DoH + DoT
Encrypted DNS transport
Public DNS resolver
This resolver blocks ads, trackers and malicious domains before they ever reach your devices, and answers every query over an encrypted connection. Point your phone, laptop or router at the endpoints below. There is no account and nothing to install.
https://tundns.zone.id/dns-query
tundns.zone.id:853
Encrypted in transit · No logging of your browsing · No account required
How it works
Your device asks this resolver where a domain lives. If the domain is an ad, a tracker or malicious, the request is answered with nothing, so the bad content never loads.
Add the DNS-over-HTTPS or DNS-over-TLS endpoint in your device or router settings.
Each lookup is checked against up-to-date blocklists for ads, trackers and threats.
Pages load without ads and tracking, and everything travels over an encrypted connection.
On the TunGuard VPN
If you reach this server through its WireGuard VPN, the operator can switch filtering on for your device without you changing a single setting. Your DNS is routed through this resolver automatically, so ads and trackers are blocked on every device in the group.
The server owner generates a WireGuard configuration for your device and sends you the QR code or file.
From the TunGuard dashboard the owner moves your device into a policy group that has AdGuard DNS filtering turned on.
The server quietly sends your device's DNS requests through the filtered resolver. No app to install, no per-device configuration.
Because the filtering happens at the network level, a device that is already set up is covered the moment it joins a filtered group, and it stops being covered when it leaves. The owner runs the whole thing from the dashboard: create a policy group, turn on AdGuard DNS filtering, then move devices in or out. Every device in the group is answered through the same blocklists.
A device using its own Private DNS (DNS-over-HTTPS or DNS-over-TLS) takes that path instead, so point it at the endpoints on this page manually.
Features
Powerful filters strip ads, analytics and tracking pixels on every connected device.
Optionally shield younger users from adult content and other unwanted categories.
See which requests are blocked and how much noise is removed, privately, on the server.
Allow or block specific domains for the whole network or for individual devices.
DNS-over-HTTPS and DNS-over-TLS keep every query private between device and resolver.
Phones, tablets, laptops and routers: anything that supports a modern DNS resolver.
Set up
Use the same endpoint on as many devices as you like.
Settings → Network & internet → Private DNS → Private DNS provider hostname:
tundns.zone.id:853
Port 853 (DNS-over-TLS).
Install a DNS-over-HTTPS or DNS-over-TLS profile that points at this resolver, or use a client such as AdGuard that supports custom upstreams.
https://tundns.zone.id/dns-query
In Firefox or Chrome enable Secure DNS / DNS-over-HTTPS with a custom provider:
https://tundns.zone.id/dns-query
Set the router's DNS to forward to this resolver, and use a DNS-over-TLS upstream if it supports one:
tundns.zone.id:853
FAQ
DNS is the address book of the Internet: it turns a name like example.com into the numeric address your device connects to. A resolver is the server that answers those lookups.
DNS-over-HTTPS at your /dns-query URL, and DNS-over-TLS on the hostname shown at
the top of this page. Both lead to the same filtered resolver.
No. The resolver is open and needs no sign-in. There is nothing to install on your devices beyond pointing them at the endpoints.
Traffic between your device and this resolver is encrypted with DoH or DoT. It is a filtering resolver, so treat it like any third-party DNS: it exists to block unwanted content, not to profile you.
DNS-over-HTTPS uses the standard HTTPS port (443). DNS-over-TLS uses the port shown next to the DoT endpoint above (853 by default).
It blocks ad, tracker and malicious domains from its blocklists. Some apps can bypass DNS filtering by talking directly to an address; those are not affected.
Point your device at the endpoints above. Full setup guides, self-hosting notes and the project source live in the documentation.
Read the documentation