Dashboard

ShieldDNS is Active

Your requests are being filtered and secured.

Connection Guide (Updates based on your domain)

Private DNS (Android DoT Hostname)

DoT URL

DNS-over-HTTPS (DoH) URL

DNS-over-QUIC (DoQ) URL

Total Queries (24h)

Blocked Queries (24h)

Blocking Ratio

- %

Avg. Response Time

- ms

Unique Clients (24h)

Cache Hit Ratio

- %

Active QPS

0.0

Blocked Domains

Traffic Overview (Last 24h)

Live Query Log

Time	Domain	Client IP	Type	Status	Actions

Advanced Analytics

Top Blocked Domains

Domain	Hits

Top Clients

Client IP	Country	Queries

Query Types

A / AAAA: Standard website connections (IPv4 / IPv6 addresses).

HTTPS / SVCB: Modern secure connection and service metadata.

MX / NS: Mail server records and domain authority info.

TXT: Text data, often used for email verification (SPF/DKIM).

SRV / PTR / SOA: Service discovery, reverse DNS, and zone authority.

DNSKEY / DS: DNSSEC security records for authenticated DNS.

NAPTR / HINFO: Telephony (VoIP) and host hardware information.

ANY: General requests for all available records of a server.

Request Origin (Countries)

geo: Internal or local network traffic (Private IPs).

ISO Codes: International traffic categorized by country of origin.

-: Unknown or currently resolving origins.

Query Log

Time	Domain	Client IP	Type	Status	Actions

System Diagnostics

SSL Certificate

Loading certificate data...

System Status

API Reachability Online

DNS Port (53) Active

DoT Port (853) Active

Resource Usage

CPU Load (1/5/15m) 0.00, 0.00, 0.00

Detecting...

RAM Usage 0 / 0 MB

Disk Space 0 / 0 GB

Uptime 00:00:00

Upstream Performance

Upstream Server	Status	Response Time
Loading performance data...

Settings

Configuration Presets ⚙️

Apply a configuration preset to populate settings values. You must click "Save Configuration" at the bottom to save the changes.

Global DNS Settings ⚙️

Debug Mode

Write detailed diagnostic information to the system logs.

Upstream DNS Servers (Standard)

Comma separated IP addresses (Max 5)

Upstream DoT Servers (DNS over TLS)

Comma separated hostnames (Max 5). Example: unfiltered.joindns4.eu

Admin Domain (for Block Page)

The domain used for the Admin UI (e.g., dns.mydomain.de). Used for professional redirects.

Default IPv4 Block Page IP

Prefer Encrypted Upstreams (DoT)

Always try to use DNS-over-TLS if available.

DNS-over-HTTP/3 (DoH3 / QUIC)

Accelerate encrypted DNS queries via UDP/QUIC (HTTP/3). Prevents packet drops on mobile and unstable connections.

Encrypted Client Hello (ECH & HTTPS Records)

Enables full HTTPS/SVCB DNS record processing for end-to-end Encrypted Client Hello (ECH) TLS privacy.

DNS Rebinding Protection

Blocks upstream answers resolving to private IP ranges. Note: Custom local mappings (e.g. fritz.box, local routers) always remain reachable.

Privacy & Anonymization 🔒

Anonymize Client IPs (DSGVO / GDPR)

Masks the last octet of IPv4 and host bits of IPv6 addresses in query logs (e.g. 192.168.1.0).

Strip EDNS Client Subnet (ECS)

Strip client subnet data to prevent upstream servers from learning your network location.

Security & Abuse Detection 🛡️

Sign Apple Profiles (.mobileconfig)

Use the server's SSL certificate to sign generated profiles for a "Verified" status on iOS.

Abuse Detection Engine (Auto-Blocking)

Automatically block clients abusing the server with floods or DGA bots.

DGA Sensitivity Threshold

Lower is more sensitive (Default: 3.8). Blocks domains with high entropy.

DGA Minimum Length

Ignores subdomains shorter than this (Default: 8).

DoH Query Rate Limit (req/s)

Max requests per client per second on the DoH endpoint (Default: 50).

DNS Port 53 / DoT Rate Limit (req/s per client)

Queries per second per client on standard DNS, DoT, and DoQ (Default: 100, 0 = disabled).

DNS Flood Burst Allowance (queries)

Permitted burst capacity before dropping queries (Default: 250).

API Keys

Manage API keys for third-party monitoring and automation. Tokens are shown only once.

Name	Permissions	Created	Last Used	Actions

Model Context Protocol (MCP) 🤖

Enable native Model Context Protocol server for AI coding assistants and autonomous agents (e.g. Antigravity, Claude Desktop, Cursor).

Enable MCP Server

Allow authorized AI tools to inspect logs, manage rules, and monitor DNS state.

MCP Endpoint & Configuration

Connect your AI assistant by generating an API Key with exec:mcp permission and configuring the endpoint:

Endpoint: /api/mcp?token=<YOUR_API_TOKEN>

Antigravity: {"mcpServers":{"shielddns":{"url":"https://<your-domain>/api/mcp?token=<TOKEN>"}}}

Smart Networking & Maintenance

Smart Upstream Selection

Dynamic latency sorting for fastest response times.

Data Retention (Days)

Latency Test Interval (Minutes)

Frequency of response time checks. Distributed across the interval.

Diagnostics Refresh Interval (Seconds)

Frequency of hardware resource updates (CPU, RAM, etc.) in Diagnostics view.

Smart Selection Mode

Strategy used for upstream selection when Smart Selection is active.

Enable Serve Stale

Serve expired cache entries while refreshing in background (faster perceived speed).

DNSSEC Validation

Perform full local DNSSEC validation. Disable to offload to upstream (recommended for speed).

Verify Upstream TLS

Ensure upstream servers provide valid, trusted certificates.

System Backup & Restore

Download a full system backup (.zip) or restore your configuration (.json).

Threat Intelligence 🛡️

Automatically block high-risk IP addresses from public threat feeds (blocklist.de).

Malicious IP Blocking

Enforce real-time protection using curated threat lists.

Update Interval (Hours)

How often to refresh the threat feed (Range: 1-168 hours).

Geo-Blocking 🌍

Block entire countries from accessing or resolving through this DNS server.

Select Countries to Block

Client IP Blocking 🚫

Manually block specific client IP addresses or view automatically blocked clients.

Block New Client IP

Currently Blocked Clients

0 Clients Blocked

Autoblock Whitelist 🛡️

Prevent specific IPs from being banned by the automated security system.

IP Address	Blocked At	Country	Reason	Actions

Full System Refresh 🔄

Perform a total refresh of all system components. This will re-download all enabled filter lists, reload all custom rules (IP/Geo), and restart the CoreDNS server to apply changes and flush its cache.

Note: This process usually takes a few seconds. DNS resolution will be briefly interrupted during the restart.

Security 🔐

Multi-Factor Authentication (MFA) 🛡️

Add an extra layer of security to your account using TOTP (Authenticator App) or Passkeys (biometrics, security key, or device PIN).

Status: Checking...

Cluster & Federation 🌐

Synchronize configuration across multiple ShieldDNS instances (e.g. primary cloud resolver + secondary local network appliance with failover).

Cluster Role

Cluster Node Name

Human-readable label for this server in query logs and cluster overviews.

Environment Profile

Cluster Query Log Replication

Control how DNS query logs are aggregated across cluster members.

Cloudflare Worker Dispatcher Domain

Optional DNS hostname for a Cloudflare Worker edge distributor. When set, this hostname is presented in setup profiles and trusted for cluster dispatching.

Protocol Capabilities & Redundancy Scope: ✅ DoH / DoH3 (Port 443): Full Worker routing, active failover, and Geo-steering.
ℹ️ DoT / DoQ / Plain DNS (Port 853 / 53): Cloudflare Workers only proxy HTTP/HTTPS. For DoT/DoQ/UDP failover, configure dual A/AAAA DNS records for your domain so client resolvers automatically fallback between nodes.

View Template on GitHub

Privacy & Transparency

GDPR compliance overview — how ShieldDNS processes and protects your data.

Active Privacy Protections

Current server-side privacy settings. Change these under Settings → Privacy & Anonymization.

Client IP Anonymization (GDPR) Loading…

Strip EDNS Client Subnet (ECS) Loading…

Encrypted Upstream Transport (DoT / DoH) N/A

Query Log Retention Loading…

DNS Filtering (Malware & Tracking) Loading…

Data Processed

Queried Domains Yes — locally only

Timestamps Yes — auto-purged

Client IP Addresses Yes — anonymized or full

Response Codes Yes — locally only

Personal Profiles / Tracking Never

Cookies / Browser Fingerprints Never

Third-Party Analytics Never

Data Minimization & Retention

Storage Location This server only

Upstream Data Sharing None — zero tracking

Automatic Log Purge After retention period

IPv4 Anonymization Mask /24 (last octet zeroed)

IPv6 Anonymization Mask /64 (host bits zeroed)

Data Subject Rights (GDPR Art. 12–22)

Right of Access (Art. 15) Query Log view

Right to Erasure (Art. 17) Settings → Clear Query Log

Right to Data Portability (Art. 20) Query Log → CSV / JSON

Right to Rectification (Art. 16) Via Settings page

Right to Restriction (Art. 18) Disable logging (0 days)

Technical Privacy Features

DNS-over-TLS (DoT) Port 853

DNS-over-HTTPS (DoH) HTTPS / QUIC (H3)

Encrypted Client Hello (ECH) HTTPS record support

EDNS Client Subnet stripping Configurable

No upstream personal data Guaranteed

Legal Basis & Controller

Legal Basis Legitimate interest (Art. 6(1)(f) GDPR) — operating a private DNS resolver for abuse protection, security filtering, and network diagnostics.

Data Controller The operator of this ShieldDNS instance. This is a self-hosted application — the controller is the person who deployed it, not ShieldDNS developers.

Third-Party Processors None. All data remains on this server. Upstream DNS resolvers receive only the queried domain — never client IPs (when ECS stripping is enabled).

Privacy Quick Actions

Exercise your rights or review data directly from here.

About ShieldDNS

High-performance DNS appliance for the modern web.

Environment

ShieldDNS Version v1.11.0

CoreDNS Version v1.14.7

OS Base Alpine 3.24.1

ShieldDNS Updates

Latest Available Version: Checking...

Update Channel

Choose which channel of updates to follow.

Auto-Update

Install updates automatically during the night.

Project Links

Repository Releases Report Issue

Project Statistics

Codebase metrics generated during the build process.

Code Breakdown

Layer	Files	Lines

Test Coverage

Suite	Files	Tests

Project Contributors

List of project contributors sorted by commit count.

Username	Last Commit	Commits

ShieldDNS is Active

Connection Guide (Updates based on your domain)

Traffic Overview (Last 24h)

Live Query Log

Top Blocked Domains

Top Clients

Query Types

Request Origin (Countries)

SSL Certificate

System Status

Resource Usage

Upstream Performance

Custom Blocklist

Custom Allowlist

Local DNS Mappings

Your Active Blocklists

Your Active Allowlists

Suggested Blocklist Presets

Suggested Allowlist Presets

Configuration Presets ⚙️

Global DNS Settings ⚙️

Privacy & Anonymization 🔒

Security & Abuse Detection 🛡️

API Keys

Model Context Protocol (MCP) 🤖

MCP Endpoint & Configuration

Smart Networking & Maintenance

Threat Intelligence 🛡️

Geo-Blocking 🌍

Manual Server Location (Fallback)

Client IP Blocking 🚫

Currently Blocked Clients

Full System Refresh 🔄

Security 🔐

Multi-Factor Authentication (MFA) 🛡️

Set Up Authenticator App

Authenticator Apps (TOTP)

Security Keys & Passkeys

Cluster & Federation 🌐

Connected Replicas

Primary Server Connection

Active Privacy Protections

Data Processed

Data Minimization & Retention

Data Subject Rights (GDPR Art. 12–22)

Technical Privacy Features

Legal Basis & Controller

Privacy Quick Actions

Environment

ShieldDNS Updates

Project Links

Project Statistics

Code Breakdown

Test Coverage

Project Contributors

ShieldDNS Setup

Step 1: Role & Security

Step 2: Upstream Configuration

Step 3: Blocklists

ShieldDNS Login

MFA Challenge 🛡️

Add Blocklist

Generate API Key

⚠️ High Risk Operation

Final Confirmation

System Resetting...

Notification

Confirmation

Enter Name

List Details

Client Details

Top 10 Domains (Allowed)

Top Blocked Domains

Recent Activity

Domain Details

Top Clients for this Domain

Recent Queries

Create System Backup

Import Encrypted Backup

Backup Overview & Selection