Updated July 7, 2026
Automatic encrypted-DNS discovery (DDR, RFC 9462) designates dnsdoh.art directly for DNS over HTTPS, DNS over TLS and DNS over QUIC. A device given only the resolver address finds the encrypted endpoints on its own, with no configuration.
How verification works
The discovery query travels in plain DNS, so a strict client only accepts a designation after a proof: the designated server's certificate must cover both its name and the resolver address the device started from. The certificate served on every transport now carries the site names and the resolver address 194.180.189.33 together, so the designation to dnsdoh.art verifies directly. Windows 11 and Apple platforms confirm the pair and fill in https://dnsdoh.art/dns-query, the same address shown everywhere on this site.
Verified on every transport
- DNS over HTTPS - HTTP/2 and HTTP/3 on port 443, path
/dns-query. - DNS over TLS - port 853.
- DNS over QUIC - port 853.
All three are verified designations, not just opportunistic hints.
Certificate and pinning
The certificate is short-lived with fully automated renewal and monitoring, and its key is pinned with DANE TLSA records in the DNSSEC-signed zone, unchanged across renewals.
From a test name to the stable setup
Verified discovery first ran on a separate test name, ddr.dnsdoh.art, which carried its own address certificate purely to prove that strict clients would accept and verify a designation. The test worked, and the arrangement is now stable without it: the main certificate covers the resolver address directly, so discovery designates dnsdoh.art itself on every transport. The ddr.dnsdoh.art name has been dropped from the discovery answer, and its temporary alias is being retired. The stable, everyday address stays the one shown across the site, https://dnsdoh.art/dns-query. The full engineering story - the certificate constraints, both designs and the commands to verify them - is written up in the guide Verified DDR end to end.