Public recursive DNS resolver

please-resolve.me

A public DNS resolver with classic DNS, DNS over HTTPS, DNS over TLS, AdGuard Home as the filtering layer, and Unbound as the recursive resolver.

Set it up View active filters

Endpoints

One resolver, multiple transport paths.

Classic DNS is the most compatible option and is usually configured by IP address. The domain is mainly useful for encrypted profiles such as DoH and DoT, where the TLS certificate must match the hostname.

Plain DNS

Unencrypted DNS queries over UDP or TCP port 53. Useful for routers, servers, and systems without native DoH or DoT support.

185.240.240.212

DNS over HTTPS

DNS queries are transported as HTTPS traffic over port 443. Useful for browsers, Windows DoH profiles, and clients that support a DoH template.

https://doh.please-resolve.me/dns-query

DNS over TLS

Encrypted DNS over port 853. Android uses this mode as "Private DNS" directly with the hostname.

dot.please-resolve.me:853

Resolution

What happens during a query.

This service is a recursive resolver. It answers DNS questions for clients, but it is not an authoritative nameserver for your own zones.

ClientA browser, phone, router, or server sends a DNS query.
TransportThe query reaches the resolver through DNS, DoH, or DoT.
AdGuard HomeRules, blocklists, and local rewrites are applied.
UnboundDomains that are not blocked are resolved recursively with validation.
ResponseThe client receives the DNS answer or a blocked response.

Filter

Active blocklists.

The filters are transparently sourced from the HaGeZi DNS blocklists. The main list is HaGeZi Multi PRO, described by HaGeZi as the recommended balanced variant. It is complemented by focused security and pop-up lists.

HaGeZi Multi PRO

Recommended balanced main list against ads, tracking, telemetry, malware, phishing, scams, and other nuisance domains.

View list 209,497 Rules

HaGeZi TIF mini

Compact threat-intelligence list against malware, phishing, and risky destinations.

View list 183,859 Rules

HaGeZi Pop-Up Ads

Additional list for pop-up ads and aggressive ad networks.

View list 52,626 Rules

HaGeZi Dynamic DNS

Blocks many Dynamic DNS destinations that are often used for rotating infrastructure.

View list 1,506 Rules
Source: github.com/hagezi/dns-blocklists AdGuard Home Unbound Upstream

Privacy and operation

Publicly reachable, admin private.

The resolver is publicly reachable for DNS queries. The administrative interface is not exposed publicly and remains restricted to internal networks.

  • Query logging is disabled.
  • Client IP anonymization is enabled.
  • DNSSEC-validating recursion runs through Unbound.
  • DoH uses a public TLS certificate for please-resolve.me.

Setup

Which address goes where.

Many operating systems only accept IP addresses for classic DNS. Use the domain for DoH or DoT, where the hostname is part of the encrypted connection.

Routers, Linux, classic DNS fields

If there is only a nameserver field, enter the IP address.

185.240.240.212

Windows with DNS over HTTPS

Windows needs the resolver IP plus the DoH template. After that, set the IP as your DNS server.

netsh dnsclient add encryption server=185.240.240.212 dohtemplate=https://doh.please-resolve.me/dns-query autoupgrade=yes udpfallback=no

Android Private DNS

Android uses DNS over TLS and expects only the hostname.

dot.please-resolve.me

Browser or DoH client

Enter the DNS-over-HTTPS URL as a custom resolver.

https://doh.please-resolve.me/dns-query