DeCloudUs

In this release, we replaced all DeCloudUs DNS servers in Germany with new hardware and server architecture, which will enhance DNS servers performance and our ability to scale easier in the future.

• DeCloudUs DNS Germany servers were built roughly two years ago. While this is not a long time ago, relatively speaking, DeCloudUs DNS has evolved very rapidly over the past two years, which is certainly a blessing; however, we quickly realized that the original hardware and architecture had limitations that we encountered more often than we liked. We decided to re-architect the DNS server network and infrastructure to better fit what DeCloudUs DNS has evolved to become and meet our future needs
• For most users, there is absolutely no action needed from your side. DeCloudUs DNS server addresses (DoT, DoH, and DNSCrypt) were automatically changed to point to the new servers. For advanced users: if you currently bootstrap an IP to DeCloudUs DNS server address or if you used static DNS Stamp, please re-examine your configuration and update bootstrap IPs and DNS Stamps.

In this release, DeCloudUs DNS Custom Server extended the ability to use a custom upstream DNS server and added 10 more services to the "Block Additional Services" section.

• Custom upstream DNS server setting: users are now able to add any public DNS server as their upstream resolver for ultimate freedom and control. When DeCloudUs DNS receives your DNS queries, it first checks to see if the domain/subdomain to be resolved is blocked per your settings. If the domain/subdomain is blocked, DeCloudUs Custom DNS immediately returns 0.0.0.0 as the response; otherwise, the query is then sent to upstream recursor to resolve the IP address of domain/subdomain. By default, DeCloudUs uses its own internal recursive resolvers that are expertly configured for optimal performance, speed, and security to resolve domains/subdomains to IPs. The new setting allows you to replace DeCloudUs internal recursive resolvers with any public DNS resolver as your upstream. For most users, we recommend using the default setting; however, you can change this setting based on your needs to: use alternative DNS roots (such as OpenNIC), use/access decentralized TLDs (such as OpenNIC TLDs), obfuscate the use of DeCloudUs DNS from fingerprinting, etc. Please keep mind that quality of the upstream server you choose will be directly tied to the quality and reliability of your DNS service, so please use this setting with care.
• Additional blocked services options: there are now 10 additional services available for one-click blocking: mail.ru, vk.com, Discord, Skype, Viper, WeChat, ok.ru, qq.com, Telegram, and Weibo. This now makes for a total of 30 services available to be blocked by a simple click, in addition to 8 other broader categories and thousands of custom rules that you can also create.

In this release, DeCloudUs DNS Custom Server extended the ability to develop DNS rewrite rules and added a new block category for Premium Plus subscribers.

• Custom DNS rewrite rules: via existing blocklist, users are now able to add DNS rewrite rules to be in full control for how DeCloudUs Custom DNS responds to a particular domain or subdomain query. Through this feature, users are able to create their own private DNS records; for example, if you have a device that you only access when connected to your home network, you can create a DNS record for this device on Custom DNS to respond with the private IP (i.e. mydevice.home^=10.1.1.3). You can also use this feature to instruct DeCloudUs Custom DNS to respond with a different IP address for a particular domain or subdomain; for example, if you have a device with hardcoded Google NTP server name, instead of letting it connect to Google IP, you can configure Custom DNS to serve the IP address of a different non-Google NTP server (i.e. time1.google.com^=1.pool.ntp.org). To use the feature, please visit Custom DNS settings page to see syntax instructions and examples.
• "Privacy Extreme" setting: Custom DNS added "Privacy Extreme" block category. This will block additional services that are often embedded within popular sites that could be used to track your activities. These additional domains are not part of our "Privacy by Default" baseline because blocking them is known to cause an impact, in certain cases, on sites features and functionality. While Custom DNS users always have the ability to block any domains/sites/services beyond our baseline, we wanted to make it a little easier to more aggressively block thousands of additional domains by a click of a button. If you enable this setting, you are encouraged to use the custom whitelist to unblock/allow domains that impact your personal online activities.

In this release, DeCloudUs DNS Custom Server extended the ability to "deApple" and "deMicrosoft" to Premium Plus subscribers.

• Added "deApple" option to Custom Server: this option blocks nearly 6,000 apex/root domains (not just subdomains) registered to Apple. Over the past few months, we received many requests from subscribers to add a blocklist for Apple as many users with Apple devices are increasingly uneasy about what Apple does with the data it collects. While it was always possible to block popular Apple domains via Custom Blocklist, that Premium Plus subscribers have access to, many users were looking to DeCloudUs to make it a one-click setting, which makes sense since Apple is not just a major hardware and OS company but also embeds its cloud services in every device it sells. It is certainly expected for Apple users to allow specific hosts/subdomains needed for important functions such as device software updates; to make that task easier, we provided a link that includes a list of specific subdomains for popular Apple services so that a user can evaluate what to allow.
• Added "deMicrosoft" option to Custom Server: this option blocks over 30,000 apex/root domains (not just subdomains) registered to Microsoft. Microsoft has different lines of business that are fairly similar to Google: Windows is a popular OS on millions of devices that has increasingly been including more embedded Microsoft cloud services and Microsoft does run an online Ads business, so it is reasonable to expect that they collect user data for better ad performance. Since Microsoft owns tens of thousands of root domains, we decided to add a setting that blocks all of these domains with a simple setting. There are some necessary services that some users may want to allow (such as Windows OS updates); to make that task easier, we provide links that list the different subdomains Microsoft uses to deliver certain popular services, so that a user can evaluate what to allow.
• To use these settings, simply visit your Custom DNS page and select these options to enable them. Like the "deGoogle" option, these new settings are very powerful in completely blocking Apple and Microsoft. DeCloudUs aims to provide you with options and tools that you can use however you see fit based on your privacy goals. We would strongly recommend you to learn about what services/subdomains you need to allow for your devices, via the links we provide for reference under these settings, if you opt to enable them.

In this release, DeCloudUs DNS servers implemented advanced filtering capabilities that are second to none along with implementing our own recursive resolvers.

• Added malicious IP address blocking based on Threat Intelligence feeds. Many DNS resolvers are capable of parsing DNS queries and blocking DNS lookups for specific domains/subdomains, if they exist on a blocklist. DeCloudUS DNS servers are also capable of parsing DNS responses and blocking the response if a domain/subdomain resolves to a known malicious IP address. Registering malicious domains/subdomains is fairly easy and cheap; once a domain/subdomain is added to a blocklist, the malicious service owner can simply point the service IPs to new domains to get around that. Obtaining new/different server IPs is more difficult though. To better protect your traffic, we obtain daily threat intelligence feeds for server IPs that are proven to be malicious; regardless of the domain/subdomain, if these IPs show up in DNS responses, DeCloudUs DNS servers will respond with 0.0.0.0 instead to protect your devices. To prevent false positives, once the IP address ceases malicious activities (typically when the malicious service is taken down), the IP address is then removed from the blocklist, which is refreshed at least once a day. It is also worth mentioning that Custom DNS extends the ability to block by response IPs to Premium Plus users through custom blocklist.
• Launched DeCloudUs DNS own recursive resolvers. As you may have seen in the past, DeCloudUs DNS servers upstreamed non-filtered DNS queries to Quad9 and Cloudflare (which was done in a way that guaranteed Quad9/Cloudflare would know absolutely nothing about you as the user or what DNS queries a specific user was submitting). This was done mainly to reduce computing overhead and also deliver speedy responses. Surprisingly, we noticed some issues with Quad9 and Cloudflare over the past year: Quad9 responses would timeout once in a great while, which caused DNS errors for end users; Cloudflare delivered outdated responses on more rare occasions when certain DNS entries had large TTLs. As DeCloudUs grew, we became confident that we could do better. It took a couple of months to build massive recursive resolvers and configure them in a way that rivals Quad9/Cloudflare speed. Based on weeks of benchmarking, our recursors were often faster in resolving domains/subdomains that were not cached by Quad9/Cloudflare (sometimes twice as fast); when a DNS entry is cached by our resolvers, they are 10 times faster in responding. With all things considered, averaging the response times when benchmarking one million largely diverse requests, our resolvers were indeed slightly faster. Over the last two weeks, we configured all DeCloudUs DNS servers to use our own recursive resolvers. For you, this means faster and more reliable DNS with the peace of mind that no other provider is involved with you DNS queries whatsoever. Now, if you do a DNS Leak Test, you will only see "resolver.decloudus.com" as the DNS resolver.

In this release, DeCloudUs reached a big milestone of operating DNS servers globally and giving users the choice of selecting specific server location to use. This release also saw other major enhacements detailed below.

• Added DeCloudUs DNS servers in USA. DeCloudUs DNS users are from all over the world; the closer the user is to a server location, the faster the DNS service will be. Previously, DeCloudUs only operated DNS servers in Germany. With additional DeCloudUs DNS servers operating in the USA, users in the Western Hemisphere will see DNS responses up to 80% faster. It is important to note that DeCloudUs DNS servers, regardless of location, have the same strict privacy policy. Since DeCloudUs DNS ONLY supports encrypted DNS protocols, it is simply impossible for any entity to know what DNS queries are being made to DeCloudUs DNS servers in any country or location.
• Added the ability for users to restrict their DNS traffic to a specific location. By default, user DNS traffic is automatically routed to the DeCloudUs DNS server closest to them. The default setting ensures optimal DNS speed and availability. If servers in one location experience a failure or prolonged outage, the default setting automatically routes your DNS traffic to a different server location that's operational. However, if a user has a strong preference to restrict their DNS traffic to only one specific location, we added the ability for users to easily do that.
• Added the ability to do one-time direct invoice payments via Stripe when automatic payment fails. There are countries (such as India) and some banks and card issuers that reject automated subscription payments and require direct one-time payments. To solve this problem, when an automatic payment fails, we provide the user with a link to make direct, one-time invoice payment that satisfies the restrictions placed by these countries and banks. This is specific to Stripe being the payment method.
• Enhanced the Apple mobileconfig generator tool and clarified the instructions. We noticed that some browsers were downloading the mobileconfig files as txt, so we modified the tool to ensure it always downloads with .mobileconfig extension. We also clarified some of the instruction steps with better screenshots.

In this release, DeCloudUs greatly expanded filtering capabilities for malicious sites and added more choices and block options for Premium Plus:

• Expanded the "Security By Default" filters to block over 600,000 additional sites that are known to be malicious (spreading malware and/or used for phishing). The expanded filters were applied to all Premium and Premium Plus servers and will be continuously kept up-to-date moving forward.
• Extended Custom DNS ability to block more site categories. Now, with a click of a button, users can easily block these new site categories: piracy and illegal content sites, online gambling sites, and crypto sites (cryptojacking, crypto-mining, etc). DeCloudUs is committed to giving users the ability to fully and easily control what to block or allow.
• Applied many site content and navigation enhancements.

In this release, DeCloudUs added the ability to accept crypto payments for subscription along with many other site enhancements that improve usability and user experience:

• Added the ability to subscribe via cryptocurrency (BTC and LTC) in the utmost privacy-friendly and user-friendly way. A user only needs to provide an email address to receive server details and manage subscription. Through our carefully designed subscription management flow, the user is able to generate an invoice and submit crypto payment to extend the subscription expiration date at anytime. The user is able to easily manage the subscription profile (change email address, extend subscription, cancel subscription) directly from the DeCloudUs portal with minimal effort.
• Added mobile-friendly and touch-friendly sub-navigation menus on pages with multiple sections for ease of navigation.
• Added more extensive user-friendly error and success messages as feedback for the different actions users perform.

In this release, DeCloudUs Premium and Premium Plus servers implemented major enhancements that significantly reduced DNS resolution time along with many new user features for Premium Plus Custom DNS server:

• Implemented major updates and upgrades to upstream DNS servers load-balancing, reducing DNS resolution time by 30%.
• Extended Custom DNS server ability to block/allow domains/hostnames by IP address they resolve to, with the ability to block/allow individual IPs or entire IP subnets.
• Added troubleshooting DNS querying/dig tool in Custom DNS management page. Since Custom DNS server is fully customizable, DNS queries results are unique to each user based on the DNS settings. Since DeCloudUs only supports secure DNS protocols, standard DNS troubleshooting and dig tools require advanced customization and configuration to work with DeCloudUs. To make it easier to troubleshoot any DNS issue users may have, the dig tool shows direct DNS responses from the user's Custom DNS server.
• Reformatted Zulu whitelist to make it easier to read and understand.

• Released new Custom DNS service under a new Premium Plus service plan. This new service plans gives access to all current Premium servers in addition to a custom DNS server where users get complete and full control over what sites to block or allow.
• Added "Manage Your Subscription" section in the server list details users currently have access to. In this section, there is a button that will allow users to manage their subscription profiles (update email address, update payment method, or cancel subscription) directly through the payment provider (PayPal or Stripe).

• Implemented payment integration with Stripe in addition to PayPal, extending the payment/subscription methods allowed to give users more options.
• Launched Echo Premium DNS server avaiable to all Premium subscribers. Echo servers block ads (including Google Ads), trackers (including all Google trackers), and known malware sites while leaving non-ad and non-tracker Google services and sites running. Echo DNS servers are best suited for devices or an entire home network where Google services are in wide use, but you still wish to enhance your privacy and online safety.

• Launched DeCloudUs Premium DNS service as monthly subscription plan. The plan gives us access to Production, Prime DNS servers with different filtering capabilities. Premium Servers operate on the community-based principle that those who contribute to a service should be the ones who benefit the most from it.
• Launched Alpha Premium DNS server available to all Premium subscribers. Alpha DNS servers are the "original" DeCloudUs DNS Premium servers where Google services and tracking are completely blocked (to fully deGoogle/unGoogle your device or your entire life, if you wish). In addition, the servers will also block ads, online trackers, and known malware sites.
• Launched Zulu Premium DNS server available to all Premium subscribers. Zulu DNS servers were built based on popular demand for "deGoogle/unGoogle light". Unlike Alpha DNS servers (that will completely block Google), Zulu DNS servers blocks most Google domains and tracking, but will allow some popular Google services to work, such as YouTube, Gmail, Google Search, Google CAPTCHAs, and Android App Notification

• Initial launch of DeCloudUs DNS as a community-powered project started with a mission to take back our digital privacy and preserve our online security.
• Launched Production servers available to all subscribers that make a donation, where Google services and tracking are completely blocked (to fully deGoogle/unGoogle your device or your entire life, if you wish). In addition, the servers will also block ads, online trackers, and known malware sites.
• Launched Test server available to anyone free to use. Test server is a replica of a Production server and fully functional; however, it not as reliable as it is prone downtime (during test cycles), small in size, capacity does not scale with usage, and maybe throttled or slow with high demand.