DeCloudUs

We receive many inquiries about how DeCloudUs DNS uses other "cloud" or "big tech" service providers in the DNS service. These inquiries often cite other privacy-touting DNS providers that use Cloudflare Workers, Google hosted services, Cloudflare proxies, Amazon loadbalancers, etc. The answer to that question is simple, there are no other providers or cloud services used in our DNS servers whatsoever.

First, unlike other providers, we are fully transparent about the third parties DeCloudUs uses, in any way, in our "User Agreement and Privacy Policy" page (there are none for DNS servers). In short, we self-host all of our servers. We do not use "cloud" servers; rather, we lease hardware servers from data centers and we then install and manage all componets: firewall, Operating System, web server, DNS server, etc. While this is indeed more complex and more expensive than using "cloud" providers to deliver our service, it is the only way to guarantee optimal privacy and security, since we are in control of the DNS traffic and we do not trust it to any other provider. If we were to use Cloudflare Workers or proxies for example, Cloudflare would then, likely, be able to see unecrypted DNS queries/traffic coming from your IP address. That would never be OK with us; after all, what is the point of using a privacy-focused DNS service when all DNS traffic is handled by a third party provider that may have different privacy policies that the DNS service does not control?

To conclude, we are committed to your privacy and security as outlined in our privacy policy. One of the main reasons behind our service is to "decloud" and take charge of our data and privacy from large tech companies that control most of the Internet. For us, building our DNS service on the top of other cloud services is simply not an option.

The short answer is no and no. There is no DNS query/request limit and there is certainly no limit on the number of devices you can use DeCloudUs DNS on. You can set up DeCloudUs DNS on as many devices as you wish, for you and your family in the same household.

As a baseline, every DeCloudUs DNS server provides "Privacy by Default" and "Security by Default" that collectively block over one million domains:

Privacy by Default: all DeCloudUs DNS servers block all known ads, trackers, analytics, and web beacons domains from anywhere (the ones you see and the ones behind the scenes). This also includes device-specific trackers for a wide variaty of popular devices such Samsung, Apple, Microsoft, Google, Roku, Xiaomi, etc. These domains compromise your privacy and track your activities across the web to the profit of the companies using them. They provide no value and no benefit to you, so blocking them will not negatively impact your online experience. In fact, by blocking these domains, in addition to privacy protection, your online experience will be significantly enhanced by eliminating annoying ads and speeding up your browsing.

Security by Default: all DeCloudUs DNS servers block a wide variaty of malicious sites that are used for phishing, spam, and spreading malware. DeCloudUs DNS uses various Threat Intelligence feeds to obtain the most up-to-date data on active malicious sites every day. In addition, DeCloudUs DNS is capable of blocking domains based on the IP address they resolve to; DeCloudUs blocks 1000s of malicious IPs, which in return blocks unlimited number of malicious domains that resolve to these IPs. While you should always remain vigilant of malicious sites, DeCloudUs DNS will help you stay safe online.

DeCloudUs DNS supports encrypted DNS protocols: DNS over TLS (DoT), DNS over HTTPS (DoH), and DNSCrypt in order to keep your DNS traffic private and secure. In addition, DeCloudUs keeps no DNS logs to ensure that no one can see what DNs quries you are submitting.

Using DNS-based proxy (SmartDNS) comes with a grave privacy cost to you as the user. Providers of such service have to store/log your IP address in order for the service to work properly, since the IP address will be used to authenticate the user to the proxy service. This is something that you can confirm by reading the privacy policies for such providers. From our perspective, that's too much information to store and directly counters the mission of providing users more privacy; we never store/log user IPs for our service and, in fact, we purposely architected our service in a way to make that not possible.

A better option would be to use a standalone VPN or HTTP Proxy service because they would not need to store/log your IP address. You can certainly use DeCloudUs DNS in combination of standalone VPN or HTTP Proxy to achieve your privacy goals. We would recommend using VPN and HTTP Proxy providers with solid privacy-focused policies.

You can fully control what sites and services to block or allow with a few clicks when using Custom DNS, including blocking adult sites, social media sites, streaming services, and much more. You can also manually add additional domains and subdomains to be blocked or allowed. This gives ultimate control over your online privacy and security and makes for a great Parental Control tool, if you need it.

Yes, it absolutely is! DNS level blocking can actually be more effective in blocking all these things and much more. With DeCloudUs DNS, unlike other content blockers, there is no additional software or apps to install - just a simple DNS setting change. Once your device, system, or home network is configured to use DeCloudUs DNS, you you have complete control over what to block or allow in a very thorough and granular way. For example, if you configure a device to use DeCloudUs with deGoogle, deApple, or deMicrosoft option enabled, DeCloudUs will block all these services from running anywhere on your device - in places you see and you don't see - within the Operating System, mobile apps, or browser.

The same applies to anything DeCloudUs blocks, based on your settings, from ads, trackers, phishing, malware, adult sites, Google, Apple, Microsoft, social media sites, streaming services, etc. And due to the flexibility of DNS-based blocking, you can use it selectively for a browser, for an entire device or system, or for an entire network. You can also use different DeCloudUs DNS servers on different devices per your needs.

Best of all, don't take our word for it.. go ahead and try for yourself how effective DeCloudUs DNS can be for your own needs! We offer a 10-day free trial for our Premium Plus, so you can get access to all of our servers risk-free.

Using a custom ROM or mobile operating system that respects your privacy is good solution. Rooting your phone to remove Google services can also work well. However, there are a few reasons for why that would not be possible:

• You have a work phone that you cannot root or load custom ROM on
• Your existing phone is not supported by deGoogled/unGoogled custom ROMs (and you cannot afford to get a new phone).
• You do not have the technical knowledge to root your phone

In such cases and others, deGoogling your phone via DNS block is a good alternative.

Also, even if you have a custom ROM or rooted phone, Google and many other trackers will still run as it is embedded within many apps and sites. So you may still need a solution that will block Google, trackers, ads, and known malware sites.. like DeCloudUs DNS.

Yes, absolutely DeCloudUs can help! It is completely understandable that deGoogling is not for everyone. DeCloudUs can still help you achieve more privacy and security online with no impact on your favorite Google services. DeCloudUs offers Echo DNS Servers and Custom DNS Servers exactly for that purpose.

Echo servers block all ads and trackers (including Google ads and trackers), but allow most Google consumer and business services to still work. Echo servers will improve the quality of your online experience by blocking annoying ads on browsers and within mobile apps, which will speed up your browsing. Echo servers will also enhance your privacy by blocking trackers that run in the background without your knowledge; these trackers serve no real purpose other than being used by ads and marketing companies to gather more and more information about what you do online. Consumer and business services (that are not ads or trackers) offered by Google and other companies will work perfectly fine with Echo servers.

In addition to Echo servers, Premium Plus subscribers have access to Custom DNS servers. Using Custom DNS, you are in complete control for what to block or allow. As a baseline, Custom DNS will block all ads and trackers (including Google ads and trackers) and malicious websites. You can then specify other services or websites you wish to block to further enhance your online privacy based on your needs.

We only use secure DNS protocols, that's why DeCloudUs DNS supports popular secure DNS protocols: DNSCrypt, DNS over TLS (DoT), and DNS over HTTPS (DoH). DeCloudUs does not support plain DNS (where you use a IP address) as your DNS traffic would not be secure or private, which counters the mission of using a privacy-focused DNS service.

You can use DeCloudUs DNS on any device or software that supports DoT, DoH, or DNSCrypt, which is fairly wide-spread nowadays. If your network device/router does not support encrypted DNS, you can set up secure DNS directly on individual devices that you wish to secure (mobile devices, laptops, browsers, etc). Alternatively, you can install additional software on your network to extend secure/encrypted DNS to your entire network (such DNSCrypt or Stubby).

DeCloudUs DNS only supports secure and encrypted DNS protocols (DoT, DoH, DNSCRYPT). So there is no option to use the typical, cleartext DNS over port 53, which is what your VPN provider expects by asking for direct IPs. As stated in FAQ above, using cleartext DNS (just the plain IP address) is vulnerable to multitude of attacks that can compromise your security, even if you do it in combination with VPN.

For OpenVPN in general (which is what most VPN providers use), it is possible for VPN tunnel to use your device's DNS settings so you do not have to configure DNS IPs with the VPN provider. For mobile phones, for example, Private DNS option is set to use DeCloudUs DNS in android settings, as outlined in How-To section. Most VPN proivders allow you to download a VPN client profile to modify and use on other OpenVPN apps (like the official OpenVPN app). The OpenVPN client profile you use from the VPN provider doesn't have any parameters regarding DNS settings. DNS queries are then handled by DeCloudUs DNS, while the tunnel is up and running.

This can also work the same way on other devices such as tablets, PCs, etc; simply configure the device to use DeCloudUs DNS directly (as outlined in the How-To section) and do not configure DNS settings for OpenVPN; at that point, the device would use its own DNS settings (i.e. DeCloudUs secure and private DNS) to resolve DNS queries while also tunneling the traffic to your VPN provider.

Yes, you certainly can! You can set DeCloudUs DNS as your upstream DNS resolver for AdGuard, pfSense, Pi-hole, OpenWrt, DNSCrypt-Proxy, etc. DeCloudUs DNS supports DoT, DoH, and DNSCrypt, so you have many options to choose from depending on what secure DNS protocols your device supports.

Note regarding AdGuard Home: when adding DeCloudUs Alpha or Zulu in the upstream server settings and clicking the "Test Upstream" button, you may see an error saying it cannot be used. Simply ignore this and just click "Apply" button to save and apply the settings; you will see that AdGuard Home works just fine with DeCloudUs DNS as upstream server . The reason this happens is becuase AdGuard Home is testing whether the upstream DNS server is working or not by resolving "google-public-dns-a.google.com". DeCloudUs Alpha and Zulu (which are used for DeGoogling, blocking trackers, ads, etc..) return 0.0.0.0 for google-public-dns-a.google.com (as opposed 8.8.8.8); solely based on that, AdGuard Home displays an error when clicking the test button; so it is safe to ignore that error and simply save your settings and AdGuard Home will start using DeCloudUs with no issues. DeCloudUs Echo servers do not cause this error with the test button in AdGuard Home becuase Echo servers are only for blocking Ads, trackers, phishing, malware, and malicious sites.

DeCloudUs DNS is NOT a custom software. DeCloudUs DNS is a service comprised of DNS servers, resolvers, and recursors. DeCloudUs DNS server components are built SOLELY using open source software: Debian OS, Nginx, Encrypted DNS Server, acme.sh, etc), so there is no need for Github or Gitlab repo to share DNS server source code. What makes DeCloudUs DNS unique is how we fit all these open source components together in a way to deliver personalized DNS customization along with the advanced block/filtering lists to deGoogle, deApple, deMicrosoft, block ads, adware, trackers, known malware sites, adult sites, social media sites, etc, in addition to our unwavering policies regarding privacy and security.

If you are a Premium Plus subscriber, you can create a log-enabled DNS profile that will allow you to view all DNS queries and their responses.

If you do not have a Premium Plus subscription or you do not wish to create log-enabled profile, there certainly are many other ways for you to see DNS query logs from your side (client-side). Here are some examples:

Troubleshooting Tool: DeCloudUs DNS provides a troubleshooting tool for Premium and Premium Plus. The Troubleshooting tool allows to enter any domain or subdomain and then immediately tells you if it is blocked or not.

Browser Developer Tools: When accessing a web site, to find what domains or subdomains are blocked when visiting this site, you can use browser Developer Tools network monitor (such as Firefox for example https://developer.mozilla.org/en-US/docs/Tools/Network_Monitor). First, you set the browser DoH to use DeCloudUs DNS (as outlined in the How To section). The network monitor will show a "Domain" column and "Status" column when you visit a site; if a domain is blocked by DeCloudUs DNS, the status for that domain will be empty/null; if a domain is not blocked, it will have a status of some sort. This allows you to easily identify what is being blocked when visiting a particular site/page.

Encrypted-DNS Client Apps (that show client logs) If you wish to view DNS logs associated to a mobile device or mobile app, there are many DNS client apps that support encrypted DNS that will show you detailed information about your DNS queries. For example, InviZible Pro (for Android) and DNSCloak (for iOS). While mobile devices have native support for encrypted DNS and DeCloudUs DNS can (and should) be configured directly on the device, if you have a need to see the device DNS queries, you can install such a DNS client app and configure it to use DeCloudUs DNS; this will allow you to see full details for your encrypted DNS traffic.

Please contact us and we will certainly look into it. Please let us know the following:

• The exact URL that should or should not be blocked (otherwise it will be a wild goose chase!)
• The server you are using (DoT/DoH URL or DNSCrypt stamp).

We can certainly look into it to see if it is possible. Here are the general guiding principles to follow for whitelisting subdomains on Zulu DNS servers:

• It must be targeted whitelisting (for example, only one or two subdomains are needed for the requested service to run).
• It cannot be a core Google subdomain used in many other services (for example, accounts.google.com, googleservices.com, etc).
• It must not have a large impact on user privacy, espeically if it is a Google service that runs in the background without a user knowing (for example, googleapis.com).

If your request follows these general principles, please contact us. Zulu whitelist is published here for all users to see: https://decloudus.com/zulu-whitelist.txt. Otherwise, you are also free to fully control and customize your own deGoogling experience via Custom DNS.

The fastest way is to do a "DNS Leak Test" via an online tool such as dnsleaktest.com. Here is what you should see:

• For DeCloudUs Test DNS server, you should see IPs that belong to OpenNIC project. We recently decided to use OpenNIC alternative root DNS system for Test server. OpenNIC root DNS gives access to more TLDs not part of the standard DNS root.
• For DeCloudUs Alpha, Zulu, and Echo servers, you should see resolver Hostname "resolver.decloudus.com", which is our internal, super fast, ultra secure recursor resolver.
• For DeCloudUs Custom servers, you should see resolver Hostname "resolver.decloudus.com" by default. However, you can change "Upstream" resolver via custom server settings; so if you made a change, you should see the Hostname and IP of the DNS resolver of your choosing.