TOXITECH DNS

An independent ToxiTech service

Less noise.
Start with DNS.

A quieter first connection. Filter known ad, tracker and malicious domains with an encrypted DNS resolver run by ToxiTech.

Use ToxiTech DNS See what’s behind it

No account to create. Use it in a browser or on your device.

YOUR CONNECTION DETAILS01 / DNS
DNS over HTTPSDoH / 443
PRIVATE DNS HOSTNAME

The hostname supports DNS over TLS and QUIC on port 853.

Run a one-off lookup from this page.

The check sends one example.com lookup to this endpoint. It does not detect your device’s current DNS provider.

01

Encrypted on the wayHTTPS, TLS and QUIC for DNS requests.

02

Filtering at the domainMaintained lists, checked for updates hourly.

03

Your network, your choiceUse it where it makes sense for you.

Make the connection

A small change
to your settings.

Choose where you want to use it. Browser settings affect that browser; Android Private DNS covers compatible device lookups.

01 Browser 02 Android 03 Other devices

WINDOWS / LINUX / MACOS

Start with your browser.

  1. Open your browser’s settings and find DNS over HTTPS or Encrypted DNS.
  2. Choose a custom provider and enter the complete HTTPS address below.
  3. Save the setting, then open a website to check your connection.
https://dns.toxitechnetwork.org/dns-query

Using Cyphra? Select ToxiTech — dns.toxitechnetwork.org in its DNS choices. Work and Personal profiles have separate settings.

Firefox setup reference

ANDROID 9 AND LATER

One hostname. Device-wide DNS.

  1. Open Settings and search for Private DNS.
  2. Select Private DNS provider hostname.
  3. Enter dns.toxitechnetwork.org and save.
dns.toxitechnetwork.org

Use the hostname here, without https:// or /dns-query. Menu names vary by device. VPNs and apps with their own DNS settings can override this choice.

Android network settings reference

ROUTERS / LINUX / DNS CLIENTS

Use an encrypted DNS client.

For a router or a system-wide Linux setup, use a client that supports custom DoH or authenticated DoT. Keep certificate verification enabled.

DNS over HTTPS
https://dns.toxitechnetwork.org/dns-query
DNS over TLS
tls://dns.toxitechnetwork.org:853
DNS over QUIC
quic://dns.toxitechnetwork.org:853

These URI forms are for compatible DNS clients. An IP-only DNS box does not enable encryption. Follow your client’s instructions for server addresses and TLS server names.

DoH clients should allow HTTP/2 or HTTP/1.1 fallback while HTTP/3 is temporarily unavailable. DNS over QUIC on port 853 remains available.

Behind the address

A filter before
the connection.

When a device asks where a domain lives, the resolver checks the name against its filtering rules. Known blocked domains get a blocking response.

Your deviceRequests a domain
ENCRYPTED DNS
ToxiTech DNSChecks the filter lists
ALLOWED DOMAIN
The websiteConnects as usual
Known blocked domainConnection stopped at DNS
How domain filtering works. Illustration, not live traffic or a blocking counter.
THE LIMIT

A useful layer, not the whole stack.

DNS filters domains, not individual pages or files. It cannot remove every ad, inspect downloads, replace endpoint protection or hide your IP address from websites.

Privacy, in plain language

Know who handles
your lookups.

Encrypted DNS protects requests in transit between your client and this resolver. ToxiTech operates the resolver and can see the domain names it receives and client connection information.

Resolver query logs
Currently enabled, with a 24-hour retention setting. Client IP anonymization is off.
Aggregate statistics
Currently enabled, with a 30-day retention setting.
Upstream resolution
Allowed uncached lookups normally go to Quad9 over HTTPS. Cloudflare is an encrypted fallback for connection failures; valid security blocks are preserved. Local HaGeZi filtering stays active during fallback, but Cloudflare does not reproduce Quad9’s additional threat data. Both providers have their own privacy policies.
Client enrichment
Automatic WHOIS and reverse-DNS client enrichment are off. Local device naming remains available.
Operational logs
Security and connection metadata may appear in infrastructure logs. These are separate from the resolver’s 24-hour query history and have their own retention.
This page
No analytics scripts, third-party fonts, advertising pixels or cookies. The resolver check runs only when you click it.

Bootstrap DNS lookups locate the upstream providers’ hostnames. This is an independently operated resolver, not an anonymity service. Ask about privacy or report a false positive ↗

Before you switch

A few good
questions.

Will it block every ad or unsafe site?

No. Domain filtering can block entries on its lists, including known ad, tracker and threat domains. Same-domain ads, newly created threats and unsafe pages on otherwise legitimate domains may remain accessible. Use browser protections and keep your devices updated too.

What happens when a new threat is discovered?

The resolver checks for updated lists every hour. A domain becomes blocked after a maintained threat feed adds it and this server successfully refreshes the list. Detection and upstream publication take time; this is not instant protection against every new threat.

What if a site I need stops working?

Report the domain and what failed to toxi@toxitechnetwork.org. If you need immediate access, explicitly choose another provider in your device or browser settings. Some managed networks and captive portals also restrict encrypted DNS.

Does this replace a VPN or browser protections?

No. It encrypts DNS queries and filters names. Website traffic, downloads, browser extensions, account security and your public IP address need their own protections.

Less background noise.
One setting to get started.

Set up your DNS