Encrypted DNS resolver - DoH, DoH3, DoT and DoQ, no logs.

A public resolver on 194.180.189.33. It filters ads, trackers, malware and phishing with four public blocklists, and answers over four encrypted transports. No accounts, and no record of your IP address or the names you look up.

Plain DNS travels in the open, so your provider and anyone on the path can read every name you look up. Encryption closes that gap - it does not hide the lookups from the resolver you choose, which is why which resolver you trust matters as much as the protocol.

Set it up Copy an address
Already configured? Test if it's working Check your IP address and browser fingerprint
No Registration
Zero Logging
Encrypted DNS
DNSSEC Verified
Post-Quantum
Encrypted SNI

Pick a transport, copy the address

All four reach the same resolver. Which one you want depends on what you are configuring.

DNS over HTTPS (DoH)

Port 443
https://dnsdoh.art/dns-query

Use this if you are setting up Chrome, Firefox or Edge Secure DNS, or Windows 11. This address can end up on HTTP/3 without you doing anything: the endpoint advertises it, and a client that speaks HTTP/3 upgrades itself to DoH3.

DNS over TLS (DoT)

Port 853
dnsdoh.art

Use this if you are filling in Android Private DNS, an iOS or macOS profile, Stubby, or a router.

DNS over HTTP/3 (DoH3)

Port 443
h3://dnsdoh.art/dns-query

Use this if your client wants HTTP/3 named explicitly, as AdGuard's do. Same endpoint as DoH above - you only need to type h3:// where a client will not negotiate HTTP/3 by itself.

DNS over QUIC (DoQ)

Port 853
quic://dnsdoh.art:853

Use this if you run AdGuard Home, dnsproxy, or router firmware that speaks DoQ. No browser or operating system implements it directly.

Legacy DNS (Unencrypted)

Only use if your device doesn't support encrypted DNS

194.180.189.33

Need help choosing? Check our setup guides

View detailed setup instructions

What we measured

Numbers taken on this resolver, not claims about it. Each one links to the page that shows the work.

Time to a first answer

DoQ 105 ms, DoT 144 ms, DoH 145 ms, DoH3 148 ms, over 300 cold lookups on 29 and 30 July 2026. Plain DNS answers in 41 ms and encrypts nothing.

The four transports, measured side by side

What happens when packets drop

At 2% packet loss the 99th percentile is 310 ms on DoQ and 329 ms on DoH3, against 1226 ms on DoT and 1222 ms on DoH. The QUIC transports are not quicker to a first answer - they are steadier when the network is not.

Why the TCP transports stall for a full second

Four public blocklists

AdGuard DNS Filter, OISD, PhishTank with OpenPhish, and URLHaus. Rule counts are recalculated in your browser from the live lists rather than asserted here.

The lists and their current rule counts

Signed, pinned, post-quantum

The zone is DNSSEC-signed with ECDSA P-256, and DANE TLSA records pin the key on all four transports. TLS negotiates X25519MLKEM768, and Encrypted Client Hello is published in the zone.

Every layer, with the dig output

DNS Guides

Plain-language explainers on how DNS and encrypted lookups work

How DNS Actually Works

The lookup behind every connection, step by step: stub, resolver, root, TLD, authoritative.

What Is a DNS Resolver?

The one server that sees every domain you visit, and what it can learn about you.

How DNS Ad-Blocking Works

What gets blocked at the lookup, and which ads DNS filtering can't remove.

How the DNS Leak Test Works

What the test on this site actually measures, and how it finds the resolvers you really use.

Encrypted DNS vs VPN

What each one covers, what neither hides, and when you need which.

Browser Fingerprinting Explained

What your browser tells about you without cookies, and how identifying it is.
Browse all guides