Use our public DNS

Point your device at it.

Two resolvers on the same anycast addresses everywhere. One answers everything; the other refuses ads, trackers and known malware. Neither keeps a log of what you asked.

01

The addresses

UnfilteredFiltered
IPv4177.177.83.83177.177.83.84
IPv62602:f3ff:83::832602:f3ff:83::84
DoHhttps://dns.yunzheng.space/dns-queryhttps://dns.yunzheng.space/dns-query
DoT / DoQdns.yunzheng.spacedns.yunzheng.space
Set both the IPv4 and the IPv6 address where the device has both. A device left with one of its two resolvers pointing elsewhere is using that other resolver roughly half the time, which makes filtering look broken and makes any privacy claim meaningless.
02

Windows and macOS

  1. Windows 11: Settings → Network & internet → your connection → DNS server assignment → Edit → Manual. Turn on IPv4 and IPv6, fill in the addresses above, and set DNS over HTTPS to On (automatic template).
  2. macOS: System Settings → Network → your connection → Details → DNS, then add the addresses with +. Remove the ones that were there.

In a Chromium browser you can also set it for the browser alone: Settings → Privacy and security → Security → Use secure DNS → Custom, then paste the DoH URL.

03

iOS and Android

Android 9 and later has this built in: Settings → Network & internet → Private DNS → Private DNS provider hostname → dns.yunzheng.space. That is DNS over TLS and it applies to the whole device, on Wi-Fi and on mobile data.

iOS and iPadOS need a DNS profile to apply system-wide; without one, only per-Wi-Fi manual DNS is available under Settings → Wi-Fi → (i) → Configure DNS → Manual, and it does not cover mobile data.

04

Linux and routers

systemd-resolved, with DNS over TLS
# /etc/systemd/resolved.conf.d/orbit.conf
[Resolve]
DNS=177.177.83.83#dns.yunzheng.space 2602:f3ff:83::83#dns.yunzheng.space
DNSOverTLS=yes
Then
sudo systemctl restart systemd-resolved

On a router, set it once in the DHCP settings and every device on the network follows. This is the only way to cover devices that have no DNS setting of their own — printers, televisions, anything embedded.

05

Check it worked

First, that the resolver answers you at all:

dig +short @177.177.83.83 example.com

Then, that your device is actually using it. Ask for a name the filtered resolver refuses. On the filtered address the answer is the resolver's own address — that is the notice page, not the ad server:

dig +short @177.177.83.84 googleads.g.doubleclick.net
# 177.177.83.84   ← refused, answered with the notice page

dig +short googleads.g.doubleclick.net
# 177.177.83.84   ← your device is using the filtered resolver
If the second command returns an ordinary address, your device is still resolving through something else — most often an IPv6 resolver that was left unchanged, or a browser doing its own encrypted DNS.
06

Questions

Is it free?

Yes, for everyone, with no account. It is run by a non-profit laboratory as a public service.

Do you validate DNSSEC?

Yes. A name whose signatures do not check out is refused with SERVFAIL, and a name we proved genuine comes back with the authenticated-data flag. Unsigned names resolve normally — being unsigned is not a failure, and most of the internet still is. Add <code>+cd</code> to a dig if you are validating yourself and want the raw answer.

Is there a rate limit?

500 queries per second per node, counted per /24 or per /64 rather than per address. Going over it does not block anything: address lookups get a page explaining what happened, and other types get an empty answer. A household or office never comes close.

Next

Related

Getting started

How an Orbit account is organised, what lives where in the console, and the shortest path from signing in to serving a name from our network.

DNS hosting

Add a zone, point your registrar at our name servers, and manage records. Includes weighted answers, health-checked records, ALIAS at the apex and zone-file import.

Connect a hostname

Delegate the whole domain, delegate one hostname, or add a CNAME and leave your DNS where it is. What each one costs you and when to pick it.

← All documentation