All Systems Operational

Transparency Report

We operate an open infrastructure stack. Below is the detailed technical breakdown of how we protect, filter, and secure your DNS queries.

Security & Privacy Pipeline

Flow: Left → Right
01 FIREWALL

nftables

Kernel-level packet filtering. Blocks malicious IPs and rate-limits abusers before they reach our stack.

Rate Limiting
Threat-Feed IP Blocking
Default-Drop Inbound
02 FILTERING

dnsdist

Query filtering with no cache of its own. Blocks ads, trackers, malware and phishing against four public blocklists, then passes everything else to the validating resolver. Runs exactly as released, with no patches.

Adware & Tracking
Malware & Phishing
No Cache of Its Own
03 CACHE & DNSSEC

Unbound DNS

Validating resolver. Cryptographically verifies DNSSEC signatures and serves hot records from its own prefetching in-memory cache.

DNSSEC Validation
Prefetch Caching
Aggressive NSEC (RFC 8198)
04 UPSTREAM

DNS over TLS

Unbound forwards every cache miss over DNS over TLS to Cloudflare and Quad9, so nothing reaches the upstream resolvers in plaintext.

DoT (RFC 7858)
Two Upstream Operators
No Client Subnet (ECS) Sent

Active IP Blocklists (nftables kernel-level)

We block these sources at the network edge. The list below is the set of feeds currently enabled, all fetched from the FireHOL IP lists.

Enabled Threat Feeds Active
FireHOL Level 1
FireHOL's base list, built for few false positives: unrouteable address space plus several attack lists.
Essential
Spamhaus DROP + EDROP
Address ranges Spamhaus lists as hijacked or run by spam and malware operations.
Essential
BotScout + Blocklist.de
Decommissioned 7 July 2026. Disabled after its crowd-sourced reports were found to include legitimate search engine crawlers (Googlebot, Bingbot). Full incident writeup: When Your Blocklist Bans Googlebot.
Disabled (FP Mitigation)
Feodo Tracker
C2 servers for banking trojans (Dridex, Emotet, Trickbot).
Malware
CyberCrime Tracker
Command-and-control servers tracked by the CyberCrime project.
Malware
ET Compromised
Emerging Threats list of hosts known to be infected.
Malware
DShield (SANS ISC)
Top attacking subnets reported by the global sensor network.
Attacks
GreenSnow
Decommissioned 7 July 2026. Disabled as redundant with the feeds above.
Disabled (Redundant)

DNS Filter Lists (dnsdist)

Domain-based blocklists that filter ads, trackers, malware, and phishing at the DNS level. These work after traffic passes the firewall.

Counts measured 6 August 2026 - reopen the page to recalculate them live from the source lists in your browser.

261,790
rules blocked across all lists
Filter Source Live Sync
AdGuard DNS Filter
The baseline standard for blocking ads & general trackers.
163,297 rules filter_1.txt
OISD Blocklist Small
High-speed, essential blocking for maximum stability.
56,395 rules filter_5.txt
Phishing URL Blocklist
Real-time phishing & fraud domains from PhishTank and OpenPhish.
34,808 rules filter_30.txt
Malicious URL Blocklist
Active malware-distribution URLs tracked by abuse.ch URLHaus.
7,290 rules filter_11.txt

Rate Limiting & Fair Use

300
Queries / second

Per-IP rate limit on DoH. Sized for CGNAT networks, prefetching, and ad-heavy pages. Normal browsing does not come close to it.

Configuration last verified

Related

Protocols

How DoH, DoT, DoQ and DNSSEC validation work end to end.
Privacy

What is kept, where, and for how long.
Knowledge base

Answers on DNSSEC, filtering, GeoIP labels and troubleshooting.

Guides

DNS resolver

What a resolver is, and what it can see about you.
Caching & TTL

How the cache and TTL work, and why changes take time to spread.
Runbook

Build your own validating, hardened resolver with Unbound.