Public Resolver

Public DNS, on our own network.

Two resolvers on the same anycast addresses worldwide. One answers everything; the other refuses ads, trackers and known malware. Both speak plain DNS, DNS over HTTPS, DNS over TLS and DNS over QUIC, and neither keeps a log of what you asked.

01

Addresses

Unfiltered

Resolves everything, filters nothing.

  • 177.177.83.83
  • 2602:f3ff:83::83
  • DoH https://dns.yunzheng.space/dns-query
  • DoT / DoQ dns.yunzheng.space

Filtered

Refuses ads, trackers and known malware.

  • 177.177.83.84
  • 2602:f3ff:83::84
  • DoH https://dns.yunzheng.space/dns-query
  • DoT / DoQ dns.yunzheng.space
02

What we keep

Nothing that says who asked for what. The resolvers keep no per-query log at all — not the name, not your address, not a hash of either. Aggregate counters exist (how many queries a node answered, how many were filtered) and they are not attributable to anyone. There is no account, nothing to sign in to, and nothing to sell.

03

Limits

A network gets 500 queries per second per node, counted per /24 or per /64 rather than per address, and the allowance refills continuously. Going over it does not block anything: address lookups are answered with a page that says what happened, and everything else gets an empty answer so mail and service lookups fail cleanly rather than being pointed at a web server. A normal household or office never comes close.

04

Questions

Is it free?

Yes, for everyone, with no account. It is run by a non-profit laboratory as a public service.

Do you log my queries?

No. There is no per-query log — not the name, not your address, not a hash of either. Only aggregate counters that cannot be attributed to anyone.

What is the difference between the two addresses?

177.177.83.83 resolves everything as it is. 177.177.83.84 refuses names on ad, tracker and malware lists and answers those with a short notice instead.

I saw this address in my firewall log. What is it?

It is a public DNS resolver. If a device on your network is talking to it, that device is using it to look up names — either because it was configured to, or because an app chose an encrypted resolver on its own.

Does it support DNSSEC?

Yes. Answers are validated, and a name whose signatures do not check out is refused rather than returned.