Our configuration

These are the files our resolver runs, so you can check our privacy claims, copy the setup, or run your own server.

Last updated: 14 October 2026. Software: Ubuntu 24.04 LTS, Unbound 1.19.2, dnsdist 1.8.3, Certbot (Let’s Encrypt). Secrets such as private keys are not part of these files.

Unbound: /etc/unbound/unbound.conf.d/resolver.conf

server:
    # Listen only on the server itself; the public reaches us via dnsdist
    interface: 127.0.0.1
    interface: ::1
    port: 53
    access-control: 127.0.0.0/8 allow
    access-control: ::1/128 allow

    # Privacy: don't reveal server details, don't log queries
    hide-identity: yes
    hide-version: yes
    use-syslog: yes
    verbosity: 0
    log-queries: no
    log-replies: no

    # Security hardening
    harden-glue: yes
    harden-dnssec-stripped: yes
    harden-referral-path: yes
    qname-minimisation: yes

    # Performance
    prefetch: yes
    num-threads: 1
    msg-cache-size: 64m
    rrset-cache-size: 128m

dnsdist: /etc/dnsdist/dnsdist.conf

-- Plain DNS listener on an unused local port (keeps port 53 free for Unbound)
setLocal("127.0.0.1:5399")

-- Allow public clients (the default only allows private networks)
setACL({"0.0.0.0/0", "::/0"})

-- Backend: the local Unbound resolver
newServer({address="127.0.0.1:53", name="unbound"})

-- DNS-over-HTTPS on port 443 (IPv4 + IPv6)
addDOHLocal("[::]:443", "/etc/dnsdist/certs/fullchain.pem", "/etc/dnsdist/certs/privkey.pem", "/dns-query")

-- DNS-over-TLS on port 853 (IPv4 + IPv6)
addTLSLocal("[::]:853", "/etc/dnsdist/certs/fullchain.pem", "/etc/dnsdist/certs/privkey.pem")

-- Basic abuse protection: drop clients sending more than 100 queries/second
addAction(MaxQPSIPRule(100), DropAction())

-- IPv4 listeners (the [::] listeners above only accept IPv6)
addDOHLocal("0.0.0.0:443", "/etc/dnsdist/certs/fullchain.pem", "/etc/dnsdist/certs/privkey.pem", "/dns-query")
addTLSLocal("0.0.0.0:853", "/etc/dnsdist/certs/fullchain.pem", "/etc/dnsdist/certs/privkey.pem")

Firewall (UFW)

ufw allow OpenSSH
ufw allow 80/tcp    # only for Let's Encrypt certificate renewal
ufw allow 443/tcp   # DNS-over-HTTPS
ufw allow 853/tcp   # DNS-over-TLS
ufw enable
ufw logging off     # no firewall logs

Certificate renewal hook: /etc/letsencrypt/renewal-hooks/deploy/dnsdist.sh

#!/bin/sh
D=/etc/letsencrypt/live/dns.freeandopendns.eu
cp "$D/fullchain.pem" /etc/dnsdist/certs/fullchain.pem
cp "$D/privkey.pem" /etc/dnsdist/certs/privkey.pem
chown _dnsdist:_dnsdist /etc/dnsdist/certs/*.pem
chmod 640 /etc/dnsdist/certs/*.pem
systemctl try-restart dnsdist

Questions or improvements: contact@freeandopendns.eu.