公开可用DNS over HTTPS服务

DevOps 资源, 运维 2020-12-11 共12729字

1.62W 0 0

MarginNote 3 - Mac端PDF阅读批注工具激活码价格：￥69.00

赤友 NTFS for Mac 助手 - 磁盘硬盘格式读写软件注册激活码价格：￥35.00

简介

DNS是否通过HTTPS解析隐私，性能和安全性。这也使使用您选择的名称服务器而不是为系统配置的名称服务器更加容易。

DNS over HTTPS

Publicly available servers

Who runs it	Base URL	Comment
A
aaflalo.me	Server US: https://dns-nyc.aaflalo.me/dns-query Server EU: https://dns.aaflalo.me/dns-query	Runs on Star Brilliant's dns-over-https Both servers check for DNSSEC and block advertising
AdGuard	Default: https://dns.adguard.com/dns-query Family protection: https://dns-family.adguard.com/dns-query	Default provides ad-blocking at DNS level, while Family protection adds adult site blocking.
AhaDNS.com	https://doh.nl.ahadns.net/dns-query https://doh.in.ahadns.net/dns-query	A zero logging DNS with support for DNS-over-HTTPS (DoH) & DNS-over-TLS (DoT). Blocks ads, malware, trackers, viruses and telemetry. DNSSEC, TLS 1.3, Open Source.
Alibaba Public DNS	https://dns.alidns.com/dns-query	DoH/DoT/DNS Json API, Best DoH/DoT server in China
Andrews & Arnold	https://dns.aa.net.uk/dns-query	no logging (see DNS Disclaimer)
alekberg	Spain: https://dnses.alekberg.net/dns-query Holland: https://dnsnl.alekberg.net/dns-query Sweden: https://dnsse.alekberg.net/dns-query	DoH Servers in Spain, Holland and Sweden. No logging, no filtering, DNSSEC support.
armadillodns.net	https://doh.armadillodns.net/dns-query	No source IP logging.
Association 42l	https://doh.42l.fr/dns-query	DNSSEC, not logging queries' content, uses doh-proxy and edgedns for caching. Queries proxied randomly through FFDN members' open DNS resolvers (French ISPs committing for net neutrality).
B
blahdns.com	Finland: https://doh-fi.blahdns.com/dns-query Japan: https://doh-jp.blahdns.com/dns-query Germany: https://doh-de.blahdns.com/dns-query	Based on Go implementation, knot-resolver, Unbound with DNSSEC, No ECS, No logs, Adsblock
blockerDNS	https://example.doh.blockerdns.com/dns-query	DNS-based ad-blocking service; One-man operation; ZERO IP and DNS query logging for DoH and DoT. Charges 99c per month for https DOH service
BraveDNS	Malware and ad-blocking: https://free.bravedns.com/dns-query Endpoint configuration with custom blocklists: https://bravedns.com/configure	A stub resolver running in 200+ locations world-wide on Cloudfare. Fast, secure, private, transparent, configurable DNS resolver. No ECS. Implements CNAME Cloaking. No-logging. github
C
captnemo.in	https://doh.captnemo.in/dns-query	Runs dnss with local unbound resolver running DNSCrypt with DNSSEC support as the upstream. Privacy Policy. More details at https://captnemo.in/doh/. No logging or filtering. Runs in Bangalore, India
CIRA Canadian Shield	Private: https://private.canadianshield.cira.ca/dns-query Protected: https://protected.canadianshield.cira.ca/dns-query Family: https://family.canadianshield.cira.ca/dns-query	Supports DNSSEC, keeps DNS traffic inside Canada. Private: DNS resolution service that keeps your DNS data private from third-parties. Protected: Includes Private features and adds malware and phishing blocking. Family: Includes Protected and Private features and blocks pornographic content.
Cisco Umbrella/OpenDNS	Standard: https://doh.opendns.com/dns-query FamilyShield (blocks adult content): https://doh.familyshield.opendns.com/dns-query	DNSSEC, Anycast
CleanBrowsing	https://doh.cleanbrowsing.org/doh/family-filter/	anycast DoH server with parental control (restricts access to adult content + enforces safe search)
Cloudflare	https://cloudflare-dns.com/dns-query also available via Tor onion service Mozilla: https://mozilla.cloudflare-dns.com/dns-query Block Malware: https://security.cloudflare-dns.com/dns-query Block Malware and Adult Content: https://family.cloudflare-dns.com/dns-query DNS64: https://dns64.cloudflare-dns.com/dns-query	Supports both -04 and -13 content-types
Comcast	https://doh.xfinity.com/dns-query	Experimental, DNSSEC
Commons Host	https://commons.host	~20 PoPs worldwide, Node.js/playdoh over Knot Resolver.
ContainerPI	Unfiltered by Cloudflare: https://dns.containerpi.com/dns-query Filtered by CleanBrowsing, blocks adult content: https://dns.containerpi.com/doh/family-filter/ Filtered, blocks malicious domains only: https://dns.containerpi.com/doh/secure-filter/	Based on m13253/DNS-over-HTTPS, no logging, EDNS Client Subnet enabled. Multiple nodes in China Mainland(limited), China Taiwan, Japan, South Korea, India, Germany, România, Russia, USA and Brazil.
Cox	https://dohdot.coxlab.net/dns-query	Experimental, No DNSSEC
CZ.NIC	https://odvr.nic.cz/dns-query	Runs on Knot Resolver (doh2), supports DNSSEC, provided by .cz TLD operator
D
Digitale Gesellschaft	https://dns.digitale-gesellschaft.ch/dns-query	No query/IP logging, no filtering, QNAME minimization, TLS 1.3, DNSSEC; https://www.digitale-gesellschaft.ch/dns/
dns.flatuslifir.is	https://dns.flatuslifir.is/dns-query	Public adblock server that supports DoT & DoH for fun and learning, no logging, supports DNSSEC, qname-minimisation, ECS is not enabled. Located in Iceland, built on pihole, nginx, unbound, m13253/DNS-over-HTTPS
DNS.SB	https://doh.dns.sb/dns-query	DNSSEC enabled
dnsforge.de	https://dnsforge.de/dns-query	No logging. Support DNSSEC. Hosted in Germany
dnsHome.de	https://dns.dnshome.de/dns-query	DoH Server in Germany. No logging, No filtering, DNSSEC and own DNS Resolver
DNSlify	https://doh.dnslify.com/dns-query	Anycast, No Logging, Own Recursion, Strict Privacy Policy.
doh.li	https://doh.li/dns-query	Runs on dns-over-https, no logging, EDNS Client Subnet enabled, based in DigitalOcean London. DNSSEC and adblock not currently enabled.
F
FAELIX	https://rdns.faelix.net/	No logging, based on dnsdist-doh RC querying our powerdns-recursor resolvers, multiple nodes in UK and CH, more info
ffmuc.net	https://doh.ffmuc.net/dns-query	DoH-Server of Freifunk München. No logging, no filter, DNSSEC, own recursion. More in our wiki
Foundation for Applied Privacy	https://doh.applied-privacy.net/query	No query/IP logging, no filtering, QNAME minimization, no EDNS client subnet, TLS 1.3, DNSSEC, RFC7706, RFC8198; https://applied-privacy.net/services/dns/
G
Google	https://dns.google/dns-query DNS64: https://dns64.dns.google/dns-query	Full RFC 8484 support
H
Hostux.net	Uncensored DNS: https://dns.hostux.net/dns-query Adblocking DNS: https://dns.hostux.net/ads	DNSSEC, no EDNS Client-Subnet, not logging queries' content, hosted in Luxembourg.
Hurricane Electric (he.net)	https://ordns.he.net/dns-query	Also supports DoT and TLS 1.3, Does not support DNSSEC. Anycast servers.
J
jcdns.fun	https://jcdns.fun/dns-query	secure nginx, Non-Logged / Uncensored, hosted on Digital Ocean VPS by jamesacampbell AKA James Campbell.
jitender	https://jit.ddns.net/dns-query	DoH server - India, Oracle Cloud, Hyderabad, India, Runs with nginx, high availability, load balanced by nginx with multiple backend DNS servers. Blocks ad, analytics, trackers blocking provides a clean browsing experience. @coolquasar
jp.tiar.app	https://jp.tiar.app/dns-query https://jp.tiarap.org/dns-query	No Censorship, No Logging, No ECS, support DNSSEC in Japan
L
LavaDNS	USA: https://us1.dns.lavate.ch/dns-query, Finland: https://eu1.dns.lavate.ch/dns-query	DoH server in USA and Finland. No logging, no filtering, no ECS, DNSSEC support.
lelux.fi	https://resolver-eu.lelux.fi/dns-query	DoH server in France. No logging, no filtering, DNSSEC support.
LibreDNS	https://doh.libredns.gr/dns-query	no logging, TLS 1.3, No DNSSEC
N
nextdns.io	https://dns.nextdns.io/<config_id> Create a config ID	The first cloud-based private DNS service that gives you full control over what is allowed and what is blocked on the Internet. 300,000 domain resolution per month is free! Quite a fine-granular dashboard, the same account can be used for multiple devices with prefixes to easier track activities on the dashboard!
NekomimiRouter.com	https://dns.dns-over-https.com/dns-query	Runs Go implementation. Does recursion itself with no upstream servers. Toy server may fail, please report if fails
P
pi-dns.com	https://doh.pi-dns.com/dns-query https://doh.centraleu.pi-dns.com/dns-query https://doh.northeu.pi-dns.com/dns-query https://doh.westus.pi-dns.com/dns-query https://doh.eastus.pi-dns.com/dns-query https://doh.eastau.pi-dns.com/dns-query https://doh.eastas.pi-dns.com/dns-query	A zero logging DNS with support for DNS-over-HTTPS (DoH) & DNS-over-TLS (DoT). Blocks ads, malware, trackers, viruses and telemetry. DNSSEC, TLS 1.3
PowerDNS	https://doh.powerdns.org	Based on dnsdist-doh branch
Q
Quad9	Recommended: https://dns.quad9.net/dns-query Secured: https://dns9.quad9.net/dns-query Unsecured: https://dns10.quad9.net/dns-query Secured w/ECS Support: https://dns11.quad9.net/dns-query	Secured provides: Security blocklist, DNSSEC, no EDNS Client-Subnet Unsecured provides: No security blocklist, no DNSSEC, no EDNS Client-Subnet Recommend is currently identical to secure.
R
Rubyfish.cn	https://dns.rubyfish.cn/dns-query	East China Zone, Based on https://github.com/m13253/dns-over-https
S
Snopyta	https://fi.doh.dns.snopyta.org/dns-query	Non-logging DoH Server in Finland
SWITCH	https://dns.switch.ch/dns-query	DNSSEC validation protects from forged or manipulated DNS data from upstream servers, DNS Query Name Minimisation to improve privacy, SWITCH DNS Firewall blocks access to infected or malicious websites and redirects users to a landing page
T
Tiarap	https://doh.tiar.app/dns-query https://doh.tiarap.org/dns-query	Based in Singapore, No logging, block Ad/Ad-tracking/Malware, No ECS, DNSSEC
TWNIC	https://dns.twnic.tw/dns-query	No source IP logging. Operated by Quad101 project, according to this announcement
W
wugui.zone	https://dns.wugui.zone/dns-query https://dns-asia.wugui.zone/dns-query	DoH Server in Russia. No logging, No filtering
@#$%
@chantra	https://dns.dnsoverhttps.net/dns-query	"toy server" which runs doh-proxy
@jedisct1	https://doh.crypto.sx/dns-query	a server which runs another project called doh-proxy, written in Rust.
ibksturm.synology.me	https://ibksturm.synology.me/dns-query	doh-server (nginx - dnsproxy - unbound), DNSSEC / Non-Logged / Uncensored, OpenNIC and Root DNS-Zone Copy Hosted in Switzerland by ibksturm, aka Andreas Ziegler.
@matthewgall - mydns.network	https://adblock.mydns.network/dns-query (adblock, using PiHole)	no logging, DNSSEC enforcing, DDoS protected (using Spectrum by Cloudflare), anycast)
@null31	https://ibuki.cgnat.net/dns-query	Based in Brazil / doh-server (nginx - dnsdist - unbound) / dot-server (dnsdist - unbound) / DNSSEC / QNAME minimization / Uncensored / no logging, no ECS, hosted on Oracle Cloud VPS by null31.
@publicarray dns.seby.io	https://doh-2.seby.io/dns-query https://doh.seby.io:8443/dns-query	Australian server that runs @m13253's Go implementation, Unbound with DNSSEC, No ECS, and No logs

*: Tested via curl --doh-url <RESOLVER_URI> http://google.com.

Private DNS Server with DoH setup examples

Base	Source	Comment
Docker	https://github.com/satishweb/docker-doh	Complete Docker stack using Star Brilliant's dns-over-https and Docker Flow Proxy
Docker	https://github.com/coolquasar/dnsproxy	Complete DoH, DoT and DoQ stack in docker based on Adguard home dnsproxy project. Could host DoH,DoT and DoQ quickly in a cloud server, and run respective clients in local Docker env. It has been tested in Raspberry PI as well

Supported in browsers and clients

Name	Version	Comments
Firefox	62	Firefox DNS-over-HTTPS
Bromite	67.0.3396.88	How to enable DoH
curl	7.62.0	See DOH-implementation
OkHttp	3.11	See Providers
curl-doh	n/a	basic stand-alone DoH client that uses curl
Chrome	66	https://bugs.chromium.org/p/chromium/issues/detail?id=799753

DOH Tools

Name	Author/Organization	Comments
coredns	Cloudflare	CoreDNS is a DNS server/forwarder, written in Go from the Cloud Native Computing Foundation.
doh-proxy	Facebook	tools for DoH
dns2doh	Daniel	tool for generating DOH responses and questions.
doh-proxy	Frank Denis	server-side proxy in rust
doh-php-client	Daniel Cid	can be used to test and run DoH requests via PHP applications.
doh-js-client	Peter Lai	client-side implementation of DoH, can be used in nodejs backend.
jDnsProxy	Travis Burtrum	DNS proxy and cache, implementing DNS-over-TLS, DNS-over-HTTPS, and Serve-Stale
dns-over-https	Star Brilliant	server-side and client-side implementation, written in Golang
dnsdist	PowerDNS	supports doh, see https://dnsdist.org/guides/dns-over-https.html
dnss	Alberto Bertogli	daemon written in Go which acts as a proxy (the most common use case), and as a server (in case you want end-to-end control).
nss-tls	Dima Krasner	a daemon that makes gethostbyname(), getaddrinfo(), etc. happen through DoH, without any change to applications, thus transparently migrating all applications that don't use their own resolver (like some browsers) from DNS to DoH.
dealdoh	Maxime Elomari	a middleware to proxy DoH requests to different DNS upstreams, written in PHP.
Encrypted-DNS	Siujoeng Lau	DNS-over-HTTPS forwarder written in Python
RouteDNS	Frank Olbricht	a flexible stub resolver, proxy, and router with support for DoH, DoT, and plain DNS written in Go.
h2odoh	Max Kostikov	an implementation with H2O HTTP/2 server using embedded mruby.
Encrypted DNS Server	Frank Denis	can serve DNSCrypt and DoH traffic simultaneously, written in Rust.
dnscrypt-proxy	Frank Denis	dnscrypt-proxy 2 - A flexible DNS proxy, with support for encrypted DNS protocols.
quart-doh	Matthieu Treussart	HTTP/2 server who serves a DOH proxy written in Python, with Quart Python web microframework.
EasyDoH	ElevenPaths	a simple add-on for Firefox that allows one to easily activate DNS over HTTPS and its working mode with just one click.
dohjs	BYU IMAAL	Client DoH JavaScript library for accessing DNS information from web applications. Can be tested at dohjs.org
Technitium DNS Server	Technitium	A FOSS, cross-platform DNS Server written in C# that can consume as well as host DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) services.
kdig	CZ.NIC	Utility that sends one or more DNS queries to a nameserver. Each query can have individual settings, or it can be specified globally via common-settings, which must precede query specification. This utility supports DoH.