caliph.dns
connecting

Public recursive resolver · Jakarta, ID

DNS that keeps
your queries yours.

Free, encrypted and unlogged. Every lookup is filtered against 472,000+ known ad, tracker, malware and adult domains before it ever leaves the resolver — family safe on every device, with nothing to switch on.

— queries served
— threats blocked
— uptime

Endpoints

Pick a transport. Encrypted ones are strongly preferred.

DoH recommended

DNS over HTTPS

HTTP/2 and HTTP/3. Works in every modern browser.

DoT

DNS over TLS

Android Private DNS, systemd-resolved, routers.

DoQ

DNS over QUIC

RFC 9250. Lowest handshake cost on mobile networks.

Do53unencrypted

Plain DNS

Filtering still applies, but the query itself is in the clear.

What gets filtered

One profile for everyone. There is no separate family endpoint to remember.

Family safe by default

Pornography, adult and gambling sites are refused for every device pointed at this resolver, alongside malware, phishing and the usual advertising and tracking. It is not an optional mode and there is no setting to turn it on — plug in the address and the filtering is already there.

  • loading…

Counts are the domains each source list contributes to the store, live from the resolver. Blocklists were last rebuilt —.

Where it stops

Worth being straight about, because this is the part people rely on most:

  • It blocks known domains, not every bad one. New sites appear daily, and a name nobody has listed yet will resolve until the lists catch up.
  • It filters names, not pages. A site that is fine overall can still host something you would rather a child did not see, and this cannot tell the difference.
  • It is skipped entirely by anything that does not use it. A VPN, a browser with its own DNS-over-HTTPS setting, a hardcoded resolver in an app, or a site reached by raw IP address never asks this server at all.
  • It is not supervision. Treat it as one quiet layer under the parental controls already built into the device, not as a replacement for them.

Something slipping through, or something harmless caught by mistake? Tell me and the lists get adjusted.

Blocklist lookup

See exactly what this resolver does with a name before you point anything at it.

try

Answered straight from the resolver's key/value stores — no DNS query is sent, and nothing you type here is logged.

Live traffic

Straight from dnsdist, refreshed every two seconds.

Queries / sec — peak — in window
Cache hit rate — — entries cached
Median latency — last 10k queries
Blocked — — total answers filtered
Resolver load — — resident
Uptime — —

Throughput

queries/s blocked/s last 6 min

collecting samples…

Transport mix

  • loading…

Upstream health

—
  • loading…

Response codes

NOERROR—
NXDOMAIN—
SERVFAIL—
DROPPED—

Setup

Two minutes, no software to install.

  1. Open Settings → Network & internet → Private DNS.
  2. Choose Private DNS provider hostname.
  3. Enter dns.caliph.dev and save.

Android 9+. This gives you DNS over TLS system-wide, including on mobile data.

Verify it works

dig +short @103.155.191.224 doubleclick.net
# 0.0.0.0  → filtering is active

kdig -d +tls @dns.caliph.dev caliph.dev
# TLS handshake succeeded → DoT is working

House rules

No query logs

Queries are answered and forgotten. Only aggregate counters — the ones on this page — are kept.

Filtered, not censored

The blocklist targets advertising, telemetry, phishing and malware. Nothing political, nothing editorial.

Best effort

Run by one person on one box. It is stable, but it carries no SLA — do not put a hospital on it.

Fair use

Rate limits apply per source address. Bulk scanning and amplification attempts are dropped at the edge.