Why did UncensoredDNS turn off cleartext DNS lookups?

UncensoredDNS permanently turned off cleartext DNS lookups on port 53 (both UDP and TCP) in September 2022, after announcing the plan in February 2022. The stated reason was "The Unfriendly Internet" — the operator's position that unencrypted DNS queries can be observed and manipulated in transit, so the service moved to encrypted-only resolution. If you were using the plain IP addresses 91.239.100.100 or 89.233.43.71 on port 53, those lookups stopped working and you need to switch to DNS-over-TLS (DoT) or DNS-over-HTTPS (DoH).

What exactly was turned off

The blog post "Cleartext DNS Turned Off" (September 01, 2022) states that cleartext port 53 DNS lookups over both TCP and UDP were switched off that day, "as promised." The earlier announcement, "The Unfriendly Internet - Turning Off Cleartext Lookups in September" (February 10, 2022), adds that cleartext UDP and TCP DNS on port 53 — and on this service also port 5353 — was being turned off permanently.

So the change covers:

• Plain DNS over UDP/53
• Plain DNS over TCP/53
• Plain DNS on port 5353 as used by this service

What remains available is the encrypted set of protocols, which the service already offered before the shutdown.

Why the operator made the change

The reason given is framed as "The Unfriendly Internet": the operator's view is that cleartext DNS is a poor fit for a network where queries can be read or interfered with. Rather than continue serving an unencrypted protocol alongside encrypted ones, the service dropped cleartext entirely and required clients to use an encrypted transport.

This is a policy decision by the operator, not a technical failure. The service is run by Thomas Steen Rasmussen as a private individual with his own money, and it is offered free of charge — so the protocol set is his call to make.

What you should use instead

UncensoredDNS publishes two nodes, and both support encrypted transports. The addresses below come from the service's own server information.

The anycast node is served from multiple locations. The unicast node is hosted at AS9167 in Copenhagen, Denmark.

Choosing between the two nodes

• Anycast is the better default if you want the service to route you to a nearby location automatically.
• Unicast pins you to the Copenhagen node. That can be useful if you want a predictable single location, but it also means a single point of failure — the blog has documented past incidents affecting this node, including an IPv6 outage starting February 15, 2021, and a hosting move announced in January 2022 with expected downtime.

How to switch: a concrete example

The exact steps depend on your client, but the shape of the task is the same everywhere. For example, to move a Linux resolver from plain DNS to DoT:

1. Input: your current configuration points at 91.239.100.100 on port 53.
2. Action: change the upstream to the DoT endpoint anycast.uncensoreddns.org:853 and enable TLS for that upstream (for example, in systemd-resolved this means setting DNSOverTLS=yes and using the DoT hostname; in Unbound or dnsdist it means configuring a TLS forwarder).
3. Expected result: queries are sent over an encrypted TLS connection on port 853 instead of cleartext on port 53, and resolution succeeds.

For DoH, the equivalent action is pointing the client at https://anycast.uncensoreddns.org/dns-query instead of an IP on port 53.

Common snags

• Certificate validation needs the hostname. DoT and DoH authenticate the server by name, so configure anycast.uncensoreddns.org or unicast.uncensoreddns.org rather than only the bare IP. Using the IP alone can break validation.
• Port 853 may be blocked. Some networks filter outbound port 853. If DoT fails but DoH on 443 works, that is usually why — DoH rides on standard HTTPS.
• Older clients may not support either. If your router or OS resolver only speaks plain DNS, it cannot use this service anymore; you would need a local forwarder that supports DoT/DoH, or a different resolver.
• The unicast node has had outages. The blog records an IPv6 problem affecting the unicast server in February 2021 and a planned move in January 2022. If you depend on a single node, prefer anycast or configure both.

Later protocol additions

The shutdown of cleartext did not freeze the protocol set. A blog post dated October 23, 2025 announces full support for QUIC-based DNS lookups over UDP/853 — DNS-over-QUIC (DoQ, RFC 9250) and DoH3. If your client supports DoQ or DoH3, those are now options alongside DoT and DoH.