galenaDNS
Encrypted, ad-blocking DNS that keeps no record of who asked for what.
Service notice: running normally. No shutdown is planned. If that ever changes, the notice will appear here, with the date, at least 90 days ahead.
What it is
- Encrypted. DNS over HTTPS, TLS and QUIC (DoH, DoH3, DoT, DoQ). Plain, unencrypted DNS is not offered at all.
- Blocks ads, trackers and malware on every device you set it up on, using HaGeZi's public blocklists plus Quad9's threat filtering.
- No query logs. Nothing on the servers ties a lookup to you or to your address. That is checked on the running servers by an automated audit, not just promised.
- DNSSEC validated, so forged answers for signed domains are rejected.
- Two servers in two countries (Germany and Finland), with automatic failover if one goes down.
- Free, and the source is public, so you can read exactly how it works.
Set it up
The address is base.dns.swthrc.com.
| Android 9+ | Settings → Network & internet → Private DNS → Private DNS
provider hostname → base.dns.swthrc.com |
| iPhone, iPad, Mac | Download a profile, then install it (iOS: Settings → General → VPN, DNS & Device Management; macOS: System Settings → General → Device Management). It will say “Unverified” because the file is not signed — that is about the file, not the connection, which your device still verifies on every query. |
| Firefox | Settings → Privacy & Security → DNS over HTTPS → Max Protection →
Custom → https://base.dns.swthrc.com/dns-query |
| Chrome, Edge | Settings → Privacy and security → Security → Use secure DNS →
With: Custom → https://base.dns.swthrc.com/dns-query |
| Anything else | DoT: base.dns.swthrc.com on port 853.
DoH: https://base.dns.swthrc.com/dns-query. Windows, routers and
systemd-resolved need server addresses — see the
setup guide. |
Check that it's working
On the device or in the browser you just set up, open browserleaks.com/dns. The DNS servers it lists should all belong to Quad9 — usually in Germany, Finland and nearby — because Quad9 looks names up on galenaDNS's behalf, and a leak test shows whoever finally asks a website's own name servers. You won't see galenaDNS's own addresses there, and that is expected.
If it lists your internet provider instead, the setting isn't active where you tested. A browser's own secure-DNS setting covers that browser only, so test in the one you configured.
Before you switch: these setups are strict on purpose, so your lookups never quietly go somewhere else. That also means that if the service is down, pages will not load until you turn the setting off. There is no uptime guarantee. Know how to switch back, and do not set it up on someone else's device without showing them how.
Who sees what
| These servers | Answer your lookup and forget it. No log, no history, no record of your address alongside anything you looked up. |
| Quad9 (Switzerland) | Resolves names on the servers' behalf, over an encrypted link. Sees the names, never your address. |
| Hetzner (hosting) | Runs the network, so sees that your address connected, and when. Never the names, which are encrypted in both directions. |
The split is the point: no single company can see both who you are and what you look up. Encryption hides the names. It does not hide the size or the timing of each lookup, and the sizes in one page load can still suggest which sites were visited. The full, precise account is in the privacy policy.
Fair use
Built for households and small offices: each internet address can make about 50 lookups a second, with room for bursts well beyond what a busy home produces. DNS tunnelling and other abuse are refused. Running a larger network behind one address? Get in touch first.
The terms, in brief
- Free, best effort, no service level, and provided as is.
- At least 90 days' notice on this page before it ever shuts down, with the service unchanged until then.
- After a shutdown,
base.dns.swthrc.compoints nowhere for at least 90 days, and is never handed to anyone else's DNS service — so a device still configured with it fails safely instead of sending your lookups to a stranger.
Full text: terms of use.
The source
Everything — the servers, the blocklists, the privacy audit that checks the claims above on the live servers — is in the galenaDNS repository on GitLab, where issues and changes go, and mirrored to GitHub. MIT licensed.
Contact
| Abuse | abuse@swthrc.com — what a report can and cannot get |
| Privacy | dataprotection@swthrc.com |