Setup guides: dnsdome on every device and router

The addresses you will need

dnsdome speaks four DNS transports. Plain DNS covers a whole network from the router and identifies you by your public IP address. The three encrypted transports carry a per-profile token in the hostname, so they work from any network, mobile data included, and need no IP allowlisting.

Plain DNS87.244.198.165 port 53, UDP and TCP. Your network's public IP must be on the profile's allowlist.

DNS-over-HTTPShttps://dns.dnsdome.com/dns-query/<token> shown on your profile page in the panel.

DNS-over-TLS / QUIC<token>.dns.dnsdome.com port 853, hostname only. Android "Private DNS", routers, Apple profiles.

Open the panel, pick a profile, and the Encrypted DNS card shows your real DoH and DoT addresses with copy buttons and a QR code. Treat them like a password: anyone who has the token can resolve through your profile and appears in your log.

Phones, computers and browsers

Android

Android 9+

Private DNS in two taps, or the dnsdome app with a one-switch VPN-style tunnel.

iOS / iPadOS

iPhone and iPad

Encrypted DNS through a configuration profile, or plain DNS per Wi-Fi network.

Windows

Windows 10 and 11

Set the resolver in Settings, and turn on DNS-over-HTTPS on Windows 11.

macOS

System Settings for plain DNS, a signed profile for system-wide DoH or DoT.

Linux

NetworkManager, systemd-resolved with DNS-over-TLS, and a plain resolv.conf.

Browsers

Firefox, Chrome, Edge, Brave

Custom DNS-over-HTTPS inside the browser, no system changes needed.

Routers and firewalls

Setting DNS on the router covers every device behind it at once, including smart TVs and IoT gear that cannot run an app. Add the router's public WAN IP to your profile's allowlist first.

RouterOS

MikroTik

Upstream DoH, DHCP hand-out, and a redirect rule that catches hard-coded DNS.

OpenWrt

dnsmasq forwarding, or the https-dns-proxy package for encrypted upstream.

BSD firewalls

pfSense and OPNsense

Unbound in forwarding mode with DNS-over-TLS to your profile hostname.

Ubiquiti

UniFi

WAN DNS and per-network DHCP DNS in the UniFi Network application.

AVM

Fritz!Box

DNS-over-TLS upstream on FRITZ!OS 7.20 and newer.

Generic

Any other router

The three settings that exist on every router, and how to verify it worked.

Check that it works

Open the panel, then visit a domain your profile blocks. With the Ads & Tracking category on, doubleclick.net is a reliable test. The query should show as blocked in your log within a minute. If nothing is being filtered, the most common cause is that your public IP is not on the allowlist, or a second DNS server is configured as a fallback and answers instead.

Do I need to install anything on each device?

No. Point the router at dnsdome once and every device on that network is covered. Install the Android app or configure Private DNS only for phones that leave the house.

Why is there a token in the encrypted hostname?

Encrypted DNS arrives from any IP, so the source address cannot identify your profile. The token does that instead. Every profile, and every device you add to it, gets its own token, and you can revoke one without touching the others.

What if my public IP changes?

Plain DNS stops being answered until you update the allowlist. Home connections often get a new IP after a router reboot. Use the encrypted transports on the router if it supports them, or add the new IP in the panel.