adguardteam / knowledgebasedns

AdGuard DNS knowledge base

Website

This website is built using Docusaurus 2, a modern static website generator.

main branch is published automatically to https://adguardteam.github.io/KnowledgeBaseDNS/.

How to contribute

You can help by contributing to the Knowledge Base, all details are in this article.

How to develop

Prepare

First of all, you need to install the following:

• git
• yarn

Second, clone this repo to your local computer:

• git clone [email protected]:AdguardTeam/KnowledgeBaseDNS.git

Alternatively, you can use the Github app to do that.

Then you should open Terminal on your computer and navigate to the directory where you cloned this repo and run this command to install the local dependencies:

• yarn install

Lint markdown

This command lints the markdown and outputs any errors to the console:

• yarn lint:md

Some of errors can be fixed automatically:

• yarn lint:md --fix

VSCode users can install the markdownlint extension to see the errors in the editor.

Run it locally

• yarn start

This command lints markdown syntax, and if there is no markdownlint errors starts a local development server and opens up a browser window. Most changes are reflected live without having to restart the server.

How to build

• yarn build

This command generates static content into the build directory and can be served using any static contents hosting service.

How to translate

Translations are not pushed to the repo and prepared on-the-fly (i18n folder is added to .gitignore).

Here's how you can debug translations locally.

1. Download translations: CROWDIN_PERSONAL_TOKEN="YOURTOKEN" yarn run crowdin download
2. Run Docusaurus with the language of your choice: yarn run start -- --locale de

How to generate DNS stamps

If you'd like to update the list of known DNS Providers, you'll need to know how to create and check DNS stamps. Read the brief tutorial below to learn how to do it.

For DNS-over-HTTPS

1. Go to Online DNS Stamp calculator
2. Choose DNS-over-HTTPS from the drop-down menu
3. Fill out the Host name and Path fields of the form
4. Copy the ready DNS stamp from the Stamp field

For DNS-over-TLS

1. Go to Online DNS Stamp calculator
2. Choose DNS-over-TLS from the drop-down menu
3. Fill out the Host name field
4. Copy the ready DNS stamp from the Stamp field

For DNS-over-QUIC

1. Go to Online DNS Stamp calculator
2. Choose DNS-over-QUIC from the drop-down menu
3. Fill out the Host name field
4. Copy the ready DNS stamp from the Stamp field

For Plain DNS

1. Go to Online DNS Stamp calculator
2. Choose Plain DNS from the drop-down menu
3. Fill out the IP address field
4. Copy the ready DNS stamp from the Stamp field

How to check DNS stamps

1. Install dnslookup using Homebrew or from source
2. Run a command. Examples of commands for different protocols are given on this page

knowledgebasedns's Issues

[email protected]:AdguardTeam/KnowledgeBaseDNS.git

content/authentication/connecting-to-github-with-ssh

Update ControlD Unfiltered DNS Resolvers

Information can be found HERE

or for the sake of simplicity:

  unencrypeted:
  76.76.2.0
  76.76.10.0
  2606:1a40::
  2606:1a40:1::

  encrypted:
  https://freedns.controld.com/p0 (DoH/3)
  tls://p0.freedns.controld.com (DoT/DoQ)

Migrate AdGuard Home wiki to this Knowledge Base

AdGuard Home Wiki markdown files available by cloning the repo: https://github.com/AdguardTeam/AdGuardHome.wiki.git

The problem with the Github Wiki is that it does not support localization unlike the DNS knowledge base.

As for why keeping AG DNS and AdGuard Home together, I suppose there are many common topics and thus it makes sense to keep them together.

The task itself should be done in several smaller pull requests.

Please structure the process the following way:

1. Create a branch named adguardhome.
2. Create new branches from that branch.
3. Create pull requests to that branch.
4. Once we have all content finalized in that branch, we'll create a new pull request to the master branch.

Please ask @ainar-g help and add them to every pull request.

A few notes about the work itself:

1. Add a new section to the knowledge base and call it "AdGuard Home".
2. AdGuard Home wiki often has "internal" manually written tables of contents. We don't need them as Docusaurus builds them automatically.
3. Do not follow the same markdown style when migrating the content, rely on auto-beautify by VS code. Sorry @ainar-g, the reason for that is that I am almost sure that Crowdin won't play well with the guidelines you're using now as Crowdin will ruin it completely when re-importing the content.

Once this work is finished and the KB is live, we'll start changing the existing AdGuard Home wiki and funnel people to the new location.

Update Comss DNS addresses

https://adguard-dns.io/kb/ru/general/dns-providers/#comssru-dns

It seems that SDNS stamps are invalid, they don't work when you click "Add to AdGuard".
We should update these addresses.

Just in case, Comss addresses are here:
https://www.comss.ru/page.php?id=7315

Remove "beta testing" article

@jslawler commented on Tue Jan 03 2023

The AdGuard kb advertises the Private AdGuard DNS beta test, even though this has ended (for now?).

Should it still be there?

Yandex DNS: remove DNSCrypt, add DoH/DoT

Starting March 1, 2024, the DNSCrypt protocol will no longer be supported in Yandex DNS. We recommend reconfuguring your hardware and software to use the DoH/DoT protocols.

https://dns.yandex.com

Server info update (Snopyta DNS)

Snopyta Team is no longer offer DNS service.

Information about Snopyta DNS should be removed from the KB.

Link: https://adguard-dns.io/kb/general/dns-providers/#snopyta-dns

dns0

I would like to suggest the new DNS provider dns0.eu for the list of providers. It supports DoT and DoH and besides the standard configuration also provides a configuration for enhanced security as well as for families.

Revamp the known DNS providers doc

1. Change how ToC is generated:

toc_min_heading_level: 2
toc_max_heading_level: 4

2. There are many small personal resovlers which are not in their specific section.
3. Add "## Public Anycast Resolvers" section for big resolvers with nice IP addresses that run anycast network.
4. Add "## Regional Resolvers" section for smaller resolvers that are hosted in 1-2 regions and not worldwide.

## Public Anycast Resolvers
These are large-scale DNS resolvers that are distributed around the world. They use anycast routing to direct your DNS queries to the nearest data center.

• AdGuard DNS
• CleanBrowsing
• Comodo Secure DNS
• Neustar Recursive DNS
• Cisco OpenDNS
• Google DNS
• Cloudflare DNS
• Quad9 DNS
• Verisign Public DNS
• Dyn DNS
• Safe DNS
• Ali DNS
• CFIEC Public DNS
• Nawala Childprotection DNS
• 360 Secure DNS
• DNSPod Public DNS+
• Freenom World
• Strongarm DNS -- rename to DNSWatchGO, link https://www.watchguard.com/wgrd-products/dnswatchgo
• SafeSurfer DNS
• DeCloudUs DNS
• DNS.SB
• DNS Privacy
• DNSlify DNS
• NextDNS
• RethinkDNS
• ControlD
• Mullvad
• OpenBLD.net DNS

## Regional Resolvers
Regional DNS resolvers are typically focused on specific geographic regions, offering optimized performance for users in those areas. These might be run by non-profit organizations, local ISPs, or other entities.

• Yandex DNS
• SWITCH DNS
• SkyDNS RU
• Comss.one DNS
• CIRA Canadian Shield DNS
• OpenNIC DNS -- the IP addresses that are on our pages are dead, and yet the service itself is not. Update with 217.160.70.42, 2001:8d8:1801:86e7::1, mention that this is just one of the available servers, all can be found here: https://servers.opennic.org/
• DNS for Family
• CZ.NIC ODVR
• IIJ.JP DNS
• 114DNS
• Quad101
• OneDNS -- also link the website https://www.onedns.net/
• Applied Privacy DNS
• Fondation Restena DNS
• Digitale Gesellschaft DNS
• LibreDNS

## Small Personal Resolvers
These are DNS resolvers usually run by enthusiasts or small groups. They might not have the scale or redundancy of bigger players, but they often have a strong focus on privacy, transparency, or niche features.

• Privacy-First DNS
• OSZX DNS
• Lelux DNS
• Captnemo DNS
• DNS Forge
• fvz DNS
• FFMUC DNS
• ibksturm DNS
• AhaDNS
• Seby DNS
• Arapurayil
• Dandelion Sprout's Official DNS Server

4. Remove dead resolvers

• DNS.WATCH
• BlahDNS
• FreeDNS
• puntCAT DNS

Rendered web page partially broken

The description and title of ControlD in the DNS profiders page seems to be missing on the web page after being rendered

KnowledgeBaseDNS/docs/general/dns-providers.md

Lines 1047 to 1086 in ff9a6b8

	### RethinkDNS
	[RethinkDNS](https://www.rethinkdns.com/configure) provides DNS-over-HTTPS service running as Cloudflare Worker and DNS-over-TLS service running as Fly.io Worker with configurable blocklists.
	#### Unfiltered
	| Protocol | Address | |
	|----------------|----------------------------------------------------|----------------|
	|DNS-over-HTTPS|`https://basic.rethinkdns.com/`|[Add to AdGuard](sdns://AgcAAAAAAAAAAAAUYmFzaWMucmV0aGlua2Rucy5jb20BLw)|
	|DNS-over-TLS|`tls://max.rethinkdns.com`|[Add to AdGuard](sdns://AwcAAAAAAAAAAAASbWF4LnJldGhpbmtkbnMuY29t)|
	### ControlD
	[ControlD](https://controld.com/free-dns) is public DNS service which provides ads,malware, and social media blocking.
	#### Block malware
	| Protocol | Address | |
	|----------------|----------------------------------------------------|----------------|
	| DNS, IPv4 | `76.76.2.1` | [Add to AdGuard](sdns://AAcAAAAAAAAACTc2Ljc2LjIuMQ) |
	| DNS-over-HTTPS | `https://freedns.controld.com/p1` | [Add to AdGuard](sdns://AgcAAAAAAAAAH2h0dHBzOi8vZnJlZWRucy5jb250cm9sZC5jb20vcDEAAAA) |
	| DNS-over-TLS | `tls://p1.freedns.controld.com` | [Add to AdGuard](sdns://AwcAAAAAAAAAF3AxLmZyZWVkbnMuY29udHJvbGQuY29tAAA) |
	##### Block malware + ads
	| Protocol | Address | |
	|----------------|----------------------------------------------------|----------------|
	| DNS, IPv4 | `76.76.2.2` | [Add to AdGuard](sdns://AAcAAAAAAAAACTc2Ljc2LjIuMg) |
	| DNS-over-HTTPS | `https://freedns.controld.com/p2` | [Add to AdGuard](sdns://AgcAAAAAAAAAH2h0dHBzOi8vZnJlZWRucy5jb250cm9sZC5jb20vcDIAAAA) |
	| DNS-over-TLS | `tls://p2.freedns.controld.com` | [Add to AdGuard](sdns://AwcAAAAAAAAAF3AyLmZyZWVkbnMuY29udHJvbGQuY29tAAA) |
	##### Block malware + ads + social
	| Protocol | Address | |
	|----------------|----------------------------------------------------|----------------|
	| DNS, IPv4 | `76.76.2.3` | [Add to AdGuard](sdns://AAcAAAAAAAAACTc2Ljc2LjIuMw) |
	| DNS-over-HTTPS | `https://freedns.controld.com/p3` | [Add to AdGuard](sdns://AgcAAAAAAAAAH2h0dHBzOi8vZnJlZWRucy5jb250cm9sZC5jb20vcDMAAAA) |
	| DNS-over-TLS | `tls://p3.freedns.controld.com` | [Add to AdGuard](sdns://AwcAAAAAAAAAF3AzLmZyZWVkbnMuY29udHJvbGQuY29tAAA) |

you can add dnswarden to the known dns providers

https://dnswarden.com/index.html
it has generic dns filters and also a custom filter, all for free.

[Question] Should a question mark be used for these strings?

The following are used without question marks. So do these need to have question marks?

Screenshot 1

Screenshot 2

Screenshot 3

Update comss DNS server DNS-over-QUIC address

https://adguard-dns.io/kb/general/dns-providers/#comssone-dns
quic://dns.comss.one:784 address has been changed to quic://dns.comss.one:853
https://www.comss.ru/page.php?id=7315

Add a section for showing IP address to AdGuard DNS when using iCloud Private Relay

When using iCloud Private Relay AdGuard DNS' dashboard and associated AdGuard test pages will show that the user is not using AdGuard DNS.

Add a section to the AdGuard DNS kb suggesting that the user may want to "Show IP Address" to the AdGuard DNS website accurately show whether AdGuard DNS is in fact being used.

See here for more information.

Specifically look at the section headed "If a website doesn't work with Private Relay".

Comss DNS: address changed

Looks like they changed their addresses recently

DoH: https://dns.controld.com/comss
DoT: comss.dns.controld.com

Со временем прежние домены отключим, но об этом сообщим отдельно.

Local Yarn 1.22.19 update to 3.2.4 or latest yarn

"One moment though: please run the DNS KB locally and make sure it can be built properly (there're build instructions in the README). Openhack."

Typo error with CIRA Canadian Shield DNS - Family

Hello,
link: https://adguard-dns.io/kb/general/dns-providers/#cira-canadian-shield-dns
there is a typo error in the part "CIRA Canadian Shield DNS - Family".
DNS-over-TLS - Family | Hostname should be "tls://family.canadianshield.cira.ca"

bye Fred

add JupitrDNS to list of known providers

https://jupitrdns.com
Free provider that blocks ads, trackers and malware

Many guides on https://adguard-dns.io/en/public-dns.html are outdated, wrong, or missing

Presuming this is the correct repo to report problems with the guides:

• The "Nintendo" section should be renamed "Nintendo 3DS".
• No Nintendo 3DS version (nor Wii U for that matter) support IPv6 at all, so that part of the guide should be removed.
• Nintendo Switch doesn't support IPv6 either, so that part of the guide should be removed from the "Nintendo Switch" guide.
• Windows, primarily Windows 11 onwards, natively support DNS-over-HTTPS, so info about that should be added to the "Windows" section.
• I would be able to write a PS3 guide with relative ease on request.

• • I acknowledge that Epson printers and Yamaha surround receivers have so much different UIs between themselves, that writing any guides for those would not be possible.

add markdownlint to AdGuard DNS Knowledge base

let's add markdownlint like it was done in AdGuard VPN KB: AdguardTeam/KnowledgeBaseVPN#119

Mention OpenDNS SOA issues

See AdguardTeam/AdGuardHome#4471.

Apparently, OpenDNS's servers remove AUTHORITY sections from some responses, including NODATA ones, which makes caching such responses impossible. I'm not sure if there is a policy regarding documenting the quirks of particular DNS providers, but consider mentioning that fact.

Revamp the known DNS providers doc

1. Change how ToC is generated:

toc_min_heading_level: 2
toc_max_heading_level: 4

2. There are many small personal resovlers which are not in their specific section.
3. Add "## Public Anycast Resolvers" section for big resolvers with nice IP addresses that run anycast network.
4. Add "## Regional Resolvers" section for smaller resolvers that are hosted in 1-2 regions and not worldwide.

## Public Anycast Resolvers
These are large-scale DNS resolvers that are distributed around the world. They use anycast routing to direct your DNS queries to the nearest data center.

• AdGuard DNS
• CleanBrowsing
• Comodo Secure DNS
• Neustar Recursive DNS
• Cisco OpenDNS
• Google DNS
• Cloudflare DNS
• Quad9 DNS
• Verisign Public DNS
• Dyn DNS
• Safe DNS
• Ali DNS
• CFIEC Public DNS
• Nawala Childprotection DNS
• 360 Secure DNS
• DNSPod Public DNS+
• Freenom World
• Strongarm DNS -- rename to DNSWatchGO, link https://www.watchguard.com/wgrd-products/dnswatchgo
• SafeSurfer DNS
• DeCloudUs DNS
• DNS.SB
• DNS Privacy
• DNSlify DNS
• NextDNS
• RethinkDNS
• ControlD
• Mullvad
• OpenBLD.net DNS

## Regional Resolvers
Regional DNS resolvers are typically focused on specific geographic regions, offering optimized performance for users in those areas. These might be run by non-profit organizations, local ISPs, or other entities.

• Yandex DNS
• SWITCH DNS
• SkyDNS RU
• Comss.one DNS
• CIRA Canadian Shield DNS
• OpenNIC DNS -- the IP addresses that are on our pages are dead, and yet the service itself is not. Update with 217.160.70.42, 2001:8d8:1801:86e7::1, mention that this is just one of the available servers, all can be found here: https://servers.opennic.org/
• DNS for Family
• CZ.NIC ODVR
• IIJ.JP DNS
• 114DNS
• Quad101
• OneDNS -- also link the website https://www.onedns.net/
• Applied Privacy DNS
• Fondation Restena DNS
• Digitale Gesellschaft DNS
• LibreDNS

## Small Personal Resolvers
These are DNS resolvers usually run by enthusiasts or small groups. They might not have the scale or redundancy of bigger players, but they often have a strong focus on privacy, transparency, or niche features.

• Privacy-First DNS
• OSZX DNS
• Lelux DNS
• Captnemo DNS
• DNS Forge
• fvz DNS
• FFMUC DNS
• ibksturm DNS
• AhaDNS
• Seby DNS
• Arapurayil
• Dandelion Sprout's Official DNS Server

4. Remove dead resolvers

• DNS.WATCH
• BlahDNS
• FreeDNS
• puntCAT DNS