[{"content":"Domains blocked at the resolver\n1.54M\nTwo curated feeds, refreshed every 8 hours, held in memory for instant answers. Ads, trackers, telemetry: 417KMalware, phishing, scams: 1.13M What you\u0026#39;ll notice Fewer ads and trackers on every device connected to the VPN, with no browser extension. Malicious domains stop at the resolver. Phishing kits, malware hosts and scam sites return \u0026ldquo;no such name.\u0026rdquo; Nothing to configure. Same VPN profile, same two DNS addresses, same experience. Five upgrades in one cutover Encrypted upstreamLookups leave the resolver over DNS-over-TLS. Nobody between us and the internet sees them in plaintext anymore.\nAuthenticated answersDNSSEC validation is on. A forged or tampered answer fails instead of being handed to your device.\nThreat intelligence addedA security feed of 1.13 million malware, botnet and phishing domains now sits alongside the ad blocking.\nSmaller attack surfaceThe web server, admin UI and certificate client are gone. The resolver is one daemon with no web pages to exploit.\nZero-downtime cutoverReplaced one host at a time. A working resolver answered at every step and client settings never changed.\nBefore and after CapabilityBeforeNow Ad and tracker blockingYesYes, larger curated feed Malware and phishing blockingPartialDedicated threat feed Answers verified with DNSSECNoYes Encrypted to upstream resolversPlaintextDNS-over-TLS Minimises what upstreams learn about a queryNoQuery name minimisation Web admin pages exposed on the hostYes, ports 80 and 443None Security patches applied automaticallyManualUnattended upgrades Change needed on your device\u0026nbsp;None If something you need gets blocked Curated feeds occasionally catch a legitimate name, most often a vendor\u0026rsquo;s telemetry endpoint that an app insists on. Tell us the domain. Allowing it is a two-line change that takes effect without a restart and survives every feed refresh. What stays the same The two DNS addresses in your VPN profile. Private names for internal hosts resolve exactly as before. Two resolvers in two availability zones, so one can be rebuilt without anyone noticing. Figures measured on the live resolvers on 2026-10-24. Blocklists are Hagezi Multi PRO and Hagezi Threat Intelligence Feeds (medium). Blocking is a DNS NXDOMAIN response, not a block page. Query logs are not kept; only blocked-name events are retained, for one week, for troubleshooting.","date":"2026-10-24","description":"Every name your device looks up over the VPN now goes through a resolver that checks answers are authentic, encrypts the trip to the internet, and blocks about 1.5 million ad, tracking and malware domains before they ever load. You did not have to change a thing.","section":"blog","title":"Your VPN's DNS just got a serious upgrade","url":"/blog/resolver-upgrade-2026-10/"},{"content":"Overview Every connection your device makes starts with a DNS lookup. The resolver that answers it sees the name of every site and service you use, decides how quickly you get an answer, and can decide whether you get an answer at all. Most people never choose one; they use whatever their ISP or network hands out. That is a reasonable default, but it is still a choice, and it is worth knowing what you are trusting the resolver with.\nThis post is about how to evaluate a resolver, not which one to pick. The questions below apply to your ISP\u0026rsquo;s resolver, to a public one, and to one you run yourself.\nWhat a resolver knows A recursive resolver receives the full name you are looking up, together with your IP address, for every lookup your device makes. Over a day that is a complete list of the sites, apps and background services you used, with timestamps. Whether that record is kept, for how long, and who can see it is the first thing to find out. Read the privacy policy for the words log, retain and share, and notice what it does not say.\nThe resolver also knows your approximate location from your IP address, and some forward a truncated form of it to authoritative servers to pick a nearby content server. That is a trade-off between speed and privacy that you should at least be aware of.\nWhat to look at Logging and retention. Does the operator keep query logs at all? If so, for how long, and are they tied to your IP address? A clear statement beats a vague one.\nBusiness model. Running a resolver costs money. If you are not paying, understand what is. Advertising, data sales and \u0026ldquo;security intelligence\u0026rdquo; products all depend on query data.\nFiltering. Some resolvers block advertising, tracking, malware or adult content by returning no answer for those names. This can be exactly what you want. It also means the operator decides what you cannot reach, so look for a published policy on how the lists are built and how to report mistakes.\nEncrypted transport. Plain DNS travels in clear text, so anyone on the path can read or alter it. DNS over TLS and DNS over HTTPS encrypt the connection between your device and the resolver. Most current operating systems support at least one of them; check that the resolver does too.\nDNSSEC validation. A validating resolver checks the signatures on signed zones and refuses forged answers. It does not protect privacy, but it protects integrity.\nSpeed and reliability. Latency is set mostly by distance to the nearest resolver node and by how warm its cache is. Measure it from where you actually are rather than trusting a benchmark from somewhere else. Anycast networks with many nodes tend to be both fast and resilient.\nJurisdiction. Where the operator is incorporated and where the servers run determine which laws apply to your query data.\nReversibility. Changing resolvers should be a few fields in your network settings, and clearing them should put you back on the default. Avoid anything that requires an agent or app for a basic resolver change.\nHow to check what you are using It is common to configure a resolver and still be using a different one, because a VPN, a router, or an operating system feature took over. Two quick checks:\nMy IP Address shows the public IPv4 and IPv6 addresses your traffic leaves from. My Resolvers shows which resolvers are actually answering your lookups, which is the only way to know whether your configuration took effect. From a terminal, dig or nslookup against a specific server tells you what that server answers, and comparing it with a lookup that uses your system default tells you whether they agree:\ndig example.com +short dig @203.0.113.53 example.com +short References RFC 1034 and RFC 1035, the DNS specification RFC 7858, DNS over TLS RFC 8484, DNS over HTTPS RFC 7871, EDNS Client Subnet, the mechanism that forwards part of your address to authoritative servers IANA root servers","date":"2024-01-05","description":"What a recursive resolver actually does for you, and what to look at before you point your devices at one","section":"blog","title":"Choosing a DNS resolver","url":"/blog/choosing-dns-provider/"},{"content":"Last updated: 2026-10-31\nnxdomain.co does not set cookies. There is no analytics, no advertising and no sign-in on this site, so there is nothing for a cookie to do.\nOne thing is stored in your browser: if you use the light/dark toggle in the header, your choice is saved in the browser\u0026rsquo;s local storage under the key theme so that the site opens in the mode you picked. It is a single word, it never leaves your browser, and clearing site data for nxdomain.co removes it. If you never touch the toggle, nothing is stored and the site follows your operating system\u0026rsquo;s setting.\nThe console, when it is up, will need a session cookie to keep you signed in. It will have its own notice.\nQuestions: info@nxdomain.co.","date":"","description":"This site sets no cookies","section":"legal","title":"Cookie Policy","url":"/legal/cookies/"},{"content":"Last updated: 2026-10-31\nThis policy covers the website at nxdomain.co. The tools at myip.nxdomain.co and leaktest.nxdomain.co, and the console when it is up, are separate services and are described in their own sections below.\nThe website nxdomain.co is a static site. There are no accounts, no forms, no analytics scripts, no advertising and no third-party embeds. The site sets no cookies; see the cookie policy.\nThe site is served from a content delivery network. Like any web server, it may record standard access logs: the requesting IP address, the page requested, the time, and the browser\u0026rsquo;s user-agent string. These logs are used only to operate the site and to investigate abuse, are not combined with any other data, and are not shared.\nSite search runs in your browser against an index downloaded with the page. Search terms are not sent anywhere.\nThe tools My IP Address and My Resolvers exist to show you information about your own connection: the public addresses your traffic leaves from, and the resolvers that forwarded your lookups. Producing that answer requires receiving your request, which includes that information. It is shown to you and is not used for any other purpose.\nThe console The console at app.nxdomain.co holds the account data needed to sign in (an identity and a sign-in credential) and the inventory of servers and device keys it manages. It does not see tunnel traffic or DNS queries. The console page describes what it keeps.\nYour rights If you believe this site holds data about you and you want it removed, or you have a question about this policy, write to info@nxdomain.co.\nChanges This policy is updated when the site changes in a way that affects it. The date at the top is the date of the last change.","date":"","description":"What this site collects, which is close to nothing","section":"legal","title":"Privacy Policy","url":"/legal/privacy/"},{"content":"Status · live\nThe console is at app.nxdomain.co. Accounts are by invitation; sign in with the credentials you were issued.","date":"","description":"Provisioning, Monitoring, Configuration","section":"","title":"The console","url":"/portal/"}]