The instructions
Loading the gun
Owning the endpoint is the easy part. Every operating system, browser and router hides the setting somewhere slightly different, usually behind a word nobody uses in conversation. Below is where each of them keeps it.

Two things travel with you through all of it: the endpoint, which is the full URL, and the hostname, which is the same thing with the ceremony removed. Some fields want one, some want the other.
What you are holding
Taken from your last choice on the front page. Pick a different one there and this page follows.
DoH endpoint — https://b.hitoha.moe/dns-query
DoT address — tls://b.hitoha.moe
Hostname — b.hitoha.moe
Change one thing at a time and keep a way back. A router with a broken resolver looks exactly like a router with no internet, and the person troubleshooting it at 3am will be you.
Android Windows 11 iOS & macOS Firefox Chrome & Edge MikroTik OpenWrt AdGuard Home Verify
Android 9 and newer DoT
The cleanest install of the lot. Android calls DNS over TLS Private DNS, it applies system wide, and it survives switching between mobile data and Wi-Fi.
  1. Open Settings → Network & internet → Private DNS. On Samsung it lives under Connections → More connection settings.
  2. Choose Private DNS provider hostname.
  3. Enter the hostname only — no https://, no tls://, no trailing slash:
b.hitoha.moe
  1. Tap Save. If the field turns red, the hostname is wrong or the network is blocking port 853 — try the Android button on the front page to copy it exactly.
Windows 11 DoH
Windows wants an IP address and a template, because it refuses to trust a name it has not resolved yet. Find the address first. 
nslookup b.hitoha.moe
  1. Settings → Network & internet → your adapter (Wi-Fi or Ethernet) → Hardware properties.
  2. Next to DNS server assignment, click Edit and switch to Manual.
  3. Turn on IPv4, and paste the address nslookup returned into Preferred DNS.
  4. Set DNS over HTTPS to On (manual template) and enter the endpoint:
https://b.hitoha.moe/dns-query
  1. Leave Fallback to plaintext off. A fallback is a door you left unlocked out of politeness.
  2. Save, then repeat for IPv6 if the resolver you picked serves it.
Windows 10 has no interface for this. Use a client such as AdGuard Home, YogaDNS or dnscrypt-proxy, or set it on the router and let every device inherit it.
iOS, iPadOS and macOS DoH / DoT
Apple has supported encrypted DNS since iOS 14 and macOS 11, but only through a configuration profile or an app that installs one. There is no text box in Settings.
  1. Install a DNS client from the App Store — AdGuard, DNSecure or DNSCloak all accept a custom server.
  2. Add a custom resolver and paste the endpoint:
https://b.hitoha.moe/dns-query
  1. Enable it, then confirm under Settings → General → VPN & Device Management → DNS that your profile is the active one.
  2. On macOS the same profile works: double click the .mobileconfig and approve it in System Settings → Privacy & Security → Profiles.
Firefox DoH
Browser level encryption covers the browser and nothing else. Everything outside it keeps asking whoever the system was told to ask.
  1. Settings → Privacy & Security → scroll to DNS over HTTPS.
  2. Select Max Protection.
  3. Open the provider list, choose Custom, and paste:
https://b.hitoha.moe/dns-query
  1. Confirm on about:networking#dns — the TRR column should read true for new lookups.
Chrome, Edge, Brave, Vivaldi DoH
  1. Open chrome://settings/security — on Edge it is edge://settings/privacy.
  2. Turn on Use secure DNS.
  3. Choose Custom and paste the endpoint:
https://b.hitoha.moe/dns-query
  1. Check it on chrome://net-internals/#dns if you want to see the queries leave.
MikroTik RouterOS DoH
Do it here and every device in the house is covered, including the ones with no settings screen at all. The front page will hand you a ready made .rsc for the endpoint you picked — the long way is below.
1. Give the router something to bootstrap with
/ip dns
set servers=1.0.0.1,1.1.1.1 allow-remote-requests=yes
2. Import a certificate store, or DoH will refuse to verify
/tool fetch url="https://curl.se/ca/cacert.pem"
/certificate import file-name=cacert.pem passphrase=""
3. Pin the resolver address, then switch DoH on
/ip dns static
add name="b.hitoha.moe" type=A address=151.158.198.53

/ip dns
set use-doh-server="https://b.hitoha.moe/dns-query" verify-doh-cert=yes
Replace the static address with whatever nslookup returns for your chosen host, or press .rsc on the front page and let the site resolve it for you. Without that static entry the router cannot find the resolver it is about to start using, which is a circle it will not escape on its own.
RouterOS 7.20 and later — forwarders
/ip dns forwarders
add name=ELPIS doh-servers="https://b.hitoha.moe/dns-query"

/ip dns static
add name=* forward-to=ELPIS type=FWD
OpenWrt DoH
  1. Install the proxy and its LuCI page:
opkg update
opkg install https-dns-proxy luci-app-https-dns-proxy
  1. Point the first instance at the endpoint, and drop any providers that shipped by default:
uci set https-dns-proxy.@https-dns-proxy[0].resolver_url='https://b.hitoha.moe/dns-query'
uci set https-dns-proxy.@https-dns-proxy[0].bootstrap_dns='1.1.1.1,1.0.0.1'
uci set https-dns-proxy.@https-dns-proxy[0].listen_addr='127.0.0.1'
uci set https-dns-proxy.@https-dns-proxy[0].listen_port='5053'
uci commit https-dns-proxy
/etc/init.d/https-dns-proxy restart
  1. Tell dnsmasq to forward everything to the proxy and to ignore what the ISP handed out:
uci -q delete dhcp.@dnsmasq[0].server
uci add_list dhcp.@dnsmasq[0].server='127.0.0.1#5053'
uci set dhcp.@dnsmasq[0].noresolv='1'
uci commit dhcp
/etc/init.d/dnsmasq restart
AdGuard Home & Pi-hole DoH / DoT
ΕΛΠΙΣ is happy to sit upstream of your own filter. You keep the block lists and the logs on your hardware; we answer what is left. There are two ways round, and the difference is who does the filtering.
Filtered upstream — encrypted, with our lists
  1. AdGuard Home: Settings → DNS settings → Upstream DNS servers, then paste one per line:
https://b.hitoha.moe/dns-query
Raw upstream — recursion only, your lists
The recursors resolve and nothing else: no block lists, no rewrites. Use these when your own filter is the one making the decisions. 
2402:4e20:b00b::1111
2402:4e20:b00b::1001
2402:4e20::1111
2402:4e20::1001
  1. Set Load balancing to Parallel requests if you listed more than one, click Test upstreams, then Apply.
  2. Fill Bootstrap DNS servers with the same four addresses, so the encrypted hostnames above can be resolved on a cold start.
  3. Pi-hole has no encrypted upstream of its own — either give it the raw recursors directly, or run cloudflared or dnscrypt-proxy beside it and point Pi-hole at 127.0.0.1#5053.
The raw recursors are IPv6 only. A box with no native v6 should take the encrypted route instead — most entries in the table on the front page answer over IPv4 as well.
Verify, then trust Always
Never take a resolver's word for it, including ours.
  1. Confirm names still resolve at all:
nslookup example.com
  1. Check that filtering is live — a known ad domain should come back empty or as 0.0.0.0.
  2. Run a leak test at dnsleaktest.com or dnscheck.tools. If your ISP's resolver is still listed, something on the path is intercepting port 53 and the encrypted setting never took.
  3. On a browser, about:networking#dns or chrome://net-internals/#dns will tell you the truth faster than any website can.
Encrypted DNS hides which names you ask for from everyone between you and the resolver. It is not a VPN, it does not hide the addresses you then connect to, and it will not make you anonymous. It closes one specific window that has been standing wide open since 1983.
When it does not work
  1. Nothing resolves at all. The client cannot reach the resolver's name. Set a bootstrap address, or add a static entry for the hostname.
  2. Android rejects the hostname. Port 853 is blocked on that network. Use DoH somewhere else in the chain, or another network.
  3. Certificate errors on a router. The certificate store is missing or the clock is wrong. Import the store, fix NTP, try again.
  4. It works, then stops at random. Something is intercepting port 53 and losing the race. Force encrypted only and disable plaintext fallback.
  5. Still stuck. Ask on Discord or open an issue on GitHub. Bring the endpoint, the client and the exact error.
Pick a different one
Region, filtering profile and transport all change the endpoint. The table is one click away.
Back to the table