Encrypted Transport Active

Recursive Resolution.
Zero Upstream Tracking.

A private, DNSSEC-validating recursive resolver backed by NGINX, AdGuard Home, and Knot. Block ads, trackers, and adult content at the network level without forwarding queries to third-party resolvers.

Configuration Guide View Endpoints

Resolver Statistics

Live

Fetching stats…

Top Queried Domains · AGH window

Top Blocked Domains · AGH window

DoH / DoH3

Port 443 PQC Active

Proxied via NGINX with Post-Quantum hybrid key exchange (ML-KEM) and HTTP/3.

URI Template

https://dns.salmanshafi.net/dns-query/

DNS-over-TLS (DoT)

Port 853

Native Android and router integration. PQC awaiting upstream support.

Hostname

dns.salmanshafi.net

DNS-over-QUIC (DoQ)

UDP 853

Rapid handshakes and zero head-of-line blocking for mobile networks.

URI Template

quic://dns.salmanshafi.net

Plain DNS (Unencrypted) — Not Recommended

Port 53 Unencrypted

Plain DNS does not encrypt your queries. Your ISP can see every domain you resolve. Additionally, the server IP may change in the future without notice. Use only if you fully understand the risks.

103.174.50.32

2001:df7:b880:4::53

Architecture Stack

Hosted on AlmaLinux 10 in Bangladesh, the multi-stage stack operates as a fully self-contained recursive resolver.

NGINX fronts the edge with TLS termination and PQC. AdGuard Home applies network filters, immediately forwarding unblocked queries locally to Knot Resolver for root resolution.

Location MetroVPS (Bangladesh)

Edge Proxy NGINX (PQC Terminated)

Policy Engine AdGuard Home (:5380)

Backend Knot Resolver (127.0.0.53)

Resolution Pipeline

Left-to-right transport branches, then top-to-bottom recursive resolver pipeline.

Client Device

Initiates DNS query

Port 53

Plain DNS

Unencrypted, ISP visible

Port 853

DoT / DoQ

Encrypted, Direct

Port 443

DoH / DoH3

NGINX & PQC Terminated

Policy Engine

AdGuard Home

Blocklists Allowlists SafeSearch

Knot Resolver

Recursive Backend — DNSSEC Validation, QNAME Minimisation, 1GB Cache

Root, TLD, Authoritative DNS

Direct recursive walk — no third-party forwarding

Configuration Guide

Select your platform to configure encrypted DNS resolution.

Android Private DNS

Navigate to Settings > Network & internet.

Tap on Private DNS.

Select Private DNS provider hostname and enter:

dns.salmanshafi.net

Browser DNS-over-HTTPS

Chromium (Chrome, Brave, Edge)

Navigate to Settings > Privacy and security > Security. Enable Use secure DNS, select Custom, and paste:

https://dns.salmanshafi.net/dns-query/

Mozilla Firefox

Navigate to Settings > Privacy & Security. Scroll to DNS over HTTPS, select Max Protection, choose Custom and paste the URI above.

Wi-Fi Router (DoT)

Plain DNS on port 53 is available but unencrypted and not recommended. Your ISP can see your queries. For secure transport, use DoT on port 853.

Log into your router (e.g. OpenWrt, Asuswrt-Merlin) and locate the secure DNS forwarder (Stubby/Dnsmasq).

Set the upstream DoT hostname to:

dns.salmanshafi.net

Ensure the port is set to 853, save, and restart the DNS daemon.

Windows 11 Native DoH

Windows requires an underlying IP to bootstrap custom DoH templates natively via Settings.

To use this resolver on Windows, configure DoH directly inside your browser (see Browser tab) or register the DoH template via PowerShell:
netsh dns add encryption

Apple iOS & macOS

Apple devices natively support encrypted DNS protocols across the entire OS via .mobileconfig profiles.

Generate a signed Apple Configuration Profile using a trusted open-source generator, specifying the DoH URI:

https://dns.salmanshafi.net/dns-query/

Download the profile and install it via Settings > Profile Downloaded.

Active Filter Policies

Synchronised blocklists operating at the AdGuard Home layer.

Recursive Resolution. Zero Upstream Tracking.

Resolver Statistics

Top Queried Domains · AGH window

Top Blocked Domains · AGH window

DoH / DoH3

DNS-over-TLS (DoT)

DNS-over-QUIC (DoQ)

Plain DNS (Unencrypted) — Not Recommended

Architecture Stack

Resolution Pipeline

Client Device

Plain DNS

DoT / DoQ

DoH / DoH3

AdGuard Home

Knot Resolver

Root, TLD, Authoritative DNS

Configuration Guide

Android Private DNS

Browser DNS-over-HTTPS

Chromium (Chrome, Brave, Edge)

Mozilla Firefox

Wi-Fi Router (DoT)

Windows 11 Native DoH

Apple iOS & macOS

Active Filter Policies

Recursive Resolution.
Zero Upstream Tracking.