Encrypted DNS over HTTPS, TLS & QUIC

DNS, in a better light.

LichtDNS is a private, fully recursive resolver. It blocks ads, trackers and malware, verifies every signature, and forgets you the moment it answers.

HTTPS https://dns.lichtdns.com/dns-query
TLS dns.lichtdns.com 853/tcp
QUIC dns.lichtdns.com 853/udp
Set up your device What’s different
Inside a query
Answered, then forgotten. Nothing about it is written down.

Encrypted, or not at all.

There is no plain DNS on port 53. Every query to LichtDNS travels inside HTTPS, TLS or QUIC, so your network provider can’t read it or rewrite it.

DNS-over-HTTPS · 443

HTTPS

Looks like any other web traffic. Works in browsers, on Windows, iPhone and Mac, and through most firewalls.

Best forBrowsers, Apple devices, Windows

DNS-over-TLS · 853

TLS

A dedicated encrypted channel for DNS. It’s what Android’s Private DNS and most routers speak natively.

Best forAndroid, Linux, routers

DNS-over-QUIC · 853

QUIC

The newest of the three. Fast handshakes, no head-of-line blocking, and it survives switching networks.

Best forAdGuard, dnsproxy, newer clients

Features

Private by design.
Not by promise.

Most of what makes LichtDNS private is what it doesn’t do: keep logs, share your subnet, or hand your queries to another provider.

No query logs. No IP retention.

We answer your question and let it go. LichtDNS keeps no record of the names you look up, and none of the IP addresses they came from.

0 queries stored
0 IP addresses kept

No EDNS Client-Subnet

Many resolvers pass part of your IP address on to every website’s nameserver. LichtDNS never does, so your network and rough location stay private.

Our own recursive resolver

No Google, Cloudflare or Quad9 upstream. LichtDNS runs its own Unbound resolver, which walks the DNS tree from the root servers down, so no third party ever sees your queries.

DNSSEC validated

Signed answers are checked against the chain of trust all the way to the root. Forged or tampered records are rejected before they reach you.

CNAME cloaking, uncloaked

Trackers hide behind first-party names like metrics.example.com. We follow the entire CNAME chain and block it if it ends at a tracker.

Blocks ads, trackers and malware

Curated, openly published blocklists stop ads, tracking and malicious domains for every app on your device, not just the browser.

See the blocklists

OpenNIC

Community-run top-level domains resolve right alongside the regular internet.

.eth via ENS

Ethereum Name Service domains open in any browser, with no extension to install.

How it works

The life of a query.

Five steps between you typing a name and your device getting an answer.

  1. 01

    Sealed

    Your device sends the question inside HTTPS, TLS or QUIC. Your network only sees that you’re talking to LichtDNS.

  2. 02

    Resolved from the root

    No upstream provider. We ask the root servers, then the TLD, then the domain’s own nameservers, without attaching your subnet.

  3. 03

    Verified

    DNSSEC signatures are checked up the chain of trust. An answer that fails validation is never returned.

  4. 04

    Filtered

    The name, and every CNAME it points through, is checked against the blocklists. Ads, trackers and malware get no address.

  5. 05

    Forgotten

    The answer goes back to you. The question isn’t written down, and neither is your IP address.

Setup

Switch on the light.

Pick your platform. Most take under a minute, and nothing needs installing.

Blocklists

Filtered in the open.

These are the lists LichtDNS currently filters against. Each is maintained publicly, so you can see exactly what gets blocked.

This selection may change over time as lists are added, replaced or retired. Each list is also kept up to date by its own maintainers, so what it blocks changes too.

About

A personal project, built on open source.

LichtDNS is a personal project, not a company. It runs two well-known open-source DNS servers, set up with privacy first.

Your device

Encryption & filtering

AdGuard Home

Accepts your encrypted query, checks it and every CNAME behind it against the blocklists, and answers blocked names on the spot. Query logging is off.

github.com/AdguardTeam

Recursive resolver

Unbound

Resolves everything else from the root servers down and validates DNSSEC. It never forwards to another provider and never sends your subnet.

nlnetlabs.nl
Root, TLD & authoritative servers

FAQ

Questions, answered.

Why is there no regular DNS on port 53?

Plain DNS is unencrypted. Anyone between you and the resolver, like your ISP or a café’s Wi-Fi, can read which sites you visit and even change the answers. By only offering encrypted protocols, LichtDNS can’t be used insecurely by accident.

Which protocol should I use?

Use whatever your device supports natively. On Android, that’s DNS-over-TLS through Private DNS. On iPhone, Mac, Windows and in browsers, use DNS-over-HTTPS. If your client supports DNS-over-QUIC, it’s usually the fastest, especially on mobile networks.

What does “own recursive resolver” mean?

Many DNS services are a thin layer over a bigger provider and pass every query upstream. LichtDNS runs its own Unbound resolver, which looks up each name itself, starting at the DNS root, so your queries are never handed to Google, Cloudflare or anyone else.

What is EDNS Client-Subnet, and why don’t you send it?

ECS attaches a piece of your IP address to queries sent to a website’s nameservers, so CDNs can pick a server near you. It also tells every one of those nameservers roughly where you are. We leave it out. Occasionally a CDN might pick a slightly farther server; your location stays yours.

What is CNAME cloaking?

To dodge blockers, some trackers ask websites to create a subdomain like metrics.example.com that quietly points (via a CNAME record) to the tracker’s servers. It looks first-party, so simple blocklists miss it. LichtDNS checks every name in the CNAME chain, so the tracker is blocked no matter what it’s called on the surface.

What are OpenNIC and .eth domains?

OpenNIC is a community-run DNS root with its own top-level domains, such as .geek, .libre and .oss. ENS is a naming system on Ethereum that powers .eth names. LichtDNS resolves both alongside normal domains, so they open like any other site.

Can I still use DNSSEC-unsigned domains?

Yes. Most domains aren’t signed yet, and they resolve normally. Validation only rejects answers that are signed but whose signatures don’t check out, which is a sign of tampering or a broken setup.

Less tracking.
More light.

One address. Every app on your device, encrypted and filtered.

dns.lichtdns.com
Set up your device