Security Changelog

Transparent updates on our infrastructure, security patches, and feature rollouts.

51 updates
POST-MORTEM

Post-mortem: Our Leak Test Was Inventing Leaks

Our DNS leak test reported a phone leaking queries to Google Public DNS. It was not. The probe zone is delegated to a host whose port 53 serves strictly as a recursive resolver, so probe queries ended in SERVFAIL. Quad9 retried 18 times, gave up, and the phone fell back to a secondary resolver 57ms later - which we then recorded as an extra 'leaked' resolver on top of the correct ones. The test itself kept working and kept finding real leaks throughout; the defect added entries rather than removing them, which is why it survived so long.

Read details Read the post-mortem
POST-MORTEM

Post-mortem: One Directive Refused Every HTTP/2 POST

A hardening change on this resolver set nginx's http2_body_preread_size to 16k. Any value below 65535 makes nginx refuse every HTTP/2 request carrying a body - every RFC 8484 DoH POST - for at least five weeks. A new post-mortem documents the code path, the measurement, and a reproduction anyone can run on localhost.

Read details
DOCUMENTATION

New Guide: Zero Open Admin Ports

A new how-to documents the pattern this server uses to hide its management plane: the AdGuard Home admin panel and SSH answer two devices over Tailscale and nobody else. Three gates - a localhost bind, an nginx geo allowlist, and a DNS split view from the resolver itself - plus one nftables rule for port 22, each verified from both sides.

Read details
SECURITY

Amplification Defence, Part Two: EDNS Clamp, DNS Cookies, and a 4 KB Bug

The two remaining defence layers are live: the public edge truncates UDP answers at 1,232 bytes whatever buffer size a client advertises, and a valid DNS Cookie now exempts a client from rate limiting. Testing the truncation promise end to end also surfaced a silent 4 KB limit in dnscrypt-proxy's TCP path that had been failing large answers for years - fixed.

Read details
DOCUMENTATION

Runbook Published: Running a 160-Hour Certificate

The unified certificate behind the site and all encrypted DNS transports lives 160 hours - the condition attached to the only free way to put an IP address in a SAN. The complete production operation is now documented: issuance, ARI renewal, the watchdog and DANE guard scripts published in full, and the failure timeline.

Read details
DOCUMENTATION

Runbook Published: The Missing NSEC

A DNS provider served our signed zone's delegation without the NSEC record proving DS absence, and validating resolvers refused the whole subtree with EDE 22. We diagnosed it across six providers, reported it with a one-line reproduction, and the platform-wide fix is now verified. The full account is published as a runbook.

Read details
UPDATE

Discovery Answers Now Carry Address Hints (One Less Round Trip)

Every DDR designation the resolver returns for _dns.resolver.arpa now includes ipv4hint=194.180.189.33, on DoH, DoT and DoQ alike. A bootstrapping device can open the encrypted handshake immediately instead of first resolving the target name, saving one round trip at the moment latency is most visible.

Read details
DOCUMENTATION

New Reference Guide: Anatomy of a Hardened DNS Zone

A new flagship guide walks through the real dnsdoh.art zone record by record: DNSSEC, DANE on all four transports, the HTTPS record with ECH, DDR discovery, mail lockdown and CAA. Published together with an infrastructure change: the ECH key now rotates monthly, automatically.

Read details
DOCUMENTATION

Runbook Published: When a Public Blocklist Bans Googlebot

A crowd-sourced IP blocklist this service imports had listed real Googlebot addresses. The firewall dropped them before nginx ever saw a request, and the site began to fall out of search. The full incident writeup is now published as a guide, with every tool included.

Read details
MAJOR UPDATE

Automatic Encrypted DNS Discovery Is Live (Verified DDR)

dnsdoh.art now answers Discovery of Designated Resolvers (RFC 9462) in strict verified mode. A device that knows only the resolver address 194.180.189.33 discovers the encrypted endpoints on its own, and Windows 11 fills in the DoH template automatically.

Read details
DOCUMENTATION

Two New Guides: DNS Caching and What Your IP Reveals

Two new evergreen guides: one explains DNS caching and TTL, including why a record can keep resolving to an old address after you change it; the other walks through what an IP address lookup actually shows about you, and what it does not.

Read details