We built a public DNS resolver, and you can use it or don't

We now run a free public DNS resolver on AS212683. Two nodes in London, DNSSEC on, no filtering, no logging your queries, and it speaks every modern encrypted transport we could think of. If you're just here for the addresses, jump to the bottom. If you're here for the write-up, put the kettle on or if you are like me grab a redbull.

The addresses

• IPv4: 5.182.115.74 and 5.182.115.75
• IPv6: 2a11:2646:1:2::4 and 2a11:2646:1:2::5
• DoT: dns.as212683.net on port 853
• DoH: https://dns.as212683.net/dns-query

Setup instructions per platform live at dns.as212683.net. Yes the landing page is served by dnsdist itself, we'll get to that.

Why

The obvious question. There are already excellent public resolvers run by very serious companies with very serious budgets and we are not going to out-Anycast Cloudflare. Fair.

The less obvious answer: DNS is one of those pieces of the internet where "more distributed" is genuinely better, most public resolvers on offer are three companies in a trenchcoat, and if you're a small ASN with the boxes already spinning it's approximately the same amount of work to serve fifty users or fifty thousand. The customer-facing config we were already running does 90% of what a public service needs. The rest was, in retrospect, an interesting weekend.

Also we wanted to write a blog post about it, which is arguably the real reason anyone does anything these days.

The stack, briefly

Nothing exotic. Two boxes, both in London:

• dnsdist out front doing all five transports (Do53, DoT, DoH, DoQ, DoH3), packet caching, rate limiting, dynamic blocking, and - this bit is genuinely funny - the landing page too
• PowerDNS Recursor loopback-only behind dnsdist, doing actual recursion with DNSSEC validation
• nftables with notrack on public UDP (more on why in a sec)
• Let's Encrypt via acme.sh for the TLS
• Prometheus + Grafana pointing at both boxes

The topology is deliberately boring. Boring is a feature.

The bit where we tried not to become a DDoS weapon

Every open resolver is a potential amplification reflector. This is the biggest reason "just run a public resolver" is a bad idea by default, and the reason most attempts by small networks end up on Shadowserver's problem list within a week.

You cannot make the risk zero. What you can do is make yourself an unattractive tool compared to the thousands of naked resolvers already floating around:

• ANY queries dropped. The classic amplification vector, gone.
• UDP answers capped at 1232 bytes (DNS Flag Day 2020). Big answers force clients to TCP, which spoofed sources can't complete. Amplification factor plummets.
• Non-recursive (RD=0) queries dropped. Real clients set the recursion-desired bit. Scanners often don't.
• Per-IP rate limit at 200 QPS, dropped past that.
• Dynamic blocking that watches per-IP QPS, NXDOMAIN rate, SERVFAIL rate, and response bandwidth, and bans offenders for five minutes at a time. Random-subdomain attacks and volumetric abuse get shown the door within seconds.
• DoQ and DoH3 are QUIC-based and QUIC has anti-amplification built into the protocol itself so that's a plus.

The application-layer stuff above handles abuse patterns. For actual volumetric attacks - the kind that don't care what's listening, they just want to fill your pipe - that's what our DDoS scrubbing is for. Traffic hits our scrubbers upstream of the resolvers, gets cleaned, and only the legit stuff makes it to dnsdist. Between the two layers, the resolvers themselves basically never see an attack in the shape that matters. Which is roughly the goal.

The notrack thing

Enough people asked about this in the review that it's earned its own header.

Linux tracks every "connection" through nftables' conntrack table so that ct state established,related accept works - that's how return traffic gets in. Fine for customer volumes. Genuinely catastrophic for a public UDP DNS server, because every query looks like a new connection, the table fills, and then the kernel starts dropping packets. On everything. Including the SSH session.... Do not ask me how I know.

The fix is boring and universal: bypass conntrack entirely for public UDP 53/853/443 via nftables' raw prerouting hook with notrack. TCP stays tracked (it's stateful anyway, and there's dramatically less of it). Every serious public resolver does this. Nobody talks about it. If you're standing up a public UDP-anything and you don't do this, you will find out in production, and it will be at 3am.

The nerdy bits worth mentioning

dnsdist serves the landing page. It owns port 443 for DoH already, so we told it to also serve / with a small HTML info page. /dns-query is still DoH, / gets a human. This is one fewer service on the box, one fewer thing to keep patched, one fewer reverse proxy to argue with. If it feels wrong, that's because you've been told for years that DNS servers only speak DNS. dnsdist 2.x quietly stopped bitching.

DDR (RFC 9462) is on. Clients that speak DDR - Windows 11, increasingly others - will ask us for _dns.resolver.arpa SVCB records, and we hand them back a pointer to our DoT and DoH endpoints. They then auto-upgrade to encrypted transport with zero user configuration. Try it yourself if you're into that sort of thing:

dig @5.182.115.74 _dns.resolver.arpa TYPE64

Two-layer caching. dnsdist has a 1M-entry packet cache in front, recursor has 2.5M record cache behind it. Popular names never touch the recursor. This is the reason a resolver on modest hardware can sit at very high QPS without breaking a sweat.

The Grafana

We monitor the boring stuff (up/down, QPS, cache hit ratio), the interesting stuff (latency percentiles, per-transport response times, dynamic blocks in flight), and the paranoid stuff (kernel UDP drops, response bandwidth vs query bandwidth, DNSSEC bogus rate). If any of those tiles turn red for long enough, Alertmanager tells us before you do. Probably.

What we don't do

• No per-client query logging. Aggregate Prometheus counters only.
• No EDNS Client Subnet sent upstream. Authoritative servers see us, not you.
• No filtering. No blocklists. No walled gardens on the public service (this is simply there for the future... AdBlocks anyone?).
• No ads, no upsell, no analytics on the landing page.

Written down so you can hold us to it.

How to actually use it

Easiest: Android Private DNS, put dns.as212683.net in the box, done. Everything encrypted.

Windows 11: DNS server assignment -> Manual -> the four IPs + DoH template.

Browsers: Settings -> Secure DNS -> custom provider -> paste the DoH URL.

iOS / macOS: install our configuration profile from olilo.co.uk/as212683-dns.mobileconfig

Routers: point WAN DNS at both IPs.

Linux: systemd-resolved with DNSOverTLS=yes.

Full walkthrough at dns.as212683.net.

Please break it (nicely)

If you find something weird, misbehaving, or straight-up broken, tell us: noc@as212683.net.

If you find something we should be doing differently, also tell us. Especially if you've run this kind of thing at bigger scale and have opinions on our thresholds. We can be persuaded.

Have fun. Tell your mates. Please don't use it to run for-profit DNS-over-DNS-tunnelling schemes.