The resolver behind dnsdoh.art runs a maintained fork of AdGuard Home. Its upstream project recently merged several security fixes that have not yet reached an official release. They were reviewed, ported and deployed here on 7 July 2026.

What was applied

  • Strict DoH validation: responses from upstream DoH servers must now strictly match the RFC 8484 zero-ID convention and answer the question that was asked; a malformed or mismatched response is rejected instead of repaired.
  • Blocklist size limits: downloads are capped in size, preventing server resource exhaustion if an external filter source misbehaves.
  • h2c removal: the unencrypted HTTP/2 upgrade path in the internal web server is disabled, closing an unbounded-read vector.
  • ECH parsing fix: improved handling of the ech parameter in HTTPS records.

What it means for users

Nothing changes in daily use. These fixes reduce the ways a misbehaving upstream server or filter source could affect the resolver, before the fixes are available in the stock product.

Full detail

Every change in the fork is documented publicly, with the reasoning and the upstream references: AdGuardHome-edge technical specification.