Home & Personal Docs

DNS Resolver Addresses

Point your device or router to the following addresses to start filtering DNS with DNSAFE. All plans use the same resolver — your filtering policy is applied based on your registered account IPs.

Standard DNS (port 53)

Primary 3.12.124.91

Encrypted DNS

DoH https://api.dnsafe.net/dns-query

DoT hostname api.dnsafe.net

DoT port 853

ⓘ

Register your IP first. Filtering only applies to IPs registered in your account. Log in to my.dnsafe.net → Devices to add your device or network IP before configuring DNS.

Quick Start Guide

Get DNSAFE filtering active on your device in under three minutes.

1

Create a free accountGo to my.dnsafe.net and sign up. No payment required for the Free plan.
2

Register your device IPIn the portal, go to Devices and click + Add Device. Your current public IP is shown — click “Use my current IP” to add it in one step.
3

Configure DNS on your deviceChange your DNS server to 3.12.124.91. See the platform guides below for step-by-step instructions for your device.
4

Verify filtering is workingVisit dnsafe.net/check — it should show “Protected” with your account details once filtering is active.

💡

For whole-home protection, configure DNS on your router rather than individual devices. One change protects every device on your network. See the Router guide below.

Platform Setup Guides

Choose your platform for step-by-step DNS configuration instructions.

Windows 11 / 10

Open Settings → Network & Internet
Click your active connection (Wi-Fi or Ethernet)
Scroll down to DNS server assignment and click Edit
Change from Automatic to Manual
Toggle on IPv4 and enter 3.12.124.91 as the Preferred DNS
Click Save

💡

For DNS-over-HTTPS on Windows 11, set DNS server to 3.12.124.91 then toggle the DNS over HTTPS dropdown to “On (automatic template)” if prompted.

macOS

Open System Settings (or System Preferences on older macOS)
Click Network, then select your active connection
Click Details… (macOS Ventura+) or Advanced…
Click the DNS tab
Click + and add 3.12.124.91
Click OK then Apply

iPhone & iPad (iOS / iPadOS)

iOS doesn't allow changing DNS per-network from Settings for standard UDP DNS. Use one of these methods:

Method 1 — DNS-over-HTTPS via Encrypted DNS Profile (recommended)

Visit dnsafe.net/check on your iPhone and tap Install DNS Profile. This installs a configuration profile that routes all DNS through DNSAFE automatically.

Method 2 — Per-Wi-Fi network

Go to Settings → Wi-Fi
Tap the ⓘ icon next to your network
Scroll down to Configure DNS and tap it
Select Manual, tap + and add 3.12.124.91
Tap Save

⚠️

The per-Wi-Fi method only applies to that one network. If you want filtering on all connections including mobile data, use the DNS profile method.

Android

Option 1 — Private DNS (DNS-over-TLS, Android 9+) — recommended

Open Settings → Network & internet (or Connections on Samsung)
Tap Private DNS
Select Private DNS provider hostname
Enter api.dnsafe.net and tap Save

This routes all DNS queries through DNSAFE encrypted, on all networks including mobile data.

Option 2 — Per-Wi-Fi (standard DNS)

Go to Settings → Wi-Fi
Long-press your network and tap Modify network or tap the gear icon
Under IP settings, select Static
Enter 3.12.124.91 in the DNS 1 field
Tap Save

Router / Network-wide

Configuring DNS on your router protects every device on your home network automatically — no per-device setup needed.

Router	Where to find DNS settings
Most home routers	Log in to your router (usually `192.168.1.1` or `192.168.0.1`) → WAN / Internet settings → DNS
TP-Link	Advanced → Network → Internet → DNS settings (or DHCP settings for LAN DNS)
ASUS	WAN → Internet Connection → WAN DNS Setting
Netgear	Advanced → Setup → Internet Setup → Domain Name Server (DNS) Address
Eero	eero app → Network settings → DNS
UniFi	Settings → Networks → LAN → DHCP Name Server (Manual)
pfSense / OPNsense	System → General Setup → DNS Servers

Set the Primary DNS to 3.12.124.91. Leave the secondary blank or use your ISP's DNS as a fallback (note: fallback DNS bypasses DNSAFE filtering).

ⓘ

Register your router's WAN IP. Your router's WAN (public) IP is what DNSAFE sees. Go to my.dnsafe.net → Devices and register it. If your ISP gives you a dynamic IP, it may change — re-register when it does, or upgrade to a plan with dynamic IP support.

DNS-over-HTTPS (DoH)

DNS-over-HTTPS encrypts your DNS queries, preventing ISPs and network observers from seeing which domains you're looking up. DNSAFE supports DoH for all plans.

DoH URL https://api.dnsafe.net/dns-query

Browser Configuration

Browser	How to configure DoH
Chrome / Edge / Brave	Settings → Privacy and Security → Security → Use secure DNS → Custom → paste the DoH URL
Firefox	Settings → Privacy & Security → DNS over HTTPS → Max Protection → Custom → paste the DoH URL
Safari (macOS)	Install a DNS profile from dnsafe.net/check which configures DoH system-wide

💡

Browser-level DoH only encrypts DNS for that browser. For system-wide encrypted DNS, use Android's Private DNS feature or a macOS/iOS DNS configuration profile.

DNS-over-TLS (DoT)

DNS-over-TLS provides encrypted DNS on port 853. It's ideal for routers and operating systems that support it natively.

Hostname api.dnsafe.net

Port 853

Supported Platforms

Platform	DoT Support	How to configure
Android 9+	✅ Native	Settings → Network → Private DNS → enter `api.dnsafe.net`
pfSense / OPNsense	✅ Supported	System → General Setup → DNS → enable TLS → enter hostname
Windows 11	✅ Supported	Network → DNS settings → DNS over HTTPS → custom provider
Linux (systemd-resolved)	✅ Supported	Edit `/etc/systemd/resolved.conf` → set `DNS=3.12.124.91` and `DNSOverTLS=yes`
iOS / macOS	Via profile	Install config profile from dnsafe.net/check

Custom Allow & Block Rules

In addition to the default DNSAFE filtering, you can create your own rules to block or allow specific domains. Custom rules apply to all registered devices on your account.

Adding a Rule

1

Go to RulesLog in to my.dnsafe.net and click Rules in the left sidebar.
2

Click + Add RuleEnter the domain and select Block or Allow.
3

Wait for propagationRules take effect within 5 minutes. Flush your DNS cache if you need it immediately.

Block Rules

A block rule prevents any device on your account from resolving the domain. Enter just the bare domain — no http:// prefix or path:

✓ tiktok.com — blocks the domain and all its subdomains
✓ ads.example.com — blocks only this subdomain
✗ https://tiktok.com/for-you — paths are ignored; enter domain only

Allow Rules

Allow rules let you whitelist a domain that would otherwise be blocked by DNSAFE's default filtering. This is useful if a legitimate site you use has been incorrectly flagged.

Flushing Your DNS Cache

After adding a rule, you may need to flush your device's DNS cache before the change takes effect:

Platform	Command / Method
Windows	`ipconfig /flushdns` in Command Prompt
macOS	`sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder`
Chrome browser	Visit `chrome://net-internals/#dns` and click Clear host cache
iOS / Android	Toggle Airplane Mode on then off, or restart the device

Plans & Add-ons

DNSAFE offers four consumer plans based on the number of devices you need to protect.

Free

bash/mo

1 device

Personal

.99/mo

5 devices

Family

.99/mo

15 devices

Pro

2.99/mo

25 devices

What's included on all plans

ThreatGrid protection — blocks 395,000+ malware, phishing, and threat domains
DNS-over-HTTPS and DNS-over-TLS support
Custom block and allow rules
Query logs (30 days)
Devices dashboard

Add-ons

Extend your filtering with optional category packs, available on Personal plans and above.

Add-on	What it blocks	Price
Extended Logs	Extends query log retention from 30 to 90 days	bash.99/mo
Extra Device Slots	Add 5 more device slots to your current plan	.99/mo
Ad & Tracker Block	Advertising networks, tracking pixels, analytics beacons	bash.99/mo
Adult Content Filter	Adult and explicit material across all domains	bash.99/mo
Social Media Block	Facebook, Instagram, TikTok, X, Snapchat and others	bash.99/mo
Parental Controls Bundle	Adult content + violence + gambling combined	.99/mo

Managing add-ons

Go to my.dnsafe.net → Account → Add-ons to enable or disable any pack. Changes are reflected in your next billing cycle.

Upgrading or downgrading

Go to my.dnsafe.net → Account → Plan and select a new plan. Upgrades take effect immediately. Downgrades take effect at the end of your current billing period.

Referral Programme

Earn account credit by referring friends and family to DNSAFE. For every person who signs up using your referral link and subscribes to a paid plan, you receive one month free added to your account.

How it works

1

Get your referral linkLog in to my.dnsafe.net and go to Account → Referrals. Your unique referral link is shown there — copy it to share.
2

Share the linkSend it to anyone who might benefit from DNS filtering. When they click your link and sign up, they're automatically credited to your account.
3

Earn creditOnce your referral subscribes to a paid plan, one free month is added to your account automatically. There's no limit to how many referrals you can make.

ⓘ

Credit is applied automatically. You don't need to do anything — the credit appears on your account page once the referral's first payment clears. Credits stack and are applied before any card charges.

Referral FAQ

Question	Answer
How long does a referral credit take to apply?	Within 24 hours of the referred user's first successful payment
Do I earn credit for Free plan signups?	No — credit is only earned when the referral subscribes to a paid plan
Can I refer someone who already has an account?	No — referral credit only applies to new accounts
Is there a maximum number of referrals?	No limit

Troubleshooting

DNS check shows “Not protected”

Your device is either not using the DNSAFE resolver, or your IP isn't registered. Check both:

Confirm DNS is set to 3.12.124.91 on your device (see the platform guides above)
Log in to my.dnsafe.net → Devices and check that your current public IP is listed. If not, add it.

A site I blocked is still loading

Check the rule exists in my.dnsafe.net → Rules
Wait up to 5 minutes for the rule to propagate
Flush your DNS cache (see the table in the Custom Rules section)
Try opening the site in a private/incognito browser window

A legitimate site is being blocked

The site may be flagged in DNSAFE's ThreatGrid blocklist. To allow it:

Go to my.dnsafe.net → Rules → + Add Rule
Enter the domain and select Allow
The site should be accessible within 5 minutes

If you believe a domain is incorrectly flagged, email support@dnsafe.net so we can review it.

My IP address changed

If your ISP issued you a new IP address, filtering will stop working until you update your registered IP. Log in to my.dnsafe.net → Devices, remove the old IP, and add your current one. Your current public IP is shown automatically on that page.

Filtering stopped working after a router restart

Some routers reset DNS settings on reboot. Check that your router still has 3.12.124.91 configured as the DNS server after restarting. If this keeps happening, check your router's DNS settings persistence and save the configuration.

Still need help?

Open a support ticket directly from the portal: my.dnsafe.net → Support → New Ticket. Or email us at support@dnsafe.net. We aim to respond within one business day.