Correction, 11 October 2026
An internal infrastructure audit on 10-11 October identified a discrepancy between our published privacy statements and our operational logging.
Our resolvers do not keep query logs. However, client IP addresses were retained longer than intended by our DDoS defence layers and system diagnostics, short diagnostic captures of DNS traffic were kept on disk, and the weekly off-site server backups that contained some of these records were not encrypted.
We have purged all legacy logs, enforced strict retention limits (at most 30 days for defence decisions, 7 days for diagnostic captures), moved off-site backups to asymmetric encryption (age) applied on the server before upload, and updated this policy to reflect exact system behaviour.
In plain words: we kept more than we said, for longer than we said. That is fixed, and the list below is now exact.
What is not kept
No query logs
dnsdist and Unbound, the programs that answer you, log no queries and no replies. A live log of recent queries exists in memory only, on a RAM filesystem, where the defence layers read it. Nothing copies it to disk.
No accounts, no history, nothing sold
There is nothing to sign up for. No history of what you look up is built, and nothing is sold or shared for money.
Who else sees your queries
When a name is not already in our cache, Unbound asks Cloudflare (1.1.1.1) or Quad9 (9.9.9.10), over encrypted DNS over TLS. They see the name being looked up and our server's address. They do not see yours: we do not pass your address or your network on to them (no EDNS Client Subnet). What they do with the queries they receive is governed by their own privacy policies.
What the defence layers keep
The server is protected by layers of defence that block abusive traffic. To do that, they keep some records of source addresses. This is the complete list as of 11 October 2026:
| record | what it contains | kept for |
|---|---|---|
| live block lists | addresses currently blocked | in memory only, never on disk |
| defence system log | full source addresses of traffic the defence acted on | 2 weeks |
| defence decision logs | address, time and reason of each block | at most 30 days |
| reputation store | addresses the defence has acted on, with a score | until the score decays, usually weeks |
| rate-limit observations | network prefix only (the last part of the address is removed) | until the file reaches its size limit |
| short DNS packet captures | source address and query name, taken only for short periods when traffic looks wrong | 7 days |
| blocked-packet log | source and destination addresses and ports, mostly probes of closed ports | about 8 days |
| web server error and crawler logs | address of requests the web server rejected, and of requests that claim to be search-engine crawlers | about 3 days |
Everything in this table is deleted automatically when its period ends.
The website's own tools
- IP & Fingerprint page: your address is looked up in a location database on the server, with no outside service. The result is held in memory for 1 hour, then deleted.
- DNS leak test: the resolver addresses your test produced are held in memory for a few minutes.
Backups
Once a week the server's configuration and some of its data are backed up, and six days a week its configuration alone. All scheduled backups are encrypted with age on the server, before anything is uploaded; the only key that can decrypt them is held by the operator, off the server. Logs are not included. The weekly backups are stored with cloud storage providers, and the last four are kept; the daily ones stay on the server, and the last seven are kept. Backups made before 11 October were not encrypted. All of them have been deleted.
Encryption in transit
DoH3, DoH, DoT and DoQ are encrypted, so your network operator cannot read or change those queries. DoH3 and DoQ run over QUIC, which uses TLS 1.3. DoH and DoT support TLS 1.2 and 1.3. Plain DNS on port 53 is also offered, for devices that support nothing else. It is not encrypted, by the nature of the protocol.
Related: Terms of Service · how the server is built · FAQ