--- title: "DoH with Quad9 DNS Servers - qg58ahy9ww549ax" description: "Updated July 25, 2019" date: "2018-10-04T16:47:00+00:00" language: "en-US" canonical_url: "https://quad9.faceliftdesigns.com/news-blog-doh-with-quad9-dns-servers/" source_url: "https://quad9.faceliftdesigns.com/news-blog-doh-with-quad9-dns-servers/" content_type: "text/markdown" --- ![computer code background](https://quad9.faceliftdesigns.com/wp-content/uploads/2026/05/000002641638_Small1_600x200_e1538719897586_c69158a2fc.jpg) **Updated July 25, 2019** We’re happy to announce Quad9 now has support for [DNS over HTTPS](https://datatracker.ietf.org/doc/draft-ietf-doh-dns-over-https/) (aka DoH). DoH is a secure DNS protocol that is getting a lot of traction lately. [Mozilla](https://blog.mozilla.org/futurereleases/2018/09/13/dns-over-https-doh-testing-on-beta/) announced support for it in their [Firefox](https://www.mozilla.org/en-US/firefox/) browser and [Google](https://developers.google.com/speed/public-dns/docs/dns-over-https) recently announced support for developers and [Alphabet](https://abc.xyz/) through [Jigsaw](https://jigsaw.google.com/) released the [Intra](https://getintra.org/#!/) app for [Android](https://play.google.com/store/apps/details?id=app.intra&hl=en_US) DoH is not supported at an operating system level therefore right now it requires the installation of additional software. Already using a DoH client and want to test out Quad9? Use **[https://dns.quad9.net/dns-query](https://dns.quad9.net/dns-query)** If you have an issue using the above query string please try: https://dns.quad9.net/dns-query? We will be updating this post with additional configuration guides as they become available. DoH requires either use of the system resolver or an IP address to perform the initial lookup for a hostname based query string. If you want to use the name to access it you need to be able to perform a lookup for that name. You can also point to the IP address. Quad9 supports three flavors of DNS currently. A secured version,  a unsecured or “vanilla” version and a version of our secured service that supports [ECS](https://en.wikipedia.org/wiki/EDNS_Client_Subnet)   | Service | DOH Address/Name | DNSSEC | Malicious Blocking | Encryption | IP Addresses | | --- | --- | --- | --- | --- | --- | | Recommended (Secure) | https://dns.quad9.net/dns-query | YES | YES | YES | 9.9.9.9, 149.112.112.112, 2620:fe::fe, 2620:fe::fe:9 | | Secured | https://dns9.quad9.net/dns-query | YES | YES | YES | 9.9.9.9, 149.112.112.9, 2620:fe::9, 2620:fe::fe:9 | | Unsecured | https://dns10.quad9.net/dns-query | NO | NO | YES | 9.9.9.10, 149.112.112.10, 2620:fe::10, 2620:fe::fe:10 | | Secured w/ [ECS](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) support | https://dns11.quad9.net/dns-query | YES | YES | YES | 9.9.9.11, 149.112.112.11, 2620:fe::11, 2620:fe::fe:11 | : This is what you enter as the DNS server to use, exactly as shown. Be careful to not add a trailing ‘/ ‘after dns-query or your client may have issues connecting. : Our Recommend service is currently identical to our secure service, intended to be slightly easier to remember and more friendly for configuration. If you don’t know what to use, use this! An easy way to test without changing anything in your favorite DoH client is to just perform the following query right from your browser: [https://dns.quad9.net:5053/dns-query?name=quad9.net](https://dns.quad9.net:5053/dns-query?name=quad9.net)   ###### Updated 7/25/2019 – This is now running on a custom port since this implementation is not inline with the most recent standards based DoH implementation. (see You can also use the IP address instead of the name anywhere you see it when it comes to DoH – our certificates have all our common IPs, so this works too: [https://9.9.9.9:5053/dns-query?name=quad9.net](https://9.9.9.9:5053/dns-query?name=quad9.net)   ###### Updated 7/25/2019 – This is now running on a custom port since this implementation is not inline with the most recent standards based DoH implementation. (see   ## Tested Client Implementations   - [Intra](https://getintra.org/#!/) (Android) - [DNSCrypt-proxy](https://github.com/jedisct1/dnscrypt-proxy) - [Firefox](https://www.mozilla.org/en-US/firefox/) (Version 62 and later) - [Golang client and server](https://github.com/m13253/dns-over-https)   Additional client implementations and information can be found on ([wikipedia](https://en.wikipedia.org/wiki/DNS_over_HTTPS)).   ## Other Options for DNS Privacy and Encryption Quad9 supports both [DNS-over-TLS](https://www.quad9.net/private-dns-quad9-android9) and [DNSCrypt](https://www.quad9.net/privacy-dnscrypt-testing)   ## Configuration Examples   ###     #### Download the for Android.   ##### **Updated July 25, 2019. Quad9 is now included in the default list of DoH servers.   #### Launch the app and go to Settings:     #### Touch ‘Select DNS over HTTPS Server’:     #### Touch Built-in server and then Quad9 Secure DNS:     #### You will see the following confirmation screen and you need to touch ‘Accept” to apply your new settings:     #### For more stats and info scroll down:     #### Once you exit the app you will see the following confirmation modal:     #### DNS over HTTPS (DoH) is not enabled by default, so you have to type about:config in your browser bar to open up the settings page.     #### In Settings, you can modify 3 items related to the *Trusted Recursive Resolver* (aka network.trr):   - network.trr.mode trr.mode controls when and how *DoH* should be used. By default it is set to 0, meaning it is disabled. If you change it it will enable it. 0 — Off (default). To use operating system resolver. - 1 — Race native against TRR. Do both in parallel and go with the one that returns a result first. Most likely the native one will win. - 2 — First. Use TRR first, and only if the secure resolution fails use the operating system resolver. - 3 — Only. Only use TRR. Never use the native (after the initial setup). - 4 — Shadow. Runs the TRR resolves in parallel with the native for timing and measurements but uses only the native resolver results. - 5 — Off by choice This is the same as 0 but marks it as done by choice and not done by default. We recommend trr.mode of ‘2’ so it will fall back to the default resolver if the connection to the DoH server fails. If you only ever want to use DoH you can set it to 3 – You will be unable to resolve DNS names if your DoH server goes down and you won’t have a back-up using your system resolver. - network.trr.uri (this is where you specify the resolver you want to use) - network.trr.bootstrapAddress (you can forgo setting this and it will use the native system resolver for the initial query for [https://dns.quad9.net/dns-query](https://dns.quad9.net/dns-query)     You can check out the logs by typing about:networking#dns into your browser bar.  Look for TRR ‘true’ entries to see what is being looked up via DNS over HTTPS.