    ratelimit: 1000
+
+    # Use this certificate bundle for authenticating connections made to
+    # outside peers (e.g., auth-zone urls, DNS over TLS connections).
+    tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
+
+    # Set the total number of unwanted replies to eep track of in every thread.
+    # When it reaches the threshold, a defensive action of clearing the rrset
+    # and message caches is taken, hopefully flushing away any poison.
+    # Unbound suggests a value of 10 million.
+    unwanted-reply-threshold: 10000
+
+    # Use 0x20-encoded random bits in the query to foil spoof attempts. This
+    # perturbs the lowercase and uppercase of query names sent to authority
+    # servers and checks if the reply still has the correct casing.
+    # This feature is an experimental implementation of draft dns-0x20.
+    # Experimental option.
+    use-caps-for-id: yes
+
+    # Help protect users that rely on this validator for authentication from
+    # potentially bad data in the additional section. Instruct the validator to
+    # remove data from the additional section of secure messages that are not
+    # signed properly. Messages that are insecure, bogus, indeterminate or
+    # unchecked are not affected.
+    val-clean-additional: yes
+
+    ###########################################################################
+    # PERFORMANCE SETTINGS
+    ###########################################################################
+    # https://nlnetlabs.nl/documentation/unbound/howto-optimise/
+    # # https://nlnetlabs.nl/news/2019/Feb/05/unbound-1.9.0-released/
+
+    # Number of slabs in the infrastructure cache. Slabs reduce lock contention
+    # by threads. Must be set to a power of 2.
+    infra-cache-slabs: 2
+
+    # Number of incoming TCP buffers to allocate per thread. Default
+    # is 10. If set to 0, or if do-tcp is "no", no  TCP  queries  from
+    # clients  are  accepted. For larger installations increasing this
+    # value is a good idea.
+	incoming-num-tcp: 10
+
+    # Number of slabs in the key cache. Slabs reduce lock contention by
+    # threads. Must be set to a power of 2. Setting (close) to the number
+    # of cpus is a reasonable guess.
+    key-cache-slabs: 2
+
+    # Number  of  bytes  size  of  the  message  cache.
+    # Unbound recommendation is to Use roughly twice as much rrset cache memory
+    # as you use msg cache memory.
+    msg-cache-size: 119173802
+
+    # Number of slabs in the message cache. Slabs reduce lock contention by
+    # threads. Must be set to a power of 2. Setting (close) to the number of
+    # cpus is a reasonable guess.
+    msg-cache-slabs: 2
+
+    # The number of queries that every thread will service simultaneously. If
+    # more queries arrive that need servicing, and no queries can be jostled
+    # out (see jostle-timeout), then the queries are dropped.
+    # This is best set at half the number of the outgoing-range.
+    # This Unbound instance was compiled with libevent so it can efficiently
+    # use more than 1024 file descriptors.
+    num-queries-per-thread: 4096
+
+    # The number of threads to create to serve clients.
+    # This is set dynamically at run time to effectively use available CPUs
+    # resources
+    num-threads: 1
+
+    # Number of ports to open. This number of file descriptors can be opened
+    # per thread.
+    # This Unbound instance was compiled with libevent so it can efficiently
+    # use more than 1024 file descriptors.
+    outgoing-range: 8192
+
+    # Number of bytes size of the RRset cache.
+    # Use roughly twice as much rrset cache memory as msg cache memory
+    rrset-cache-size: 238347605
+
+    # Number of slabs in the RRset cache. Slabs reduce lock contention by
+    # threads. Must be set to a power of 2.
+    rrset-cache-slabs: 2
+
+    # Do no insert authority/additional sections into response messages when
+    # those sections are not required. This reduces response size
+    # significantly, and may avoid TCP fallback for some responses. This may
+    # cause a slight speedup.
+    minimal-responses: yes
+
+    # # Fetch the DNSKEYs earlier in the validation process, when a DS record
+    # is encountered. This lowers the latency of requests at the expense of
+    # little more CPU usage.
+    prefetch: yes
+
+    # Fetch the DNSKEYs earlier in the validation process, when a DS record is
+    # encountered. This lowers the latency of requests at the expense of little
+    # more CPU usage.
+    prefetch-key: yes
+
+    # Have unbound attempt to serve old responses from cache with a TTL of 0 in
+    # the response without waiting for the actual resolution to finish. The
+    # actual resolution answer ends up in the cache later on.
+    serve-expired: yes
+
+    # Open dedicated listening sockets for incoming queries for each thread and
+    # try to set the SO_REUSEPORT socket option on each socket. May distribute
+    # incoming queries to threads more evenly.
+    so-reuseport: yes
+
+    ###########################################################################
+    # LOCAL ZONE
+    ###########################################################################
+
+    # Include file for local-data and local-data-ptr
+    include: /opt/unbound/etc/unbound/a-records.conf
+
+    ###########################################################################
+    # FORWARD ZONE
+    ###########################################################################
+    forward-zone:
+        # Forward all queries (except those in cache and local zone) to
+        # upstream recursive servers
+        name: "."
+        # Queries to this forward zone use TLS
+        forward-tls-upstream: yes
+
+        # https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers
+
+        forward-addr: 95.216.212.177@443#dot-fi.blahdns.com
+        forward-addr: 2a01:4f9:c010:43ce::1@853#dot-fi.blahdns.com
+
+        forward-addr: 212.52.0.233@853#dot-jp.blahdns.com
+        forward-addr: 2406:ef80:4:1537::1@853#dot-jp.blahdns.com
+
+        forward-addr: 78.46.244.143@853#dot-de.blahdns.com
+        forward-addr: 2a01:4f8:c17:ec67::1@853#dot-de.blahdns.com
+
+        forward-addr: 45.91.92.121@853#dot-ch.blahdns.com
+        forward-addr: 2a0e:dc0:6:23::2@853#dot-ch.blahdns.com
+
+        forward-addr: 103.167.150.45@853#dot-sg.blahdns.com
+        forward-addr: 2406:ef80:2:5ee4::1@853#dot-sg.blahdns.com
+
+        # Cloudflare
+        #forward-addr: 1.1.1.1@853#cloudflare-dns.com
+        #forward-addr: 1.0.0.1@853#cloudflare-dns.com
+        #forward-addr: 2606:4700:4700::1111@853#cloudflare-dns.com
+        #forward-addr: 2606:4700:4700::1001@853#cloudflare-dns.com
+
+        # CleanBrowsing
+        #forward-addr: 185.228.168.9@853#security-filter-dns.cleanbrowsing.org
+        #forward-addr: 185.228.169.9@853#security-filter-dns.cleanbrowsing.org
+        # forward-addr: 2a0d:2a00:1::2@853#security-filter-dns.cleanbrowsing.org
+        # forward-addr: 2a0d:2a00:2::2@853#security-filter-dns.cleanbrowsing.org
+
+        # Quad9
+        # forward-addr: 9.9.9.9@853#dns.quad9.net
+        # forward-addr: 149.112.112.112@853#dns.quad9.net
+        # forward-addr: 2620:fe::fe@853#dns.quad9.net
+        # forward-addr: 2620:fe::9@853#dns.quad9.net
+
+remote-control:
+    control-enable: no

hosts/README.md

@@ -6,7 +6,11 @@
 
 ## Block list (may different from BlahDNS)
 
-* [DonaminName](https://oooo.b-cdn.net/blahdns/blahdns_domains.txt) `DNSCrypt`
+* [hosts](https://oooo.b-cdn.net/blahdns/blahdns_hosts.txt)
+  
+* [Adguard Home](https://oooo.b-cdn.net/blahdns/blahdns_adguardhome.txt)
+
+* [DomainName](https://oooo.b-cdn.net/blahdns/blahdns_domains.txt) `DNSCrypt`
 
 * [RPZ](https://oooo.b-cdn.net/blahdns/blahdns_rpz.txt) `Knot-resolver, Bind9, PowerDNS`
 
@@ -14,17 +18,11 @@
 
 * [DNSmasq](https://oooo.b-cdn.net/blahdns/blahdns_dnsmasq.conf)
 
-* [Adguard Home](https://oooo.b-cdn.net/blahdns/blahdns_unbound.conf)
+* [lite host w Ipv4](https://oooo.b-cdn.net/blahdns/lite_host.txt)
 
-* [SmartDNS](https://oooo.b-cdn.net/blahdns/blahdns_smartdns.conf)
+* [lite adblocker](https://oooo.b-cdn.net/blahdns/lite_adblocker.txt)
 
-* [Surge](https://oooo.b-cdn.net/blahdns/blahdns_surge.txt)
-
-* [BlahDNS host w Ipv4/v6](https://oooo.b-cdn.net/blahdns/blahdns_adguardhome.txt)
-
-* [lite host w Ipv4](https://oooo.b-cdn.net/blahdns/lite_host.txt) `~ 5.5MB, Mobile friendly`
-
-* [lite adblocker](https://oooo.b-cdn.net/blahdns/lite_adblocker.txt) `~ 5MB Adguard, uBlock`
+* [lite domain](https://oooo.b-cdn.net/blahdns/lite_domain.txt) 
 
 * Mobile Adblock clients: [Adhell](https://play.google.com/store/apps/details?id=com.getadhell.androidapp&hl=en_US) | [Blokada](https://github.com/blokadaorg/blokada) | [DNSCloak(ios)](https://apps.apple.com/us/app/dnscloak-secure-dns-client/id1452162351) | [DNS66](https://github.com/julian-klode/dns66) | [pDNSf](https://zenz-solutions.de/personaldnsfilter) | [Nebulo](https://github.com/Ch4t4r/Nebulo) | [RethinkDNS + Firewall](https://github.com/celzero/rethink-app)
 

hosts/blacklist.txt

@@ -1,6 +1,190 @@
 ## This blacklist maintaince by @ookangzheng
 ## Attribution-NonCommercial 4.0 International (CC BY-NC-SA 4.0)
 
+mu-pl.lemnisk.co
+api.cooladata.com
+li.protechts.net
+
+ap-northeast-1.prod.pr.analytics.console.aws.a2z.com
+us-east-1.prod.pr.analytics.console.aws.a2z.com
+us-east-2.prod.pr.analytics.console.aws.a2z.com
+us-west-1.prod.pr.analytics.console.aws.a2z.com
+us-west-2.prod.pr.analytics.console.aws.a2z.com
+eu-west-1.prod.pr.analytics.console.aws.a2z.com
+us-west-2.prod.pr.analytics.console.aws.a2z.com
+telemetry.cell-0.us-east-1.prod.tangerinebox.console.aws.a2z.com
+telemetry.cell-0.ap-northeast-1.prod.tangerinebox.console.aws.a2z.com
+prod.tools.shortbread.analytics.console.aws.a2z.com
+prod.log.shortbread.analytics.console.aws.a2z.com
+analytics.console.aws.a2z.com
+
+# sdk-toutiao.com
+pangolin-sdk-toutiao.com
+api-access.pangolin-sdk-toutiao.com
+
+# Appsflyer
+inapps.appsflyer-cn.com
+
+# localstack
+analytics.production.aws.localstack.cloud
+
+# Smartmail
+usage.readdle.com
+stats.gcp.smartmailcloud.com
+
+# tianxing.com
+tianxing.com
+open.tianxing.com
+conf.open.tianxing.com
+
+# Irent taiwan
+matomo.ai-rent.net
+analytics-alv.google.com
+ssregisterserverprod.azurewebsites.net
+himsbg.servicebus.windows.net
+www.googletagmanager.com
+app.adjust.net.in
+adjust.net.in
+cfg.flurry.com
+data.flurry.com
+
+# Android Multiple accounts
+alt1-mtalk.google.com
+
+# ente.io
+sentry-reporter.ente.io
+sentry.ente.io
+
+# 4ddig.tenorshare.com
+analytics.afirstsoft.cn
+afirstsoft.cn
+
+# Phishing
+onlineservicetec.com
+www.onlineservicetec.com
+
+# set-app
+stats.setapp.com
+o36975.ingest.sentry.io
+www.downiestatistics.com
+software.charliemonroe.net
+
+# Autoking Navigator ios, android
+ad.localking.com.tw
+
+# akaquill.net
+v1.akaquill.net
+
+# torrentmac popup
+drctcldfa.com
+affelseaeinera.org
+my-entertainments.com
+num1search.xyz
+celebsporntube.xyz
+a-data.xyz
+crypto-currency-converter.com
+getsmartyapp.com
+www.getsmartyapp.com
+
+# optimizely.com
+logx.optimizely.com
+
+# Line iOS 
+# Block dancing or unhealthy video  (Line Voom)
+# Block Ads inside Line Today, also break picture (thumbnail)
+# Feedback needed (Android Too)
+
+voom-obs.line-scdn.net
+today-obs.line-scdn.net
+ad.line-scdn.net
+sentry-uit.line-apps.com
+ly.my.sentry.io
+# legy.line-apps.com
+# legy-backup.line-apps.com
+d.line-scdn.net
+ios.rqd.qq.com
+sentry.line.dev
+sentry-tw.line-apps.com
+maac.io
+lss-oal.line-scdn.net
+adservice.google.com
+liffsdk.verda.akadns.net
+vos.line-scdn.net
+cix.line-apps.com
+torimochi.line-apps.com
+sentry-uit.line-apps.com
+e14293.a.akamaiedge.net
+
+# Third-party Line api 漸強實驗室Crescendo Lab
+cresclab.com
+
+# Taiwan Covid Scam
+www.gsmgov.com
+gsmgov.com
+twpytr.com
+www.ijnb.cn
+ijnb.cn
+
+# Camscanner App iOS
+dsp-material.brainx.tech
+brainx-dsp-sg.tec-do.cn
+tec-do.cn
+adx-event-server.tec-do.cn
+click.tracksummer.com
+d.applovin.com
+csbase-web-offline-pkg.camscanner.com.653a71ef.cdnhwcjkl10.cn
+sf16-static.i18n-pglstatp.com
+appsflyer-cn.edgekey.net
+appsflyer-cn.edgekey.net.globalredir.akadns.net
+e13624.dscb.akamaiedge.net
+gw-outra-4c6f2c7b36ade8b8.elb.cn-northwest-1.amazonaws.com.cn
+tnc16-alisg.isnssdk.com
+cdn-settings.appsflyer-cn.com
+d1w4qo6covcdtw.cloudfront.net
+inapps.appsflyer-cn.com
+sf3-fe-tos.pglstatp-toutiao.com
+skadsdk.appsflyer-cn.com
+firebase-settings.crashlytics.com
+
+# UnityAd
+ws.tapjoyads.com
+configv2.unityads.unity3d.com
+init.supersonicads.com
+teleport.soom.la
+networksdk.ssacdn.com
+api.vungle.com
+int.akisinn.site
+connect.tapjoy.com
+pm-gateway.supersonicads.com
+publisher-config.unityads.unity3d.com
+events.mz.unity3d.com
+auction-load.unityads.unity3d.com
+nginx-auction7-prd.unityads.unity3d.com
+auiopt.unityads.unity3d.com
+cdn2.inner-active.mobi
+cdn-creatives-akamaistls-prd.acquire.unity3dusercontent.com
+
+# Wondershare
+www.98w.com
+98w.com
+www.pcwatch.com
+eus-recoverit-data-collect.oss-us-west-1.aliyuncs.com
+api.300624.com
+analytics.wondershare.cc
+www.bugsplatsoftware.com
+
+# Shopback
+mobileapi.usebutton.com
+usebutton.com
+
+# Instagram
+graph.instagram.com
+geo.instagram.com
+
+# boosters.company
+api.panda.boosters.company
+
+# Baidu
 dusee.baidu.com
 
 # Apecoin
@@ -39,7 +223,16 @@ gozendata.com
 gz-data.com
 service.gz-data.com
 
-# Line Messenger Android 
+# Line Messenger iOS/Android
+icp-logs.line.me
+relay-sentry-fp.line-apps.com
+sentry-uit.line-apps.com
+sentry-tw.line-apps.com
+# legy-jp-addr.line.naver.jp
+# gw.line.naver.jp # will break line pay, line points
+# nelo2-col.linecorp.com # break line message loading
+crs-event.line.me
+ingress-public.brown.line-apps.com
 torimochi.line-apps.com
 uts-front.line-apps.com
 
@@ -116,8 +309,8 @@ self-repair.mozilla.org # https://spyware.neocities.org/articles/firefox.html
 ## Apple 
 #ocsp.apple.com # Apple being evil, phone home, https://blog.jacopo.io/en/post/apple-ocsp/ & https://www.reddit.com/r/pihole/comments/jt3wyq/pihole_saves_the_day_ocspapplecom_outage/
 #ocsp2.apple.com
-#ocsp2.g.applimg.com
-#ocsp.g.applimg.com
+ocsp2.g.applimg.com
+ocsp.g.applimg.com
 #cu-cn-north00002.gala.convection.cn # https://github.com/StevenBlack/hosts/pull/1643#issuecomment-962885895
 #cu-cn-north00001.gala.convection.cn # https://github.com/StevenBlack/hosts/pull/1643#issuecomment-962885895
 
@@ -249,12 +442,17 @@ static.youappi.com
 # CERT Vulnerability (#598349)
 wpad.example.com 
 
+# QQ.com
+tpstelemetry.tencent.com
+access.toggle.qq.com
+event.toggle.qq.com
+log.tbs.qq.com
+
 # Chinese tracker
 discuz.gtimg.cn
 hao.360.cn
 ip.ia22.com
 log.sina.cn
-log.tbs.qq.com
 main.exoclick.com
 mathtype.cn
 sa.tuisong.baidu.com
@@ -322,15 +520,10 @@ ichnaea.netflix.com
 mss.handmark.com
 scribe.logs.roku.com
 cooper.logs.roku.com
-e.reddit.com
 mobile.pipe.aria.microsoft.com
 cdn.samsungcloudsolution.com
 mobile-collector.newrelic.com
 log-ingestion.samsungacr.com
-graph.instagram.com
-ssl.google-analytics.com
-video-stats.l.google.com
-# cdn-content.ampproject.org
 googleads.g.doubleclick.net
 www.googleadservices.com
 nexus.officeapps.live.com
@@ -373,10 +566,8 @@ sb.scorecardresearch.com
 ads.exdynsrv.com
 bj1110.online
 wpad.example.com
-2ip.ru
 syndication.twitter.com
 sp2.baidu.com
-# staticxx.facebook.com
 
 # Akamai DNS tools
 # https://developer.akamai.com/blog/2018/05/10/introducing-new-whoami-tool-dns-resolver-information
@@ -408,7 +599,6 @@ usage.trackjs.com
 trackjs.com
 hcs084epsepa004.som.ad.state.mi.us
 a9v8.cn
-c.y.qq.com
 play.aniview.com
 ads.stickyadstv.com
 algovid.com

hosts/source.txt

@@ -1,11 +1,3 @@
-
-https://gitlab.com/quidsup/notrack-blocklists/raw/master/notrack-malware.txt
-https://gitlab.com/quidsup/notrack-blocklists/raw/master/notrack-blocklist.txt
-https://gitlab.com/ZeroDot1/CoinBlockerLists/raw/master/list_browser.txt
-https://curben.gitlab.io/malware-filter/urlhaus-filter-hosts-online.txt
-
-https://gist.githubusercontent.com/dieechtenilente/ad3fc9bacc205876b2e29dcb9043c8bc/raw/946b18ef170fa028067d8a3f135fe6c06ec30fa6/pihole.list
-https://raw.githubusercontent.com/o0HalfLife0o/list/master/ad.txt
 https://raw.githubusercontent.com/VeleSila/yhosts/master/hosts
 https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/spy.txt
 https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/android-tracking.txt
@@ -13,13 +5,11 @@ https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/SmartTV.txt
 https://raw.githubusercontent.com/anudeepND/blacklist/master/adservers.txt
 https://raw.githubusercontent.com/Yhonay/antipopads/master/hosts
 https://raw.githubusercontent.com/cchevy/macedonian-pi-hole-blocklist/master/hosts.txt
-https://raw.githubusercontent.com/privacy-protection-tools/anti-AD/master/anti-ad-domains.txt
 https://raw.githubusercontent.com/scafroglia93/blocklists/master/blocklists-main.txt
 https://raw.githubusercontent.com/cchevy/macedonian-pi-hole-blocklist/master/hosts.txt
 https://raw.githubusercontent.com/hoshsadiq/adblock-nocoin-list/master/hosts.txt
 https://raw.githubusercontent.com/ilpl/ad-hosts/master/hosts
 https://raw.githubusercontent.com/jdlingyu/ad-wars/master/hosts
-https://raw.githubusercontent.com/notracking/hosts-blocklists/master/adblock/adblock.txt
 https://raw.githubusercontent.com/hoshsadiq/adblock-nocoin-list/master/hosts.txt
 https://raw.githubusercontent.com/ilpl/ad-hosts/master/hosts
 https://raw.githubusercontent.com/joeylane/hosts/master/hosts
@@ -27,15 +17,13 @@ https://raw.githubusercontent.com/jerryn70/GoodbyeAds/master/Hosts/GoodbyeAds.tx
 https://raw.githubusercontent.com/jerryn70/GoodbyeAds/master/Extension/GoodbyeAds-LeEco-Extension.txt
 https://raw.githubusercontent.com/jerryn70/GoodbyeAds/master/Extension/GoodbyeAds-Spotify-AdBlock.txt
 https://raw.githubusercontent.com/r-a-y/mobile-hosts/master/AdguardMobileSpyware.txt
+https://raw.githubusercontent.com/Cats-Team/AdRules/main/hosts.txt
 
 https://hostfiles.frogeye.fr/multiparty-only-trackers.txt
 https://badmojr.github.io/1Hosts/Lite/adblock.txt
-
-https://orca.pet/notonmyshift/domains.txt
 https://rescure.fruxlabs.com/rescure_domain_blacklist.txt
-https://phishing.army/download/phishing_army_blocklist_extended.txt
 http://npc.0am.jp/hosts.php?dl=1
-https://abp.oisd.nl/basic
+https://abp.oisd.nl
 https://gitee.com/bigdataleaveme/dontcollectme/raw/master/dontcollectme.txt
 https://warui.intaa.net/adhosts/hosts.txt
 https://raw.githubusercontent.com/stamparm/blackbook/master/blackbook.txt

hosts/whitelist.txt

@@ -1,6 +1,68 @@
 ## This whitelist maintaince by @ookangzheng
 ## Attribution-NonCommercial 4.0 International (CC BY-NC-SA 4.0)
 
+# Metro Taipei
+api.metro.taipei
+ws.metro.taipei
+
+# Slack
+slackb.com
+
+# Line
+# Report ads website not loading
+liffsdk.line-scdn.net
+# Line chat official account bottom message select form content
+obs.line-scdn.net
+
+# 90min.com
+images2.minutemediacdn.com
+assets.minutemediacdn.com
+tag.aticdn.net
+
+# CDN
+cn.wswebcdn.com
+
+# Fraud protection
+telephonyspamprotect-pa.googleapis.com
+device-provisioning.googleapis.com
+
+# Antutu.com
+www.antutu.com.bsgslb.cn 
+zcmglobal.v.bsgslb.cn
+
+# geojs.io
+get.geojs.io
+geojs.io
+www.geojs.io
+
+# Pixeldrain.com
+pixeldrain.com
+
+# LINE
+gw.line.naver.jp # will break line pay, line points
+nelo2-col.linecorp.com # break line message loading
+today.line.me.edgekey.net # Line Today
+e1102.a.akamaiedge.net
+liffsdk.line-scdn.net # Line Taxi
+api.line.me # Line reward point
+ 
+# app.github.media
+s88570519.t.en25.com
+p04e.t.en25.com
+t.en25.com
+
+# weworkremotely.com
+weworkremotely.com
+
+# GeoJS
+geojs.io
+
+# Fathom
+usefathom.com
+
+# Flex
+click.justwatch.com
+
 # koyu.space
 koyu.space
 
@@ -89,10 +151,12 @@ platform.sharethis.com
 wownero.herominers.com
 
 # Apple OCSP
-ocsp.apple.com
-ocsp2.apple.com
-token.safebrowsing.apple
-safebrowsing.g.aaplimg.com
+#ocsp.apple.com
+#ocsp2.apple.com
+amp-api-edge.apps.apple.com
+amp-api-edge.apps.apple.com.edgekey.net
+#token.safebrowsing.apple
+#safebrowsing.g.aaplimg.com
 
 # mihoyo.com
 log-upload-os.mihoyo.com
@@ -877,6 +941,7 @@ github.hubspot.com
 hubspot.com
 
 # Apple
+amp-api-search-edge.apps.apple.com # App store app search
 dzc-metrics.mzstatic.com # Itunes desktop sync
 iadsdk.apple.com
 cf.iadsdk.apple.com

server-conf/Readme.MD

@@ -1,40 +1,33 @@
 ## Configuration details 
 
-**If you need uncensored DoH, please use `/uncensor` instead of `/dns-query`**
 ```
-https://doh-jp.blahdns.com/uncensor ( uncensor )
-https://doh-jp.blahdns.com/dns-query ( censored )
+# DNSCrypt information
+Provider public key: 7b8bf43c61a5207cecf803627e2497d327557585837a85b87e8700e8d989ad87
+Provider name: 2.dnscrypt-cert.blahdns.com
 ```
 
-- Switzerland 🇨🇭(DoT, DoH, Dnscrypt, DoQ), Provider: HostHatch.com
-  * IP: 45.91.92.121, 2a0e:dc0:6:23::2
-  * DNS-over-QUIC: `quic://dot-ch.blahdns.com:784`
-  * DNS-over-HTTPS:
-    * https://doh-ch.blahdns.com/dns-query
-  * DNS-over-TLS: dot-ch.blahdns.com, ports 853, 443
-
-- Finland 🇫🇮(DoT,DoH,Dnscryptv2, DoQ), Provider: Hetzner
-  * IP: 95.216.212.177, 2a01:4f9:c010:43ce::1
-  * DNS-over-HTTPS:
-    * https://doh-fi.blahdns.com/dns-query
-  * DNS-over-TLS: dot-fi.blahdns.com, ports 853, 443 
-
-- Germany 🇩🇪(DoT, DoH, Dnscryptv2, DoQ), Provider: Hetzner
+- Germany (DoT, DoH, Dnscryptv2, DoQ, DoH-http3), Provider: Hetzner
   * IP: 78.46.244.143, 2a01:4f8:c17:ec67::1
   * DNS-over-HTTPS: 
     * https://doh-de.blahdns.com/dns-query
-  * DNS-over-TLS: dot-de.blahdns.com, ports 853, 443
+    * h3://doh-de.blahdns.com/dns-query
+  * DNS-over-QUIC:
+    * quic://doh-de.blahdns.com:784
+  * DNS-over-TLS: 
+    * tls://dot-de.blahdns.com:853
+  * DNSCrypt:
+    * ipv4: sdns://AQMAAAAAAAAAEjc4LjQ2LjI0NC4xNDM6ODQ0MyDwRPCkhRTWv0NpkRQ3nwfF6IP-4Nd5_Xe-78yb9_M6gRsyLmRuc2NyeXB0LWNlcnQuYmxhaGRucy5jb20
+    * ipv6: sdns://AQMAAAAAAAAAG1syYTAxOjRmODpjMTc6ZWM2Nzo6MV06ODQ0MyDwRPCkhRTWv0NpkRQ3nwfF6IP-4Nd5_Xe-78yb9_M6gRsyLmRuc2NyeXB0LWNlcnQuYmxhaGRucy5jb20
 
-- Japan 🇯🇵(DoT, DoH, Dnscrypt, DoQ), Provider: Linode
-  * IP: 139.162.112.47, 2400:8902::f03c:92ff:fe27:344b
-  * DNS-over-QUIC: `quic://dot-jp.blahdns.com:784`
-  * DNS-over-HTTPS: 
-    * https://doh-jp.blahdns.com/dns-query
-  * DNS-over-TLS: dot-jp.blahdns.com, ports 853, 443
-
-- Singapore 🇸🇬(DoT, DoH, Dnscrypt, DoQ), Provider: Linode
-  * IP: 192.53.175.149, 2400:8901::f03c:92ff:fe27:870a
-  * DNS-over-QUIC: `quic://dot-sg.blahdns.com:784`
+- Singapore (DoT, DoH, Dnscryptv2, DoQ, DoH-http3), Provider: Contabo
+  * IP: 46.250.226.242, 2407:3640:2205:1668::1
   * DNS-over-HTTPS: 
     * https://doh-sg.blahdns.com/dns-query
-  * DNS-over-TLS: dot-sg.blahdns.com, ports 853, 443
+    * h3://doh-sg.blahdns.com/dns-query
+  * DNS-over-QUIC:
+    * quic://doh-sg.blahdns.com:784
+  * DNS-over-TLS: 
+    * tls://dot-sg.blahdns.com:853
+  * DNSCrypt:
+    * ipv4: sdns://AQMAAAAAAAAAEzQ2LjI1MC4yMjYuMjQyOjg0NDMge4v0PGGlIHzs-ANifiSX0ydVdYWDeoW4focA6NmJrYcbMi5kbnNjcnlwdC1jZXJ0LmJsYWhkbnMuY29t
+    * ipv6: sdns://AQMAAAAAAAAAHVsyNDA3OjM2NDA6MjIwNToxNjY4OjoxXTo4NDQzIHuL9DxhpSB87PgDYn4kl9MnVXWFg3qFuH6HAOjZia2HGzIuZG5zY3J5cHQtY2VydC5ibGFoZG5zLmNvbQ