Public RDNS Open

Quick Start

Configure your device or resolver to use the Open tier. See Full for strong family-safe blocking or Lite for light oisd protection.

open.public-rdns.com

https://open.public-rdns.com/dns-query

https://open.public-rdns.com/dns-query

[Resolve]
DNS=37.27.125.213#open.public-rdns.com 2a01:4f9:3070:2feb::213#open.public-rdns.com
DNSOverTLS=yes
DNSSEC=yes

sudo systemctl restart systemd-resolved
resolvectl status

forward-zone:
    name: "."
    forward-tls-upstream: yes
    forward-addr: 37.27.125.213@853#open.public-rdns.com
    forward-addr: 2a01:4f9:3070:2feb::213@853#open.public-rdns.com

IPv4: 37.27.125.213     DoH: https://open.public-rdns.com/dns-query
IPv6: 2a01:4f9:3070:2feb::213   DoH: https://open.public-rdns.com/dns-query

Primary: 37.27.125.213     IPv6: 2a01:4f9:3070:2feb::213

dig @open.public-rdns.com example.com
kdig @open.public-rdns.com +tls example.com
kdig @open.public-rdns.com +https example.com
curl -s -H 'accept: application/dns-message' \
  "https://open.public-rdns.com/dns-query?dns=q80BAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE" | xxd

Endpoints

This resolver publishes _dns.resolver.arpa SVCB records for DDR auto-discovery.

Android

Android 9 and later support DNS over TLS natively via Private DNS — no app required.

1. Open Settings → Network & internet → Advanced → Private DNS.
2. Select Private DNS provider hostname.
3. Enter open.public-rdns.com and tap Save.

All DNS queries are then encrypted over TLS on port 853 system-wide.

Apple (iOS, iPadOS, macOS)

Apple devices support encrypted DNS via configuration profiles (iOS 14+ / macOS Big Sur+). Download a profile from the Quick Start section above (DoT recommended).

iOS / iPadOS

1. Tap the profile link — Safari will prompt you to allow the download.
2. Open Settings → General → VPN & Device Management.
3. Tap the downloaded profile and Install. Enter your passcode if prompted.

macOS

1. Click the profile link — it will be downloaded and opened automatically.
2. Open System Settings → Privacy & Security → Profiles.
3. Double-click the profile and click Install.

Browsers

Set the custom DoH URL to:

https://open.public-rdns.com/dns-query

• Firefox — Settings → Privacy & Security → DNS over HTTPS → Max Protection → Custom
• Chrome / Edge — Settings → Privacy and security → Security → Use secure DNS → With: Custom
• Brave — Settings → Privacy and security → Security → Use secure DNS

systemd-resolved and Unbound

systemd-resolved (Linux)

[Resolve]
DNS=37.27.125.213#open.public-rdns.com 2a01:4f9:3070:2feb::213#open.public-rdns.com
DNSOverTLS=yes
DNSSEC=yes

Use DNSSEC=yes, not allow-downgrade. The latter accepts unsigned answers when validation fails, weakening client-side protection; this resolver enforces DNSSEC and bogus answers should be rejected on your machine too.

sudo systemctl restart systemd-resolved
resolvectl status
resolvectl query example.com

Unbound or dnscrypt-proxy as a forwarder

forward-zone:
    name: "."
    forward-tls-upstream: yes
    forward-addr: 37.27.125.213@853#open.public-rdns.com
    forward-addr: 2a01:4f9:3070:2feb::213@853#open.public-rdns.com

Windows

Windows 11 supports DoH natively per-adapter:

1. Open Settings → Network & internet and select your active connection.
2. Click Edit next to DNS server assignment and choose Manual.
3. Enable IPv4 and enter 37.27.125.213; set DNS over HTTPS to On (manual template) with URL https://open.public-rdns.com/dns-query.
4. Optionally repeat for IPv6 using the addresses in Endpoints.

Windows 10 does not have a built-in DoH UI; use dnscrypt-proxy or YogaDNS, or configure DoH at the router.

Routers

Most consumer routers accept plain DNS only:

Primary: 37.27.125.213     IPv6: 2a01:4f9:3070:2feb::213

OpenWrt, pfSense, and OPNsense can forward over DoT to open.public-rdns.com:853.

Transports

DNS over HTTPS (DoH)

curl -s -H 'accept: application/dns-message' \
  "https://open.public-rdns.com/dns-query?dns=q80BAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE" | xxd
kdig @open.public-rdns.com +https example.com

DNS over TLS (DoT)

kdig @open.public-rdns.com +tls example.com

Plain DNS

dig @open.public-rdns.com example.com

Blocking

The Open tier performs no blocking — every name resolves if it exists in the global DNS. No RPZ feeds are loaded. If you need protection, use the Full or Lite tier instead.

Comparison