Set it up in two minutes

Android 9 and newer DoT

The easiest one. Android calls it Private DNS, and it works on Wi-Fi and mobile data.

1. Open Settings → Network & internet → Private DNS. On Samsung: Connections → More connection settings.
2. Choose Private DNS provider hostname.
3. Type the hostname only. No https://, no slash:

b.hitoha.moe

1. Tap Save. If it says it can't connect, your network may block port 853. Try another network, or use DoH in a browser instead.

iPhone, iPad and Mac DoH / DoT

Apple supports encrypted DNS through an app or a profile. There's no text box in Settings for it.

1. Get a DNS app from the App Store. AdGuard, DNSecure and DNSCloak all take a custom server.
2. Add a custom server and paste the full address:

https://b.hitoha.moe/dns-query

1. Turn it on, then check Settings → General → VPN & Device Management → DNS.
2. On a Mac the same profile works: open the .mobileconfig and approve it in System Settings → Privacy & Security → Profiles.

Windows 11 DoH

Windows wants an IP address and the full address. Look up the IP first:

nslookup b.hitoha.moe

1. Settings → Network & internet → your Wi-Fi or Ethernet → Hardware properties.
2. Next to DNS server assignment, click Edit and pick Manual.
3. Turn on IPv4 and put the IP from nslookup in Preferred DNS.
4. Set DNS over HTTPS to On (manual template) and paste:

https://b.hitoha.moe/dns-query

1. Leave Fallback to plaintext off, then save. Do the same for IPv6 if you have it.

Firefox DoH

Covers Firefox only. Other apps on your device keep using the system DNS.

1. Settings → Privacy & Security → scroll to DNS over HTTPS.
2. Pick Max Protection.
3. Choose Custom as the provider and paste:

https://b.hitoha.moe/dns-query

1. To check, open about:networking#dns. The TRR column should say true.

Chrome, Edge, Brave, Vivaldi DoH

1. Open chrome://settings/security. On Edge: edge://settings/privacy.
2. Turn on Use secure DNS.
3. Choose Custom and paste:

https://b.hitoha.moe/dns-query

MikroTik RouterOS DoH

Set it on the router and every device at home is covered, even the ones with no settings at all. Short on time? Press .rsc on the home page for a ready-made script.

1. Give the router a plain DNS to start with:

/ip dns
set servers=1.0.0.1,1.1.1.1 allow-remote-requests=yes

1. Import certificates, or DoH can't check who it's talking to:

/tool fetch url="https://curl.se/ca/cacert.pem"
/certificate import file-name=cacert.pem passphrase=""

1. Pin the server's IP, then turn DoH on:

/ip dns static
add name="b.hitoha.moe" type=A address=151.158.198.53

/ip dns
set use-doh-server="https://b.hitoha.moe/dns-query" verify-doh-cert=yes

RouterOS 7.20 and newer can use forwarders instead:

/ip dns forwarders
add name=ELPIS doh-servers="https://b.hitoha.moe/dns-query"

/ip dns static
add name=* forward-to=ELPIS type=FWD

OpenWrt DoH

1. Install the DoH proxy and its web page:

opkg update
opkg install https-dns-proxy luci-app-https-dns-proxy

1. Point it at your address:

uci set https-dns-proxy.@https-dns-proxy[0].resolver_url='https://b.hitoha.moe/dns-query'
uci set https-dns-proxy.@https-dns-proxy[0].bootstrap_dns='1.1.1.1,1.0.0.1'
uci set https-dns-proxy.@https-dns-proxy[0].listen_addr='127.0.0.1'
uci set https-dns-proxy.@https-dns-proxy[0].listen_port='5053'
uci commit https-dns-proxy
/etc/init.d/https-dns-proxy restart

1. Send all DNS through it, and ignore what your ISP hands out:

uci -q delete dhcp.@dnsmasq[0].server
uci add_list dhcp.@dnsmasq[0].server='127.0.0.1#5053'
uci set dhcp.@dnsmasq[0].noresolv='1'
uci commit dhcp
/etc/init.d/dnsmasq restart

AdGuard Home & Pi-hole DoH / DoT

Already running your own filter? There are two ways to use us with it.

https://b.hitoha.moe/dns-query

Check it works Always

Don't take our word for it. Check:

1. Websites still open. That's the big one.
2. Run a test at dnscheck.tools or dnsleaktest.com. You should see one of our networks, not your ISP.
3. A known ad domain should come back empty or as 0.0.0.0.

If something breaks

1. Nothing loads. Your device can't find our server. Add a bootstrap IP or a static entry for the hostname.
2. Android won't save it. Port 853 is blocked on that network. Try another network or use DoH.
3. Certificate errors on a router. Import the certificates and check the router's clock.
4. Works, then stops. Something on your network is grabbing port 53. Turn off plain DNS fallback.
5. Still stuck? Ask on Discord or open an issue on GitHub. Tell us your address, your device and the exact error.