Blog updated 2 min read

How it works

How traffic moves through the three VPN servers, and how the private resolvers filter and answer DNS lookups.

Your devices connect over WireGuard to VPN West, VPN Central or VPN East. From there your traffic goes to the internet, and your DNS lookups go to the private resolvers, which block ad, tracking and malware names and send the rest upstream over DNS-over-TLS.VPN servers · WireGuardyour trafficDNSDNS-over-TLSYour devices1 config eachVPN WestVPN CentralVPN EastInternetwebsites · appsResolversprivate · DNSSECno query logs1.54M names → NXDOMAIN

The network

Each device gets one WireGuard configuration and connects to VPN West, VPN Central or VPN East from any Wi-Fi or mobile network. It is a full tunnel: everything the device sends goes through it, encrypted. The Wi-Fi or mobile network you’re on sees an encrypted connection to a VPN server, but not what travels inside it.

DNS inside the network

Your device asks the resolvers for a name. A name on the blocklist gets an NXDOMAIN ("non-existent domain") response from the resolvers. Any other name is looked up from an upstream DNS server over DNS-over-TLS, and the DNS response is checked with DNSSEC, where the domain is signed, before it returns to your device.lookup over VPNDNS-over-TLSDNS responseDNS responseYour deviceasks for a nameResolversDNSSEC checkno query logsUpstream DNSresolves the restblocklist · 1.54M names

Before a device can connect to a website or app, it looks up the name (example.com) to get an address. Whichever VPN server the device is connected to, those lookups go to the same pair of private resolvers.

The resolvers first check the name against a blocklist of about 1.54 million ad, tracking, malware and phishing domains. A blocked name gets an NXDOMAIN (“non-existent domain”) response, so the device never connects to it. Any other name is looked up from an upstream DNS server over an encrypted connection (DNS-over-TLS). Where a domain signs its records with DNSSEC, the resolvers verify the signature before passing the DNS response on, so a forged response is rejected.

The resolver upgrade has the full details: the blocklists, how often they refresh, and what to do if something you need gets blocked.