• List of public ODoH relays

• List of public ODoH servers

Oblivious DoH is similar to Anonymized DNS, but for a variant of the DoH protocol. It is now a formalized standard in RFC 9230.

Instead of directly sending a query to a target DoH server, the client encrypts it for that server, but sends it to a relay.

The relay then forwards that encrypted query to the actual DoH server, and then forwards the response back.

This intermediate hop helps decorrelate clients' IP addresses from the queries they send, enhancing privacy.

An ODoH relay can only communicate with an ODoH server and an ODoH client. Relays can't get responses from a generic DoH server that doesn't support ODoH.

doh-server has supported Oblivious DoH since version 0.4.0. Unless POST queries have been disabled, this doesn't require any additional configuration.

dnscrypt-proxy has supported ODoH since version 2.0.46.

To enable ODoH support in dnscrypt-proxy, you need to:

1. Enable ODoH servers in your configuration:

odoh_servers = true

2. Add the ODoH servers and relays sources to your configuration:

[sources.odoh-servers]
  urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/odoh-servers.md', 'https://download.dnscrypt.info/resolvers-list/v3/odoh-servers.md']
  cache_file = 'odoh-servers.md'
  minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
  refresh_delay = 73
  prefix = ''

[sources.odoh-relays]
  urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/odoh-relays.md', 'https://download.dnscrypt.info/resolvers-list/v3/odoh-relays.md']
  cache_file = 'odoh-relays.md'
  minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
  refresh_delay = 73
  prefix = ''

The ODoH servers list contains ODoH-compatible servers, while the ODoH relays list contains the relays needed to connect to them.

Once one or more of the servers (whose name starts with odoh-) have been configured in the servers_list setting, the intermediate relays to reach them have to be configured.

Like Anonymized DNSCrypt, this is done in the [anonymized_dns] section of the main configuration file:

[anonymized_dns]
routes = [
    { server_name='odoh-example-server-1', via=['odohrelay-example-1', 'odohrelay-example-2'] }
]

The snippet above defines a route. It tells the proxy that instead of connecting to odoh-example-server-1 directly, it should connect to either odohrelay-example-1 or odohrelay-example-2 instead, and these will securely forward the queries to odoh-example-server-1.

A wildcard (*) can be used instead of a server name in order to apply a set of relays to all servers. Only use this if you have server_names defined, with a small set of servers that don't overlap with relays.

The Oblivious DNS-over-HTTPS protocol is still a work in progress, and so is the implementation in dnscrypt-proxy. In particular, automatic relay selection is not implemented yet.

Servers and relays may not be very stable.

While upstream servers don't see queries directly coming from the client, they still learn the IP addresses of the clients using them.