Skip to content
DNS Worker

DNS Worker Documentation

Protect your first hop on the internet · Intelligent Ad & Threat Blocklists · Full-Stack Protocol Coverage · Local-First 0ms Analytics · NIST FIPS 203 Post-Quantum Zero-Knowledge E2EE
Getting StartedGitHub Repository

Serverless-First Edge Network

Born for Cloudflare Workers & D1 across 300+ global edge locations with zero server maintenance, while also offering standalone self-hosted Serverfull deployment for home routers.

Intelligent Ad & Threat Blocking

Built-in protective DNS engine intercepts millions of intrusive ads, cross-site telemetry trackers, malware, and phishing domains before connections are established. Accelerated by dual-layer Bloom filters and Trie verification with sub-millisecond latency.

Custom Rules & Multi-Profile Routing

Seamlessly subscribe to popular blocklists (OISD, AdGuard, HaGeZi, StevenBlack), configure custom allowlists/blocklists and DNS rewrites, and isolate policies across devices with unique profile keys.

Full-Stack Protocols

Native support for Classic UDP 53, DoT 853 (with TLS SNI profile routing), DoH (RFC 8484 over HTTP/2 & HTTP/3), DoQ (RFC 9250), and ECH / DDR (RFC 9460).

Post-Quantum Zero-Knowledge E2EE

Powered by NIST FIPS 203 P256-MLKEM768 hybrid lattice cryptography and hardware Passkeys (WebAuthn), rendering query logs safe from future quantum decryption.

Local-First 0ms Analytics

Embedded in-browser SQLite (WASM + OPFS) delivers instant 0ms log filtering and interactive charts with zero cloud database queries.

🛡️ Ad & Threat Interception

Section titled “🛡️ Ad & Threat Interception”

DNS Worker is engineered from the ground up as a Protective DNS resolver that safeguards your network, mobile devices, and IoT appliances at the internet’s foundation:

  • Intrusive Ad & Telemetry Blocking: Silently suppresses banner ads, video commercials, popups, and invasive operating system telemetry across iOS, Android, macOS, Windows, and Smart TVs without installing client software.
  • Proactive Threat Neutralization: Real-time interception of malware distribution nodes, ransomware callbacks, phishing portals, cryptominers, and botnet Command & Control (C2) domains.
  • Dual-Layer Acceleration Engine: Combines compact Bloom filters ($O(1)$ fast check) with memory Trie exact matching, capable of processing hundreds of thousands of rules with sub-millisecond evaluation latency and zero false positives.
  • Flexible Rule Management: Pre-loaded with top-tier filter subscriptions (OISD Big, AdGuard Base, HaGeZi Multi PRO++, StevenBlack Hosts), alongside custom wildcard/regex matching and DNS rewrites.
  • Real-Time Audit & Logs: Live inspection of permitted, blocked, and rewritten queries with an interactive drawer showing matched filter rules, client origin, and latency breakdown.

👉 Explore Domain Filtering & Threat Blocklists Documentation