Public RDNS Lite

Quick Start

Configure your device or resolver to use the Lite tier. See Full for strong family-safe blocking or Open for none.

lite.public-rdns.com

https://lite.public-rdns.com/dns-query

https://lite.public-rdns.com/dns-query

[Resolve]
DNS=37.27.125.217#lite.public-rdns.com 2a01:4f9:3070:2feb::217#lite.public-rdns.com
DNSOverTLS=yes
DNSSEC=yes

sudo systemctl restart systemd-resolved
resolvectl status

forward-zone:
    name: "."
    forward-tls-upstream: yes
    forward-addr: 37.27.125.217@853#lite.public-rdns.com
    forward-addr: 2a01:4f9:3070:2feb::217@853#lite.public-rdns.com

IPv4: 37.27.125.217     DoH: https://lite.public-rdns.com/dns-query
IPv6: 2a01:4f9:3070:2feb::217   DoH: https://lite.public-rdns.com/dns-query

Primary: 37.27.125.217     IPv6: 2a01:4f9:3070:2feb::217

dig @lite.public-rdns.com example.com
kdig @lite.public-rdns.com +tls example.com
kdig @lite.public-rdns.com +https example.com
curl -s -H 'accept: application/dns-message' \
  "https://lite.public-rdns.com/dns-query?dns=q80BAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE" | xxd

Endpoints

This resolver publishes _dns.resolver.arpa SVCB records for DDR auto-discovery.

Android

Android 9 and later support DNS over TLS natively via Private DNS — no app required.

1. Open Settings → Network & internet → Advanced → Private DNS.
2. Select Private DNS provider hostname.
3. Enter lite.public-rdns.com and tap Save.

All DNS queries are then encrypted over TLS on port 853 system-wide.

Apple (iOS, iPadOS, macOS)

Apple devices support encrypted DNS via configuration profiles (iOS 14+ / macOS Big Sur+). Download a profile from the Quick Start section above (DoT recommended).

iOS / iPadOS

1. Tap the profile link — Safari will prompt you to allow the download.
2. Open Settings → General → VPN & Device Management.
3. Tap the downloaded profile and Install. Enter your passcode if prompted.

macOS

1. Click the profile link — it will be downloaded and opened automatically.
2. Open System Settings → Privacy & Security → Profiles.
3. Double-click the profile and click Install.

Browsers

Set the custom DoH URL to:

https://lite.public-rdns.com/dns-query

• Firefox — Settings → Privacy & Security → DNS over HTTPS → Max Protection → Custom
• Chrome / Edge — Settings → Privacy and security → Security → Use secure DNS → With: Custom
• Brave — Settings → Privacy and security → Security → Use secure DNS

systemd-resolved and Unbound

systemd-resolved (Linux)

[Resolve]
DNS=37.27.125.217#lite.public-rdns.com 2a01:4f9:3070:2feb::217#lite.public-rdns.com
DNSOverTLS=yes
DNSSEC=yes

Use DNSSEC=yes, not allow-downgrade. The latter accepts unsigned answers when validation fails, weakening client-side protection; this resolver enforces DNSSEC and bogus answers should be rejected on your machine too.

sudo systemctl restart systemd-resolved
resolvectl status
resolvectl query example.com

Unbound or dnscrypt-proxy as a forwarder

forward-zone:
    name: "."
    forward-tls-upstream: yes
    forward-addr: 37.27.125.217@853#lite.public-rdns.com
    forward-addr: 2a01:4f9:3070:2feb::217@853#lite.public-rdns.com

Windows

Windows 11 supports DoH natively per-adapter:

1. Open Settings → Network & internet and select your active connection.
2. Click Edit next to DNS server assignment and choose Manual.
3. Enable IPv4 and enter 37.27.125.217; set DNS over HTTPS to On (manual template) with URL https://lite.public-rdns.com/dns-query.
4. Optionally repeat for IPv6 using the addresses in Endpoints.

Windows 10 does not have a built-in DoH UI; use dnscrypt-proxy or YogaDNS, or configure DoH at the router.

Routers

Most consumer routers accept plain DNS only:

Primary: 37.27.125.217     IPv6: 2a01:4f9:3070:2feb::217

OpenWrt, pfSense, and OPNsense can forward over DoT to lite.public-rdns.com:853.

Transports

DNS over HTTPS (DoH)

curl -s -H 'accept: application/dns-message' \
  "https://lite.public-rdns.com/dns-query?dns=q80BAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE" | xxd
kdig @lite.public-rdns.com +https example.com

DNS over TLS (DoT)

kdig @lite.public-rdns.com +tls example.com

Plain DNS

dig @lite.public-rdns.com example.com

Blocking

The Lite tier uses the oisd Big list for lighter ad, malware, phishing and tracking protection (no NSFW or gambling blocks). Blocked names are answered with a CNAME to sinkhole.public-rdns.com.

The Lite tier uses the oisd Big RPZ feed from big.oisd.nl. It targets ads, malware, phishing, ransomware, spyware, cryptojacking, and non-essential telemetry — while deliberately avoiding breakage in NSFW, gambling, torrents, shopping, social media, and similar categories.

Test that blocking works

dig @lite.public-rdns.com doubleclick.net
# Expect a CNAME to sinkhole.public-rdns.com → 0.0.0.0 / ::

False positives

Report false positives via oisd.nl. For stronger blocking see Full; for none see Open.

Comparison