ΕΛΠΙΣ DNS
ΕΛΠΙΣ Resolver

Our own resolver.
No middlemen.

No ISP, no Google, no Cloudflare. ΕΛΠΙΣ Resolver asks the root servers itself and checks every signature on the way, including post-quantum ML-DSA-44. We're the second resolver in the world to do that.

2.5.0 Erdentempel is out: refused at the door
Public resolvers AdGuard Home & Pi-hole Erdentempel ADoX The road to 2.5.0 What's inside Source
2nd

resolver in the world to validate ML-DSA-44 DNSSEC

30M+

queries a day, across all our resolvers

0

forwarders. We ask the root ourselves

7

public resolvers, in Malaysia and Indonesia

Public resolvers

Bring your own filter

Running AdGuard Home or Pi-hole at home, at the office or for your business? Use these as your upstream. You keep your block lists and your logs; we do the recursion and the DNSSEC, ML-DSA-44 included.

Server IPv4 IPv6
Sakurako-1 151.158.198.49:5301 2402:4e20:b00b::1001
Sakurako-2 151.158.198.49:5302 2402:4e20:b00b::1111
Fizo-1 151.158.198.47 2402:4e20:c0de::b00b
Fizo-2 151.158.198.46 2402:4e20:c0de::bab1
Kevin-1 89.23.82.53 2a0f:1cc6:bab1::1111
Kevin-2 89.23.82.82 2a0f:1cc6:bab1::1001
Ryukura Jakarta 103.253.245.167:5301 IPv4 only for now
Unfiltered on purpose. These answer exactly what the internet says, with no block lists and no rewrites, so your own filter makes the calls. Want ours too? Use the encrypted endpoints on the home page instead. IPv6 is the better path when you have it.

How to use them

AdGuard Home & Pi-hole

Two minutes, and every device behind your filter gets our recursion and DNSSEC.

AdGuard Home

  1. Go to Settings → DNS settings → Upstream DNS servers.
  2. Paste the addresses, one per line. Ports go after a colon.
2402:4e20:c0de::b00b
2402:4e20:b00b::1001
2a0f:1cc6:bab1::1111
151.158.198.47
151.158.198.49:5301
  1. Pick Parallel requests, so the fastest answer wins.
  2. Put the same addresses in Bootstrap DNS servers, then Apply.

Pi-hole

  1. Go to Settings → DNS and untick the built-in providers.
  2. Add ours under Custom DNS servers. Pi-hole writes the port after a #.
2402:4e20:c0de::b00b
2402:4e20:b00b::1001
151.158.198.47
151.158.198.49#5301
  1. Save. Then run a test on dnscheck.tools: you should see DNSSEC passing and one of our networks answering, not your ISP.
Mix servers from different groups, like one Fizo, one Sakurako and one Kevin. They sit on different machines, so one going down for an upgrade never takes your DNS with it. In Indonesia, add Ryukura in Jakarta: it's the closest to you.

New in 2.5.0 · Erdentempel

Refused at the door

A resolver open to the public is also asked for names whose only purpose is to make it work: random labels under a domain someone is flooding, and big signed answers aimed at a spoofed address. ΕΛΠΙΣ Resolver now knows them, and turns them away before it even looks at the cache.

A questionany type, UDP or TCP
The gatea hash per label, about 20 ns
On the list REFUSED · EDE 15 (Blocked) Nothing resolved, sent upstream or cached
Everything else Cache → root → TLD → name server DNSSEC checked, ML-DSA-44 included

How the gate works

  1. The names come from the ElpisDNS honeypot, which sees the abuse first, and are compiled into the binary.
  2. Every question is checked: a name on the list, or any name below it, over UDP or TCP, of any type.
  3. A match gets REFUSED with EDE 15 (Blocked), before the cache is looked at. Nothing is resolved for it.
  4. The check is one hash per label, about 20 ns whether it matches or not, so a longer list costs nothing more.

A gate, not a filter

It isn't an ad blocker. Eleven names, none of them a site anyone visits, so your AdGuard Home or Pi-hole still makes every call that matters to you.

What it saves is real. Each random label is a cache miss and a full resolution of its own, and each spoofed question sends a big answer to someone who never asked. Refused early, they cost almost nothing, and the resolver is nobody's weapon.

The status page counts them as blocked. Only the name the client asks is checked, never a CNAME target.

Running your own? The gate is on by default, and blocklist: no in elpis.conf switches it off. 2.5.0 also makes elpis -t fail a config with a bad value in it instead of calling it OK, so an update never restarts onto one. No config that worked stops working. Release notes.

Since 2.4.0 · ADoX

Encrypted past us, too

DoH and DoT encrypt the trip from you to us. ADoX covers the next one: ΕΛΠΙΣ Resolver now asks the root, the TLDs and each domain's name server over DNS over TLS, wherever they take it.

How it works

  1. The first question to a name server goes plain, as always, with a copy over TLS on port 853. Nobody waits on the copy, so it costs no time.
  2. The server answers over TLS? From then on it gets every question over TLS only, on a connection kept open.
  3. It doesn't? It gets plain DNS as before, and we try TLS again every hour.
  4. Servers that take TLS are asked first, so fewer of your names cross the wire in the clear.
  5. Each question is padded to 128 bytes, so its length gives less away.

What it stops, and what it doesn't

It stops anyone watching the path, like the networks between us and the name server, from reading what we ask. It can't stop someone sitting on the path, who could block port 853 and send us back to plain DNS, which is where we were before.

The name server still sees the question; it has to, to answer it. And DNSSEC checks every answer the same way, however it arrived.

Few name servers take TLS yet. b.root-servers.net and Facebook's do, and more will as their operators turn it on.

See it yourself. Use ΕΛΠΙΣ as your DNS and open dnscheck.tools: ADoX in the bottom bar means our resolver reached its test server over TLS. Running your own? Add authoritative-dot: opportunistic to elpis.conf. It's off by default, and the configuration guide has the details.

The road to 2.5.0

From behind closed doors
to Erdentempel

Thirty-one releases in twenty days, from the first public build to the gate in 2.5.0. These are the ones that changed what ΕΛΠΙΣ Resolver is.

  1. Private until 21 Sep 2026

    Before 1.0.0

    Behind closed doors

    A resolver that answers the public answers anyone, including people who want to poison its cache, burn its CPU or bounce its answers at someone else. Before 1.0.0, ours wasn't ready for them, so it stayed private until it was.

  2. 1.0.0

    The release that matters most

    First light

    Built with Claude Opus

    Everything since stands on this one. It opened the doors on a complete validating resolver in portable C99 with no dependencies, and the defences a public one needs: DNS cookies and 0x20 against spoofed answers, rate limiting against floods.

    • DNSSEC with ML-DSA
    • NSEC & NSEC3
    • QNAME minimisation
    • Serve-stale & prefetch
    • DNS64
    • The root zone over AXFR
  3. 2.0.0

    After sixteen 1.1 releases in three days

    Meant to be left running

    Benchmarked on 1,221 lookups across 28 groups of real services, from Steam and YouTube to Shopee and Malaysian banks, with every answer checked against 1.1.1.1.

    1,218of 1,221 answers the same as 1.1.1.1
    0.6 msmedian answer, warm cache
    4.2 ms1.1.1.1's median, from the same place
  4. 2.4.0

    “Intrinsic Future” · the first release with a name

    Encrypted past us

    ADoX: what Elpis asks the root, the TLDs and each name server goes over TLS wherever they take it. The TLS 1.3 client is written in the tree, so it's still one small binary with no dependencies.

    What ADoX is
  5. 2.4.3 – 2.4.5 6 – 8 Oct 2026

    Three nights, three names

    A journey among the stars

    • Resilient Journey

      Looks after the host, not just the binary: the account, the systemd unit, the start at boot.

    • Celestial Equations

      Mail to Microsoft 365 resolves again: servers that refuse EDNS get asked without it.

    • Celestial Cascade

      Zones that sign on the fly, like Route 53, stop going SERVFAIL an hour after a lookup.

  6. 2.5.0

    “Erdentempel” · latest

    Back to earth, with a guard at the gate

    After three names among the stars, the journey comes back down. Erdentempel, a temple of the earth: the names asked only to make a resolver work, gathered by our honeypot, are refused before the cache is even looked at.

    1. Resilience
    2. Precision
    3. Flow
    4. Protection
    How the gate works Every release

What's inside

Small, fast, and ours

ΕΛΠΙΣ Resolver sits behind the ΕΛΠΙΣ DNS endpoints we run. AdGuard Home faces you and does the filtering; the resolver does the part nobody sees.

Post-quantum DNSSEC

Checks ML-DSA-44, the FIPS 204 signature almost nobody validates yet. Second in the world, after Cloudflare.

What ML-DSA-44 is

Straight to the root

Root, then TLD, then the name server with the answer, over TLS where they take it. Nobody upstream keeps a copy of your questions.

What ADoX is

SIMD, close to the CPU

Hand-written AVX2, SSE2 and NEON code, picked at startup for your processor. The hot paths run at machine speed.

One small binary

Portable C99 with no dependencies. Runs on Linux, the BSDs and macOS. Build it, copy it, run it.

Built together

Written by the community with help from Claude AI, and reviewed in the open on GitHub.

How it got here

Battle tested

More than 30 million queries a day across our resolvers, from real people on real networks.

Read it, build it, run your own

The source, the DNSSEC notes and the reasons the fast paths look the way they do. A resolver you can't read is a promise you can't check.

ΕΛΠΙΣ Resolver