PRIVACY · DNSSEC · ENCRYPTION

Your DNS. More control.

DNS-BASE is a publicly available recursive DNS resolver with encrypted transports, DNSSEC validation, and filtering of known threats and tracking domains. Free, no account required.

Setup More technical details

Connection details

Use one of these endpoints in your client. IP addresses alone do not provide unencrypted DNS service.

DoH

https://dns-base.de/dns-query

TCP 443 · HTTPS/2

DoT

dns-base.de

TCP 853 · TLS

DoQ

quic://dns-base.de

UDP 853 · QUIC

Server addresses

IPv4: 152.53.119.59
IPv6: 2a0a:4cc0:c0:32e2:a44e:eeff:fe55:3e84

Setup examples

Android

Android 9+: Settings → Network/Connections → Private DNS → provider hostname: dns-base.de.

Browser

Firefox/Chrome/Edge: enable secure DNS (DoH) and enter the custom URL.

Router / DNS

Routers and local resolvers: use DoT on port 853 with TLS verification name dns-base.de, or DoH/DoQ where supported.

What DNS-BASE offers

Technical protection using established open-source software.

Encrypted transports

DoH (HTTPS/2), DoT (TLS), and DoQ (QUIC). No public unencrypted DNS service on port 53.

DNSSEC validation

DNS signatures are checked; invalid responses may be rejected with SERVFAIL.

Domain filtering

HaGeZi PRO and TIF lists loaded as RPZ. Blocked names typically return NXDOMAIN and EDE 15.

QNAME minimisation

Where possible, only the necessary name components are sent to upstream authoritative servers.

How it works

dnsdist accepts encrypted DNS queries and forwards them locally to PowerDNS Recursor. The recursor answers from cache or contacts authoritative nameservers. DNSSEC validation and RPZ filtering are applied during processing.

Client → TLS / QUIC → dnsdist → PowerDNS Recursor → DNSSEC + RPZ → Cache / authoritative DNS

Protection and limits

Rate limiting helps mitigate abuse. Encryption protects transport to the resolver, not all subsequent connections. Blocklists may cause false positives; DNS-BASE is not a complete malware protection system.

Note: DNS-BASE currently runs on a single server; there is no independent second resolver location.

Logging and privacy

According to the documented configuration, individual DNS queries are not stored persistently as query logs. dnsdist maintains bounded volatile in-memory ring buffers containing queries and responses for abuse protection; system journals may contain technical events. Prometheus exposes aggregate metrics, not user browsing histories. Connection metadata is technically processed.

Configuration transparency

We publish sanitised configuration examples. These describe the architecture and are not unchanged live files or an independent security audit.

View examples

recursor.yml dnsdist.yml nftables.conf monitoring.md

The authoritative legal and privacy texts are currently available in German.