Public RDNS Full

Quick Start

Configure your device or resolver to use the Full tier. See Lite for lighter oisd protection or Open for no blocking.

full.public-rdns.com

https://full.public-rdns.com/dns-query

https://full.public-rdns.com/dns-query

[Resolve]
DNS=37.27.125.218#full.public-rdns.com 2a01:4f9:3070:2feb::218#full.public-rdns.com
DNSOverTLS=yes
DNSSEC=allow-downgrade

sudo systemctl restart systemd-resolved
resolvectl status

forward-zone:
    name: "."
    forward-tls-upstream: yes
    forward-addr: 37.27.125.218@853#full.public-rdns.com
    forward-addr: 2a01:4f9:3070:2feb::218@853#full.public-rdns.com

IPv4: 37.27.125.218     DoH: https://full.public-rdns.com/dns-query
IPv6: 2a01:4f9:3070:2feb::218   DoH: https://full.public-rdns.com/dns-query

Primary: 37.27.125.218     IPv6: 2a01:4f9:3070:2feb::218

dig @full.public-rdns.com example.com
kdig @full.public-rdns.com +tls example.com
kdig @full.public-rdns.com +https example.com
curl -s -H 'accept: application/dns-message' \
  "https://full.public-rdns.com/dns-query?dns=q80BAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE" | xxd

Endpoints

This resolver publishes _dns.resolver.arpa SVCB records for DDR auto-discovery.

Android

Android 9 and later support DNS over TLS natively via Private DNS — no app required.

1. Open Settings → Network & internet → Advanced → Private DNS.
2. Select Private DNS provider hostname.
3. Enter full.public-rdns.com and tap Save.

All DNS queries are then encrypted over TLS on port 853 system-wide.

Apple (iOS, iPadOS, macOS)

Apple devices support encrypted DNS via configuration profiles (iOS 14+ / macOS Big Sur+). Download a profile from the Quick Start section above (DoT recommended).

iOS / iPadOS

1. Tap the profile link — Safari will prompt you to allow the download.
2. Open Settings → General → VPN & Device Management.
3. Tap the downloaded profile and Install. Enter your passcode if prompted.

macOS

1. Click the profile link — it will be downloaded and opened automatically.
2. Open System Settings → Privacy & Security → Profiles.
3. Double-click the profile and click Install.

Browsers

Set the custom DoH URL to:

https://full.public-rdns.com/dns-query

• Firefox — Settings → Privacy & Security → DNS over HTTPS → Max Protection → Custom
• Chrome / Edge — Settings → Privacy and security → Security → Use secure DNS → With: Custom
• Brave — Settings → Privacy and security → Security → Use secure DNS

systemd-resolved and Unbound

systemd-resolved (Linux)

[Resolve]
DNS=37.27.125.218#full.public-rdns.com 2a01:4f9:3070:2feb::218#full.public-rdns.com
DNSOverTLS=yes
DNSSEC=allow-downgrade

sudo systemctl restart systemd-resolved
resolvectl status
resolvectl query example.com

Unbound or dnscrypt-proxy as a forwarder

forward-zone:
    name: "."
    forward-tls-upstream: yes
    forward-addr: 37.27.125.218@853#full.public-rdns.com
    forward-addr: 2a01:4f9:3070:2feb::218@853#full.public-rdns.com

Windows

Windows 11 supports DoH natively per-adapter:

1. Open Settings → Network & internet and select your active connection.
2. Click Edit next to DNS server assignment and choose Manual.
3. Enable IPv4 and enter 37.27.125.218; set DNS over HTTPS to On (manual template) with URL https://full.public-rdns.com/dns-query.
4. Optionally repeat for IPv6 using the addresses in Endpoints.

Windows 10 does not have a built-in DoH UI; use dnscrypt-proxy or YogaDNS, or configure DoH at the router.

Routers

Most consumer routers accept plain DNS only:

Primary: 37.27.125.218     IPv6: 2a01:4f9:3070:2feb::218

OpenWrt, pfSense, and OPNsense can forward over DoT to full.public-rdns.com:853.

Transports

DNS over HTTPS (DoH)

curl -s -H 'accept: application/dns-message' \
  "https://full.public-rdns.com/dns-query?dns=q80BAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE" | xxd
kdig @full.public-rdns.com +https example.com

DNS over TLS (DoT)

kdig @full.public-rdns.com +tls example.com

Plain DNS

dig @full.public-rdns.com example.com

Blocking

The Full tier is a family-safe resolver: ads, malware, trackers, NSFW, and gambling are sunk at the DNS layer via Hagezi RPZ feeds. Blocked names are answered with a CNAME to sinkhole.public-rdns.com (0.0.0.0 / ::).

Active blocklists on Full (Hagezi RPZ)

Most coverage is provided by Hagezi Ultimate, with additional specialized feeds:

• Ultimate — broad ad/tracker/malware coverage
• Threat Intelligence Feeds (TIF) — known malicious infrastructure
• Fake — fraudulent / phishing / scam domains
• DynDNS — dynamic DNS providers commonly abused by malware
• DoH / VPN / Proxy bypass — services used to circumvent filtering
• Spam TLDs (aggressive)
• Hosters — bulk hosters frequently used to host abuse
• URL Shorteners
• Anti-piracy
• Gambling
• NSFW
• Native trackers — Amazon, Apple, Huawei, Microsoft, Samsung, TikTok, and others

Lists are pulled from the Hagezi project. Refreshed several times per day.

Test that blocking works

dig @full.public-rdns.com doubleclick.net
# Expect a CNAME to sinkhole.public-rdns.com → 0.0.0.0 / ::

False positives

Report false positives to the Hagezi project; changes flow into the Full resolver on the next refresh.

Comparison

Quick reference against other popular resolvers: