A Survey of Public DNS over HTTPS Servers

In FDNS project we maintain a long list of non-logging and uncensored DoH servers. We call it The Little People Network since these are mostly non-corporate servers.

With new servers coming and going, we developed several testing tools to keep the list up to date. In this blog I will introduce one of them, and run it over this large DoH network. The information can help the user choose a DoH service based on multiple criteria: speed, bandwidth, TLS version etc. It can also help a server administrator optimize the service or debug various problems that might arise during operation.

Highlights

Don’t worry about speed, you have a bandwidth problem
HTTP headers, network traces, inactivity timer
H2O good, nginx bad
The Commercials are coming

CIRA

I get a heavy download going on my home network, in an attempt to simulate some normal network conditions. Then, I start testing CIRA Canadian Shield DoH service:

$ fdns --test-server=cira --details

   Tags: non-profit, Ontario, Quebec, BritishColumbia, EastAmerica, WestAmerica
   URL: https://private.canadianshield.cira.ca/dns-query
   Bootstrap IP address: 149.112.121.10
   Port: 443
   TLSv1.3, ALPN h2, SNI no

   HTTP Header:
-----------------------------
|  :status:  200
|  content-type:   application/dns-message
|  content-length:   165
-----------------------------
   SSL/TLS connection: 452.23 ms

   Network Trace:
-----> rx 268 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA  (end stream)

   DoH query average: 59.35 ms
   Header uncompressed | compressed | ratio:  71 | 3 | 23.67:1
   DoH/Do53 bandwidth ratio: 1.41
   Keepalive: 7 seconds

We print some geotags from our database and some connection information (TLSv1.3 etc). As we connect, we send 6 queries for example.com domain, calculating the average response time. Notice the huge connect time (452.23 ms) and the small average response (59.35 ms).

Finally, we compare the bandwidth required by this service with the bandwidth required by a regular unencrypted DNS service (Do53) running on the same server. For this we look at the original HTTP2 header (71 bytes), trimmed down by HPACK compression to only 3 bytes. The header is sent out with DNS data in a single TCP/IP packet. Simple byte counting and some basic arithmetics tell us DoH uses 41% more bandwidth than a regular unencrypted DNS service (DoH/Do53 ratio of 1.41).

Bandwidth

Here is an interesting use case. I start streaming a movie as I already have the download going. This pretty much fills up my Internet pipe. Then, I run the CIRA test again:

$ fdns --test-server=cira

   Tags: non-profit, Ontario, Quebec, BritishColumbia, EastAmerica, WestAmerica
   SSL/TLS connection: 7089.60 ms
   DoH query average: 1490.41 ms
   DoH/Do53 bandwidth ratio: 1.41
   Keepalive: 7 seconds

The connection time and the response average went through the roof! Not a problem for a test like this, but in the real world DoH client drops SSL and starts sending DNS requests in clear. This is called the fallback mode. As soon as you fill up your Internet pipe, the fallback mode kicks in, leaking unencrypted DNS traffic. In a normal day, out of a block of 3000 DNS queries I usually get about 30 or so sent in clear.

Re-establishing a DoH connection is very expensive and highly influenced by the network load. You will definitely notice a 7089.60 ms delay during your browsing, but more likely your browser will get bored waiting and go straight to fallback.

User inactivity is another problem. DoH servers detect it, and close the SSL connection after a certain time. To keep it open, Firefox sends a short keepalive message every 60 seconds. As long as the keepalive time is shorter than server’s inactivity timer, everything is fine.

A lot of servers are running inactivity timers smaller than 60 seconds. By the time Firefox sends the keepalive, the connection is already gone. One such server is CIRA, with an inactivity timer of 10 seconds. In FDNS we configure the keepalive for each specific server (7 seconds in CIRA’s case).

Let’s take a look at some of the more established DoH players.

Cloudflare

It was long rumored that Cloudflare hides a top secret HTML link in its military-grade encrypted headers. Here it is:

$ fdns --test-server=cloudflare --details

   Tags: anycast, EastAmerica, WestAmerica, AsiaPacific, Europe
   URL: https://cloudflare-dns.com/dns-query
   Bootstrap IP address: 1.1.1.1
   Port: 443
   TLSv1.3, ALPN h2, SNI no

   HTTP Header:
-----------------------------
|  (HPACK dynamic table size: 4096)
|  :status:  200
|  date:   Wed, 19 Aug 2020 11:19:48 GMT
|  content-type:   application/dns-message
|  content-length:   88
|  access-control-allow-origin:   *
|  cf-request-id:  04a80b66440000ebf856928200000001
|  expect-ct:  max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
|  server:   cloudflare
|  cf-ray:  5c537b506bd6ebf8-BOS
-----------------------------
   SSL/TLS connection: 329.63 ms

   Network Trace:
-----> rx 232 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA
-----> rx 55 bytes: IP + TCP + TLS + H2-DATA  (end stream)

   DoH query average: 60.13 ms
   Header uncompressed | compressed | ratio:  332 | 53 | 6.26:1
   DoH/Do53 bandwidth ratio: 2.19
   Keepalive: 350 to 390 seconds

Large header of 332 bytes, compressed down to 53 bytes, a far cry from CIRA’s 3 bytes. Most information is not required, and it only increases the already large DoH packets. Particularly date field is problematic because it changes all the time and will compress poorly.

On the network trace we notice a second DoH packet. You can set the end of stream flag in the previous packet and get rid of this one. Together with the large header, this results in a lackluster DoH/Do53 ratio of 2.19. It means it requires more than double the bandwidth a regular DNS service would need, and sometimes will translate into a glorious fallback mode experience for the user.

Huge inactivity timer: 400 seconds! In FDNS we run our keepalive in the 350-390 seconds range. No drops to fallback are expected due to inactivity. Moving on.

Quad9

Not to be outdone, Quad9 hides not one, but two military-grade encrypted links:

$ fdns --test-server=quad9 --details

   Tags: anycast, security, EastAmerica, WestAmerica, AsiaPacific, Europe
   URL: https://dns.quad9.net/dns-query
   Bootstrap IP address: 9.9.9.9
   Port: 5053
   TLSv1.2, ALPN h2, SNI no

   HTTP Header:
-----------------------------
|  (HPACK dynamic table size: 4096)
|  :status:  200
|  access-control-allow-headers:  Content-Type
|  access-control-allow-methods:  GET, HEAD, OPTIONS, POST
|  access-control-allow-origin:   *
|  access-control-max-age:  3600
|  cache-control:   private, max-age=21349
|  content-type:   application/dns-message
|  date:   Wed, 19 Aug 2020 11:22:06 GMT
|  expires:   Wed, 19 Aug 2020 17:17:55 GMT
|  last-modified:   Wed, 19 Aug 2020 11:22:06 GMT
|  server:   doh-server/2.0.1.q9.6 (+https://github.com/m13253/dns-over-https)
|  server-id:  res100.lga
|  vary:   Accept
|  x-powered-by:  doh-server/2.0.1.q9.6 (+https://github.com/m13253/dns-over-https)
|  content-length:   126
-----------------------------
   SSL/TLS connection: 354.27 ms

   Network Trace:
-----> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
-----> rx 73 bytes: IP + TCP + TLS + H2-HEADERS
-----> rx 207 bytes: IP + TCP + TLS + H2-DATA  (end stream)

   DoH query average: 61.85 ms
   Header uncompressed | compressed | ratio:  576 | 42 | 13.71:1
   DoH/Do53 bandwidth ratio: 2.77
   Keepalive: 550 to 590 seconds

access-control-* are Cross Origin Resource Sharing headers, a mechanism to let a site request resources from a different site. It applies only to browsers, you can remove them for DoH.

Down in the network trace, the IP/TCP/TLS overhead starts building up, drowning everything else. What you want is a single packet going out, with HTTP header, DNS data, and end of stream flag, something like this:

-----> rx 268 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA  (end stream)

Inactivity timer beyond 10 minutes. EXCELLENT!

Google

We don’t list Google in FDNS, but it is worth taking a look. I’ll save you the trouble of reading the header – all nursery rhymes and jingle bells – and jump directly to the network trace:

$ fdns --test-server=https://dns.google/dns-query --details
[...]
   SSL/TLS connection: 384.01 ms
   Network Trace:
-----> rx 65 bytes: IP + TCP + TLS + H2-PING 
<----- tx 65 bytes: IP + TCP + TLS + H2-PING  (end stream)
-----> rx 118 bytes: IP + TCP + TLS + H2-HEADERS 
-----> rx 148 bytes: IP + TCP + TLS + H2-DATA 
-----> rx 55 bytes: IP + TCP + TLS + H2-DATA  (end stream)

   DoH query average: 78.52 ms
   Header uncompressed | compressed | ratio:  534 | 50 | 10.68:1
   DoH/Do53 bandwidth ratio: 2.99
   Keepalive: 190 to 230 seconds

We are already at three times (2.99) the regular DNS bandwidth, mainly because the large number of independent TCP/IP packets. Why would you ping the user? That’s another full round trip, pushing the query average to 78.52 ms.

Note: I’m not really set up to measure speed with this tool – 6 requests for example.com, hopefully the first one caches the response on the server side. The most I can hope to measure is the entry leg into DoH network.

Very good inactivity timer (around 4 minutes).

Adguard

Say hello to Adguard, a major non-logging/non-censoring anycast network:

$ fdns --test-server=adguard --details

   Tags: anycast, adblocker, EastAmerica, WestAmerica, AsiaPacific, Europe
   URL: https://dns.adguard.com/dns-query
   Bootstrap IP address: 176.103.130.130
   Port: 443
   TLSv1.3, ALPN h2, SNI no

   HTTP Header:
-----------------------------
|  (HPACK dynamic table size: 0)
|  :status:  200
|  server:   nginx
|  date:   Wed, 19 Aug 2020 11:19:06 GMT
|  content-type:   application/dns-message
|  content-length:   115
|  cache-control:  max-age=3600.000000
-----------------------------
   SSL/TLS connection: 353.23 ms

   Network Trace:
-----> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
-----> rx 299 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA  (end stream)

   DoH query average: 57.93 ms
   Header uncompressed | compressed | ratio:  156 | 79 | 1.97:1
   DoH/Do53 bandwidth ratio: 2.51
   Keepalive: 140 to 170 seconds

Small header, decent network trace, but very bad header compression ratio of 1.97:1. Apparently HTTP2 header compression is broken in nginx. We see this on all nginx setups. That’s about half the DoH servers on the planet.

Note: the problem also affects the regular website traffic. The impact in this case is minimal, as headers amount to less than 1% of the total web traffic.

Very good inactivity timer, around 3 minutes.

Test Results

Let me say upfront that all servers better than Cloudflare are fantastic, while the rest are awesome. The servers are ranked by bandwidth, small is better. Click ▷ Details for more information, including the URL you can use to configure your DoH client.

I added to the lineup several commercial servers for comparison. These are big corporations, some of them well known for their abysmal privacy record. We don’t necessarily recommend them.

cira

Tags: non-profit, Ontario, Quebec, BritishColumbia, EastAmerica, WestAmerica
URL: https://private.canadianshield.cira.ca/dns-query
Bootstrap IP address: 149.112.121.10
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 268 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 71 | 3 | 23.67:1

DoH/Do53 1.41, keepalive 7 seconds
cox (commercial)

URL: https://dohdot.coxlab.net/dns-query
Bootstrap IP address: 174.68.248.77
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 181 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 70 | 3 | 23.33:1

DoH/Do53 1.53, keepalive 7 seconds
uncensoreddns

Tags: Denmark, Europe
URL: https://anycast.censurfridns.dk/dns-query
Bootstrap IP address: 91.239.100.100
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 318 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 156 | 22 | 7.09:1

DoH/Do53 1.59, keepalive 20 to 25 seconds , server h2o/dnsdist
comcast (commercial)

URL: https://doh.xfinity.com/dns-query
Bootstrap IP address: 75.75.77.99
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 65 bytes: IP + TCP + TLS + H2-HEADERS
—–> rx 253 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 71 | 8 | 8.88:1

DoH/Do53 1.67, keepalive 550 to 590 seconds
bt (commercial)

URL: https://doh.bt.com/dns-query
Bootstrap IP address: 81.130.111.250, 81.130.111.251
Port: 443
TLSv1.2, ALPN h2, SNI no
—–> rx 169 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 126 | 12 | 10.50:1

DoH/Do53 1.81, keepalive 20 to 25 seconds , server h2o/dnsdist
hurricane-electric (commercial)

URL: https://ordns.he.net/dns-query
Bootstrap IP address: 74.82.42.42
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 169 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 126 | 12 | 10.50:1

DoH/Do53 1.81, keepalive 140 to 170 seconds , server h2o/dnsdist
dt (commercial)

URL: https://dns.t53.de/dns-query
Bootstrap IP address: 80.156.145.201
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 169 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 118 | 16 | 7.38:1

DoH/Do53 1.84, keepalive 20 to 25 seconds , server DoH
ibuki

Tags: California, WestAmerica
URL: https://ibuki.cgnat.net/dns-query
Bootstrap IP address: 35.198.2.76
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 169 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 126 | 16 | 7.88:1

DoH/Do53 1.85, keepalive 20 to 25 seconds , server h2o/dnsdist
powerdns

Tags: Netherlands, Europe
URL: https://doh.powerdns.org/dns-query
Bootstrap IP address: 136.144.215.158
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 169 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 126 | 16 | 7.88:1

DoH/Do53 1.85, keepalive 20 to 25 seconds , server h2o/dnsdist
telefonica (commercial)

URL: https://doh-beta.e-paths.com/
Bootstrap IP address: 34.255.130.171
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 169 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 126 | 16 | 7.88:1

DoH/Do53 1.85, keepalive 20 to 25 seconds , server h2o/dnsdist
a-and-a

Tags: UK, Europe
URL: https://dns.aa.net.uk/dns-query
Bootstrap IP address: 217.169.20.23
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 169 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 135 | 16 | 8.44:1

DoH/Do53 1.86, keepalive 20 to 25 seconds , server Andrews
appliedprivacy

Tags: non-profit, Austria, Europe
URL: https://doh.applied-privacy.net/query
Bootstrap IP address: 146.255.56.98
Port: 443
TLSv1.3, ALPN h2, SNI yes
—–> rx 171 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 151 | 15 | 10.07:1

DoH/Do53 1.86, keepalive 20 to 25 seconds , server dnsdist
faelix-ch

Tags: Switzerland, Europe
URL: https://rdns.faelix.net/
Bootstrap IP address: 185.134.197.54
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 171 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 155 | 15 | 10.33:1

DoH/Do53 1.86, keepalive 20 to 25 seconds , server h2o/dnsdist
ryan-palmer

Tags: UK, Europe
URL: https://ns1.ryan-palmer.com/dns-query
Bootstrap IP address: 68.183.253.200
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 171 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 155 | 15 | 10.33:1

DoH/Do53 1.86, keepalive 20 to 25 seconds , server h2o/dnsdist
commons-host

Tags: geocast, EastAmerica, WestAmerica, AsiaPacific, Europe
URL: https://commons.host/
Bootstrap IP address: 172.104.13.242
Port: 443
TLSv1.3, ALPN h2, SNI yes
—–> rx 172 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA
—–> rx 55 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 224 | 14 | 16.00:1

DoH/Do53 1.87, keepalive 250 to 290 seconds , server commonshost
dnslify

Tags: EastAmerica, WestAmerica, NY, California
URL: https://doh.dnslify.com/dns-query
Bootstrap IP address: 185.235.81.1
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 171 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 170 | 17 | 10.00:1

DoH/Do53 1.92, keepalive 20 to 25 seconds , server h2o/dnsdist
faelix-uk

Tags: UK, Europe
URL: https://rdns.faelix.net/
Bootstrap IP address: 46.227.200.54
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 211 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 155 | 21 | 7.38:1

DoH/Do53 1.92, keepalive 20 to 25 seconds , server h2o/dnsdist
switch

Tags: non-profit, Switzerland, Europe
URL: https://dns.switch.ch/dns-query
Bootstrap IP address: 130.59.31.248
Port: 443
TLSv1.2, ALPN h2, SNI no
—–> rx 211 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 155 | 21 | 7.38:1

DoH/Do53 1.92, keepalive 20 to 25 seconds , server h2o/dnsdist
dnshome

Tags: Germany, Europe
URL: https://dns.dnshome.de/dns-query
Bootstrap IP address: 185.233.106.232
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 171 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 129 | 23 | 5.61:1

DoH/Do53 1.93, keepalive 20 to 25 seconds , server h2o/dnsdist
unbound project (GitHub)

URL: https://127.0.0.1/dns-query
Bootstrap IP address: 127.0.0.1
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 64 bytes: IP + TCP + TLS + H2-HEADERS
—–> rx 148 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 70 | 7 | 10.00:1

DoH/Do53 2.05, keepalive 20 to 25 seconds , server unbound
arapurayil

Tags: India, AsiaPacific
URL: https://dns.arapurayil.com/dns-query
Bootstrap IP address: 3.7.156.128
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 210 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 250 | 27 | 9.26:1

DoH/Do53 2.09, keepalive 10 to 15 seconds , server DNS
cloudflare

Tags: anycast, EastAmerica, WestAmerica, AsiaPacific, Europe
URL: https://cloudflare-dns.com/dns-query
Bootstrap IP address: 1.1.1.1
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 232 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA
—–> rx 55 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 332 | 53 | 6.26:1

DoH/Do53 2.19, keepalive 350 to 390 seconds , server cloudflare
dnscrypt-ca

Tags: Quebec, EastAmerica
URL: https://dns1.dnscrypt.ca:453/dns-query
Bootstrap IP address: 167.114.220.125
Port: 453
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 60 bytes: IP + TCP + TLS + H2-HEADERS
—–> rx 193 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 107 | 7 | 15.29:1

DoH/Do53 2.27, keepalive 550 to 590 seconds
rumpelsepp

Tags: Germany, Europe
URL: https://rumpelsepp.org/dns-query
Bootstrap IP address: 116.203.179.248
Port: 443
TLSv1.3, ALPN h2, SNI yes
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 64 bytes: IP + TCP + TLS + H2-HEADERS
—–> rx 214 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 184 | 18 | 10.22:1

DoH/Do53 2.28, keepalive 550 to 590 seconds , server Caddy
bortzmeyer

Tags: France, Europe
URL: https://doh.bortzmeyer.fr/
Bootstrap IP address: 193.70.85.11
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 184 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 221 | 13 | 17.00:1

DoH/Do53 2.42, keepalive 20 to 25 seconds , server h2o/dnsdist
tiarap

Tags: geocast, EastAmerica, WestAmerica, AsiaPacific, Europe
URL: https://doh.tiarap.org/dns-query
Bootstrap IP address: 104.27.150.170, 172.67.182.106, 104.27.151.170
Port: 443
TLSv1.3, ALPN h2, SNI yes
—–> rx 291 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA
—–> rx 55 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 647 | 108 | 5.99:1

DoH/Do53 2.46, keepalive 350 to 390 seconds , server cloudflare
adguard

Tags: anycast, adblocker, EastAmerica, WestAmerica, AsiaPacific, Europe
URL: https://dns.adguard.com/dns-query
Bootstrap IP address: 176.103.130.130
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 299 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 156 | 79 | 1.97:1

DoH/Do53 2.51, keepalive 140 to 170 seconds , server nginx
adhole

Tags: UK, Europe, adblocker
URL: https://uk.adhole.org/dns-query
Bootstrap IP address: 5.253.114.91
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 63 bytes: IP + TCP + TLS + H2-HEADERS
—–> rx 161 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 157 | 13 | 12.08:1

DoH/Do53 2.60, keepalive 550 to 590 seconds , server AdGuard
brahmaworld

Tags: Germany, Europe, adblocker
URL: https://dns.brahma.world/dns-query
Bootstrap IP address: 94.237.80.211
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 63 bytes: IP + TCP + TLS + H2-HEADERS
—–> rx 161 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 157 | 13 | 12.08:1

DoH/Do53 2.60, keepalive 550 to 590 seconds , server AdGuard
commsone

Tags: Moscow, Russia, Europe, adblocker
URL: https://dns.comss.one/dns-query
Bootstrap IP address: 92.38.152.163
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 63 bytes: IP + TCP + TLS + H2-HEADERS
—–> rx 161 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 157 | 13 | 12.08:1

DoH/Do53 2.60, keepalive 550 to 590 seconds , server AdGuard
bravedns

Tags: geocast, EastAmerica, WestAmerica, AsiaPacific, Europe
URL: https://free.bravedns.com/dns-query
Bootstrap IP address: 104.26.7.92, 172.67.70.173, 104.26.6.92
Port: 443
TLSv1.3, ALPN h2, SNI yes
—–> rx 239 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA
—–> rx 55 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 726 | 78 | 9.31:1

DoH/Do53 2.68, keepalive 350 to 390 seconds , server cloudflare
nextdns

Tags: anycast, EastAmerica, WestAmerica, AsiaPacific, Europe
URL: https://trr.dns.nextdns.io/
Bootstrap IP address: 45.90.30.0
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 61 bytes: IP + TCP + TLS + H2-HEADERS
—–> rx 148 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 178 | 8 | 22.25:1

DoH/Do53 2.73, keepalive 20 to 25 seconds
usableprivacy

Tags: Austria, Europe, adblocker
URL: https://adfree.usableprivacy.net/
Bootstrap IP address: 149.154.153.153
Port: 443
TLSv1.3, ALPN h2, SNI yes
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 61 bytes: IP + TCP + TLS + H2-HEADERS
—–> rx 148 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 126 | 12 | 10.50:1

DoH/Do53 2.73, keepalive 140 to 170 seconds , server h2o/dnsdist
at&t (commercial)

URL: https://dohtrial.att.net/dns-query
Bootstrap IP address: 40.76.112.230, 13.89.120.251
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 228 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 127 | 58 | 2.19:1

DoH/Do53 2.74, keepalive 30 to 50 seconds , server nginx/1.18.0
ffmuc

Tags: Germany, Europe
URL: https://doh.ffmuc.net/dns-query
Bootstrap IP address: 195.30.94.28
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 249 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA
—–> rx 55 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 149 | 75 | 1.99:1

DoH/Do53 2.74, keepalive 140 to 170 seconds , server nginx
iriseden

Tags: France, Europe, OpenNIC
URL: https://ns1.iriseden.fr/dns-query
Bootstrap IP address: 62.210.177.189
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 834 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 500 | 343 | 1.46:1

DoH/Do53 2.75, keepalive 140 to 170 seconds , server nginx/1.14.2
dns-sb

Tags: geocast, Estonia, Germany, Europe
URL: https://doh.dns.sb/dns-query
Bootstrap IP address: 104.18.48.136, 172.67.192.75, 104.18.49.136
Port: 443
TLSv1.3, ALPN h2, SNI yes
—–> rx 438 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA
—–> rx 55 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 1101 | 122 | 9.02:1

DoH/Do53 2.77, keepalive 250 to 290 seconds , server cloudflare
quad9

Tags: anycast, security, EastAmerica, WestAmerica, AsiaPacific, Europe
URL: https://dns.quad9.net/dns-query
Bootstrap IP address: 9.9.9.9
Port: 5053
TLSv1.2, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 73 bytes: IP + TCP + TLS + H2-HEADERS
—–> rx 207 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 576 | 42 | 13.71:1

DoH/Do53 2.77, keepalive 550 to 590 seconds , server doh-server/2.0.1.q9.6
defaultroutes

Tags: Germany, Europe
URL: https://doh.defaultroutes.de/dns-query
Bootstrap IP address: 5.45.107.88
Port: 443
TLSv1.3, ALPN h2, SNI yes
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 175 bytes: IP + TCP + TLS + H2-HEADERS
—–> rx 207 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 410 | 78 | 5.26:1

DoH/Do53 2.86, keepalive 250 to 290 seconds , server DNS-over-HTTPS/1.3.11
pi-dns

Tags: geocast, EastAmerica, WestAmerica, AsiaPacific, Europe
URL: https://doh.pi-dns.com/dns-query
Bootstrap IP address: 104.27.162.107, 104.27.163.107, 172.67.199.230
Port: 443
TLSv1.3, ALPN h2, SNI yes
—–> rx 481 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA
—–> rx 55 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 1071 | 126 | 8.50:1

DoH/Do53 2.86, keepalive 350 to 390 seconds , server cloudflare
opendns (commercial)

URL: https://doh.opendns.com/dns-query
Bootstrap IP address: 146.112.41.2
Port: 443
TLSv1.2, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 247 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 147 | 73 | 2.01:1

DoH/Do53 2.92, keepalive 140 to 170 seconds , server nginx
google (commercial)

URL: https://dns.google/dns-query
Bootstrap IP address: 8.8.4.4, 8.8.8.8
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 65 bytes: IP + TCP + TLS + H2-PING
<—– tx 65 bytes: IP + TCP + TLS + H2-PING (end stream)
—–> rx 118 bytes: IP + TCP + TLS + H2-HEADERS
—–> rx 148 bytes: IP + TCP + TLS + H2-DATA
—–> rx 55 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 534 | 50 | 10.68:1

DoH/Do53 2.99, keepalive 190 to 230 seconds , server HTTP
wil.cloud

Tags: Czechia, Europe, OpenNIC
URL: https://dns-2.wil.cloud/dns-query
Bootstrap IP address: 51.254.25.115
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 955 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 636 | 444 | 1.43:1

DoH/Do53 3.12, keepalive 140 to 170 seconds , server nginx/1.18.0
aaflalo

Tags: NY, EastAmerica, adblocker
URL: https://dns-nyc.aaflalo.me/dns-query
Bootstrap IP address: 168.235.81.167
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 347 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 531 | 145 | 3.66:1

DoH/Do53 3.13, keepalive 80 to 110 seconds , server nginx/1.18.0
cznic

Tags: Czechia, Europe
URL: https://odvr.nic.cz/doh
Bootstrap IP address: 185.43.135.1
Port: 443
TLSv1.2, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 61 bytes: IP + TCP + TLS + H2-HEADERS
—–> rx 148 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 130 | 7 | 18.57:1

DoH/Do53 3.23, keepalive 7 seconds
cleanbrowsing

Tags: anycast, security, EastAmerica, WestAmerica, AsiaPacific, Europe
URL: https://doh.cleanbrowsing.org/doh/security-filter
Bootstrap IP address: 185.228.168.168
Port: 443
TLSv1.2, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 286 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 190 | 106 | 1.79:1

DoH/Do53 3.30, keepalive 140 to 170 seconds , server nginx
ibksturm

Tags: Switzerland, Europe, OpenNIC
URL: https://ibksturm.synology.me/dns-query
Bootstrap IP address: 85.5.93.230
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 372 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA
—–> rx 55 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 285 | 178 | 1.60:1

DoH/Do53 3.66, keepalive 550 to 590 seconds , server nginx/1.18.0
seby

Tags: Australia, AsiaPacific, OpenNIC
URL: https://dns.seby.io/dns-query
Bootstrap IP address: 45.76.113.31
Port: 8443
TLSv1.3, ALPN h2, SNI no
—–> rx 76 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE + H2-WINDOW-UPDATE
—–> rx 593 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 444 | 304 | 1.46:1

DoH/Do53 3.68, keepalive 20 to 25 seconds
iij (commercial)

URL: https://public.dns.iij.jp/dns-query
Bootstrap IP address: 103.2.57.6, 103.2.57.5
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 483 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 359 | 232 | 1.55:1

DoH/Do53 3.80, keepalive 140 to 170 seconds , server nginx
digital-society

Tags: non-profit, Switzerland, Europe
URL: https://dns.digitale-gesellschaft.ch/dns-query
Bootstrap IP address: 185.95.218.42
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 594 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA
—–> rx 55 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 464 | 314 | 1.48:1

DoH/Do53 3.90, keepalive 140 to 170 seconds , server nginx/1.14.0
libredns

Tags: Germany, Europe, OpenNIC
URL: https://doh.libredns.gr/dns-query
Bootstrap IP address: 116.202.176.26
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 363 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 272 | 170 | 1.60:1

DoH/Do53 4.03, keepalive 140 to 170 seconds , server nginx/1.14.0
twnic

Tags: Taiwan, AsiaPacific
URL: https://dns.twnic.tw/dns-query
Bootstrap IP address: 210.17.9.228
Port: 443
TLSv1.2, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 642 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 499 | 343 | 1.45:1

DoH/Do53 4.25, keepalive 80 to 110 seconds , server nginx/1.12.2
boothlabs

Tags: Quebec, EastAmerica, OpenNIC
URL: https://doh.boothlabs.me/dns-query
Bootstrap IP address: 158.69.53.73
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 76 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE + H2-WINDOW-UPDATE
—–> rx 759 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 552 | 431 | 1.28:1

DoH/Do53 4.33, keepalive 550 to 590 seconds , server DNS-over-HTTPS/2.1.2
declouds

Tags: adblocker, Germany, Europe
URL: https://dns.decloudus.com/dns-query
Bootstrap IP address: 176.9.199.158
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 448 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 342 | 230 | 1.49:1

DoH/Do53 4.38, keepalive 140 to 170 seconds , server nginx
alekberg-es

Tags: Spain, Europe
URL: https://dnses.alekberg.net/dns-query
Bootstrap IP address: 185.253.154.66
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 630 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 500 | 344 | 1.45:1

DoH/Do53 4.48, keepalive 140 to 170 seconds , server nginx/1.14.2
oszx

Tags: UK, Europe, adblocker
URL: https://dns.oszx.co/dns-query
Bootstrap IP address: 51.38.83.141
Port: 443
TLSv1.3, ALPN h2, SNI yes
—–> rx 700 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 579 | 402 | 1.44:1

DoH/Do53 4.55, keepalive 140 to 170 seconds , server nginx
42l

Tags: non-profit, France, Europe
URL: https://doh.42l.fr/dns-query
Bootstrap IP address: 185.216.27.142
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 749 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA
—–> rx 55 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 640 | 437 | 1.46:1

DoH/Do53 4.60, keepalive 140 to 170 seconds , server nginx
lelux

Tags: Netherlands, Europe
URL: https://resolver-eu.lelux.fi/dns-query
Bootstrap IP address: 51.158.147.50
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 76 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE + H2-WINDOW-UPDATE
—–> rx 730 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 565 | 447 | 1.26:1

DoH/Do53 4.60, keepalive 30 to 50 seconds , server nginx
blahdns-fi

Tags: Finland, Europe, adblocker
URL: https://doh-fi.blahdns.com/dns-query
Bootstrap IP address: 95.216.212.177
Port: 443
TLSv1.3, ALPN h2, SNI yes
—–> rx 76 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE + H2-WINDOW-UPDATE
—–> rx 767 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 589 | 449 | 1.31:1

DoH/Do53 4.63, keepalive 30 to 50 seconds
alekberg-se

Tags: Sweden, Europe
URL: https://dnsse.alekberg.net/dns-query
Bootstrap IP address: 45.153.187.96
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 502 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA
—–> rx 55 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 413 | 286 | 1.44:1

DoH/Do53 4.65, keepalive 20 to 25 seconds , server nginx/1.19.1
hostux

Tags: Luxembourg, Europe
URL: https://dns.hostux.net/dns-query
Bootstrap IP address: 185.26.126.37
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 669 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 545 | 376 | 1.45:1

DoH/Do53 4.73, keepalive 140 to 170 seconds , server nginx/1.14.2
fossdaily

Tags: Australia, AsiaPacific, adblocker
URL: https://dns.fossdaily.xyz/dns-query
Bootstrap IP address: 172.105.171.229
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 756 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 623 | 438 | 1.42:1

DoH/Do53 4.95, keepalive 140 to 170 seconds , server nginx
tin-fan

Tags: Germany, Europe, OpenNIC
URL: https://ns01.dns.tin-fan.com/dns-query
Bootstrap IP address: 95.217.16.205
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 777 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 649 | 455 | 1.43:1

DoH/Do53 5.08, keepalive 140 to 170 seconds , server nginx/1.14.2
containerpi

Tags: Japan, AsiaPacific
URL: https://dns.containerpi.com/dns-query
Bootstrap IP address: 45.77.180.10
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 743 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 622 | 437 | 1.42:1

DoH/Do53 5.09, keepalive 140 to 170 seconds , server nginx
pi-dns-eastus

Tags: NY, EastAmerica, adblocker
URL: https://doh.eastus.pi-dns.com/dns-query
Bootstrap IP address: 185.213.26.187
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 742 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 623 | 437 | 1.43:1

DoH/Do53 5.21, keepalive 140 to 170 seconds , server nginx
snopyta

Tags: non-profit, Finland, Europe
URL: https://fi.doh.dns.snopyta.org/dns-query
Bootstrap IP address: 95.216.229.153
Port: 443
TLSv1.3, ALPN h2, SNI yes
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 750 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 635 | 444 | 1.43:1

DoH/Do53 5.26, keepalive 140 to 170 seconds , server nginx
flatuslifir

Tags: Iceland, Europe
URL: https://dns.flatuslifir.is/dns-query
Bootstrap IP address: 46.239.223.80
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 762 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 645 | 454 | 1.42:1

DoH/Do53 5.34, keepalive 140 to 170 seconds , server nginx
li

Tags: UK, Europe
URL: https://doh.li/dns-query
Bootstrap IP address: 46.101.66.244
Port: 443
TLSv1.2, ALPN not negotiated – assuming http/1.1, SNI no
—–> rx 916 bytes: IP + TCP + TLS + HTTP/1.1
Header size: 589 bytes

DoH/Do53 5.55, keepalive 30 to 50 seconds
eth-services

Tags: Germany, Europe, OpenNIC
URL: https://opennic1.eth-services.de:853/
Bootstrap IP address: 94.247.43.254
Port: 853
TLSv1.3, ALPN not negotiated – assuming http/1.1
—–> rx 948 bytes: IP + TCP + TLS + HTTP/1.1
Header size: 616 bytes

DoH/Do53 5.75, keepalive 30 to 50 seconds
nixnet-ny

Tags: NY, EastAmerica
URL: https://uncensored.ny1.dns.nixnet.xyz/dns-query
Bootstrap IP address: 199.195.251.84
Port: 443
TLSv1.3, ALPN not negotiated – assuming http/1.1
—–> rx 901 bytes: IP + TCP + TLS + HTTP/1.1
Header size: 588 bytes

DoH/Do53 5.85, keepalive 30 to 50 seconds
dnsforge

Tags: Germany, Europe, adblocker
URL: https://dnsforge.de/dns-query
Bootstrap IP address: 176.9.93.198
Port: 443
TLSv1.3, ALPN h2, SNI no
—–> rx 60 bytes: IP + TCP + TLS + H2-WINDOW-UPDATE
—–> rx 713 bytes: IP + TCP + TLS + H2-HEADERS + H2-DATA
—–> rx 55 bytes: IP + TCP + TLS + H2-DATA (end stream)
Header uncompressed | compressed | ratio: 656 | 462 | 1.42:1

DoH/Do53 6.23, keepalive 140 to 170 seconds , server nginx

last update Oct 17, 2020

Here’s the deal:

Anybody cleaning up the header moves above Cloudflare.

If nginx brings in a fix for header compression, everybody moves above Google. Now, that would be hilarious!

But the biggest problem is the inactivity timer. If you can, increase it beyond the 60 seconds Firefox keepalive. This could mean more RAM on your server – about 200KB for each open SSL connection.

Epilog

I hope what I wrote here makes sense, sorry for the overly technical presentation. My intention was to highlight some of the current implementation problems, and how they affect users and server administrators. DoH is an emerging technology, it will take some time to settle down.

Drop us a line on GitHub if you need help using this tool. If you are more interested in a full Linux workstation DoH/DoT proxy, type sudo fdns --daemonize in a terminal and send your DNS traffic to loopback address 127.1.1.1. Testing completed!

3 thoughts on “A Survey of Public DNS over HTTPS Servers”

Pingback: Well, many of these are themselves operated by #surveillance compan… | Dr. Roy Schestowitz (罗伊)
Pingback: A Survey of Public DNS over HTTPS Servers | OSINT
Pingback: Firejail Tips and Tricks | Firejail

fdns

Firejail DoH Proxy Server

A Survey of Public DNS over HTTPS Servers

CIRA

Bandwidth

Cloudflare

Quad9

Google

Adguard

Test Results

Epilog

3 thoughts on “A Survey of Public DNS over HTTPS Servers”

Leave a Reply Cancel reply

CIRA

Bandwidth

Cloudflare

Quad9

Google

Adguard

Test Results

Epilog

Share this:

Like this:

3 thoughts on “A Survey of Public DNS over HTTPS Servers”

Leave a Reply Cancel reply