Skip to content

CHEATSHEET.md

Latest commit

 

History

History
executable file
·
98 lines (68 loc) · 6.58 KB

CHEATSHEET.md

File metadata and controls

executable file
·
98 lines (68 loc) · 6.58 KB
Raw

HaGeZi DNS: Cheat Sheet

Tip

Just want to get connected? Pick a server below, set it up, and you're done. Full background, security details, and legal/privacy info are in README and PRIVACY.

1. Pick a server by country and protection level

Full protection (ads, trackers, and threats blocked), recommended for most users:

Server Location Best for (country)
root.hagezi.org Germany, Falkenstein AT, BA, BE, BG, CH, CZ, DE, DK, FR, GB, HU, IE, IT, LU, NL, PL, RO, SI, SK
wurzn.hagezi.org Germany, Nuremberg AT, BA, BE, BG, CH, CZ, DE, DK, ES, FR, GB, GR, HR, HU, IE, IT, LU, MD, MK, MT, NL, PL, PT, RO, RS, SI, SK, TR, UA
juuri.hagezi.org Finland, Helsinki DK, EE, FI, LT, LV, NO, SE

Threats only (phishing, malware, scam), no ad/tracker blocking:

Server Location Best for (country)
ctif.hagezi.org Germany, Nuremberg AT, BA, BE, BG, CH, CZ, DE, DK, ES, FR, GB, GR, HR, HU, IE, IT, LU, MD, MK, MT, NL, PL, PT, RO, RS, SI, SK, TR, UA

Limited coverage from current locations: AD, CY, GE, IS, LI, MC, ME, SM. Any server still works, just with higher latency.

2. Connect (recommended: encrypted)

Protocol Format Example
DoH/DoH3 https://<server>/dns-query https://root.hagezi.org/dns-query
DoT <server>, port 853 root.hagezi.org
DoQ <server>, port 853 root.hagezi.org

Use the DNS Stamps for compatible apps (auto-configuration), or set it up per platform below.

Warning

Don't enable DoH, DoT, and DoQ against the same server at the same time. It doesn't add protection, only wastes your rate-limit allowance and can slow things down.

3. Platform setup

Apple (iOS, iPadOS, macOS): manual DoH/DoT entry isn't supported in system settings. Use the official mobileconfig profile instead:

Server Apple Config
root.hagezi.org Profile · QR
wurzn.hagezi.org Profile · QR
juuri.hagezi.org Profile · QR
ctif.hagezi.org Profile · QR

Install the profile via Settings, or scan the QR code with your camera.

Android (9+): Settings → Network & internet → Private DNS → Private DNS provider hostname → enter the server, e.g. root.hagezi.org. This uses DoT.

Windows (11):

  1. Go to Settings → Network & internet → [your Wi-Fi/Ethernet connection] → Hardware properties → DNS server assignment → Edit.
  2. Change the dropdown to Manual, and turn on IPv4 (and/or IPv6).
  3. Under Preferred DNS, enter the server's IP address, e.g. 188.34.161.210 for root.hagezi.org (see the Do53 table for other servers).
  4. Under DNS over HTTPS, select On (manual template).
  5. In the DNS over HTTPS template field that appears, enter the matching DoH URL, e.g. https://root.hagezi.org/dns-query.
  6. Leave Fallback to plaintext off, so queries always stay encrypted.
  7. Optionally repeat steps 3 to 6 under Alternate DNS with a second server, or leave it empty.
  8. Select Save.

Note

On some Windows 11 builds, the manual template field may stay greyed out for servers not in Windows' built-in list (Cloudflare, Google, Quad9). If that happens, register the server first via an elevated PowerShell prompt: Add-DnsClientDohServerAddress -ServerAddress '188.34.161.210' -DohTemplate 'https://root.hagezi.org/dns-query' -AllowFallbackToUdp $False -AutoUpgrade $True, then repeat the steps above.

Router or other OS/app: most consumer routers only support classic, unencrypted DNS (Do53). In that case, enter the IPv4/IPv6 addresses from the table below directly as your router's DNS servers, so every device on your network is protected automatically, no per-device setup needed.

If your router or firmware supports encrypted DNS, use the DoH URL or DoT hostname instead of the Do53 IPs:

  • OpenWrt: configure via https-dns-proxy (DoH) or stubby (DoT) in LuCI.
  • pfSense / OPNsense: set up as a DoT forwarder in the Unbound DNS Resolver settings.
  • FRITZ!Box, ASUS, and other consumer routers with encrypted DNS support: look for a "DNS-over-HTTPS", "DNS-over-TLS", or "Encrypted DNS" field in the router's DNS or internet settings and enter the DoH URL or DoT hostname there.
  • Not sure your router supports it? Stick with the Do53 IPs below, they work everywhere and protect the whole network with zero per-device configuration.

4. Unencrypted fallback (Do53), only if nothing else works

Server IPv4 IPv6
root.hagezi.org 188.34.161.210 2a01:4f8:c17:1c66::1
wurzn.hagezi.org 159.69.155.94 2a01:4f8:1c1c:d363::1
juuri.hagezi.org 95.217.163.17 2a01:4f9:c013:dc4e::1
ctif.hagezi.org 162.55.58.40 2a01:4f8:1c19:6c19::1

5. Verify it's working

Run a DNS leak test. If it shows an IP address other than the ones above, your device or network is bypassing this DNS setup.

6. Something not working?

Check the server status pages first: root.hagezi.org · wurzn.hagezi.org · juuri.hagezi.org · ctif.hagezi.org. If the server looks healthy but you still can't connect, then reach out via support@hagezi.org or the Matrix chat.

5 things to know

  1. Free, non-commercial, no account, no data sold, EU-hosted only.
  2. No logging of individual queries; only short-lived, anonymized stats (max. 1 hour, RAM only).
  3. A domain wrongly blocked or missed? Report it via support@hagezi.org or the Matrix chat.
  4. This is one layer of protection, not a replacement for antivirus, a firewall, or your own judgment.
  5. Full legal disclaimer, privacy policy, and DSA compliance info live in PRIVACY, not required reading to just use the service.