This policy covers the public DNS resolvers at 177.177.83.83, 177.177.83.84, their IPv6 addresses, and the encrypted endpoints at dns.yunzheng.space. It does not cover any other Orbit service.

There is no per-query log. Not the name you asked for, not your address, not a hash or truncation of either, and no identifier that could stand in for you. This is not a default that can be switched: the code that writes query logs refuses to run for a resolver with no owner, and the public resolvers have none. We set no cookies, we require no account, and there is nothing to sign in to.

Counters, in five-minute windows, per node: how many queries were answered, how many came from cache, how many were filtered, the mix of record types and result codes, how the query arrived (plain, TLS, HTTPS, QUIC), how long answers took, and how many answers DNSSEC proved genuine or refused. Separately from all of that, two further tallies: which networks and countries traffic arrived from, and which names were popular. Separately is the load-bearing word — those two are never counted against each other, so no record exists, here or anywhere, of which network asked for which name. A name is counted only once it has been asked for at least 50 times on one node inside one window, so a name that one person looked up never leaves the machine that answered it. Your address is used to look up a network number and a country and is then discarded.

The counters above are visible to the laboratory's operators. They are not sold, not shared with advertisers, and not handed to analytics services — there are none embedded anywhere in this service. Aggregate totals (queries answered, nodes online) are published openly. We have never received a demand for user data relating to this resolver, and there is no per-user data to hand over if we did; a demand for it would be answered by saying so.

The counters are kept for 14 days and then deleted. Nothing is archived beyond that, because nothing there is worth the risk of keeping. Operational data that is not about queries at all — that a node is up, that a certificate renewed — is kept longer.

177.177.83.83 and its IPv6 address resolve everything as published and filter nothing. 177.177.83.84 refuses names on advertising, tracking and malware lists and answers them with a short notice instead; the lists are third-party and public. Neither address blocks anything on political grounds, and neither is used to redirect traffic to advertising, search or any page we profit from. Going over the rate limit is answered with a notice page for address lookups and an empty answer for everything else — never with a substituted address.

The resolvers validate DNSSEC: a name whose signatures do not check out is refused rather than answered, and a verified answer carries the authenticated-data flag. A client validating on its own device can ask with the checking-disabled bit and will not be second-guessed. Queries may arrive in plain DNS, over TLS, over HTTPS or over QUIC; the encrypted endpoints are the same service on the same addresses.

The service is run by YunZheng LAB, a non-profit educational and research laboratory, on AS204921. Questions and abuse reports go to abuse@yunzheng.space. If this policy changes in a way that reduces what is protected, the change will be described on this page rather than made quietly.