blog.uncensoreddns.org

UncensoredDNS has documented several service changes and outages on its blog, most notably the shutdown of two anycast nodes (Kracon and Solido), a unicast server relocation, an IPv6 outage affecting the unicast server via Telia, a period of blog downtime, and the permanent disabling of cleartext DNS on port 53. These events are recorded in the project's blog posts and reflect the operational history of the service run by Thomas Steen Rasmussen.

Anycast node shutdowns

Two anycast nodes were permanently retired:

• Kracon anycast node — shut down permanently on October 24, 2024. The blog post notes that the company sponsoring the node was involved in the decision (the excerpt is truncated, but the shutdown is confirmed as permanent).
• Solido anycast node — also shut down, according to a blog post titled "Solido Anycast Node Shut Down."

What this means for users: The anycast service (anycast.uncensoreddns.org) continues to operate from multiple locations, but the removal of individual nodes can change which physical location answers your queries. If you relied on a specific node for latency or routing reasons, your traffic may now be served from a different location.

Unicast server relocation

A blog post from January 23, 2022 ("Moving Day Coming Up") announced that the unicast server was moving to a new hosting location within one to two weeks, with expected downtime during the transition.

What this means for users: If you use unicast.uncensoreddns.org (89.233.43.71 / 2a01:3a0:53:53::), the move may have caused temporary resolution failures. The unicast node is hosted at AS9167 in Copenhagen, Denmark, so a hosting change could also affect latency for users far from the new location.

IPv6 outage on the unicast server (Telia)

On February 15, 2021, a blog post reported that IPv6 had not been working for the unicast server since 01:57 CET that day, specifically via Telia. The post notes this affected DNS resolution over IPv6.

What this means for users: If your network reaches UncensoredDNS over IPv6 through Telia, queries to the unicast server would have failed or fallen back to IPv4 during that window. This is a useful reminder to check whether your resolver supports both address families if you depend on the unicast node.

Blog downtime

A post from February 10, 2022 ("Blog is Operational Again") states the blog had been offline for longer than the author would have liked before being restored.

What this means for users: The blog is the primary channel for service announcements. During blog outages, status updates may not have been available, so users should also check the project's Twitter account (@censurfridns) for updates.

Cleartext DNS turned off

Although not an outage, this is a major service change: cleartext DNS lookups on port 53 (both TCP and UDP) were permanently turned off on September 1, 2022, following an earlier announcement in February 2022. The blog cites the "unfriendly internet" as the reason.

What this means for users: If your device or router still points to UncensoredDNS over plain port 53, those lookups will no longer work. You must switch to an encrypted protocol:

How to check current status

Because these events span 2021–2025, the most reliable way to confirm what is currently running is to consult the project's own channels:

1. Blog (blog.uncensoreddns.org) — latest posts list service changes and outages.
2. Twitter/X (@censurfridns) — the project directs users here for updates and information.
3. Server info on the homepage — current anycast and unicast addresses and supported protocols are listed there.

If you are troubleshooting a resolution failure, first confirm which endpoint and protocol you are configured for, then check whether that endpoint has been affected by a node shutdown, relocation, or protocol change listed above.

UncensoredDNS provides two public DNS resolvers — an anycast service and a unicast node — reachable over DNS-over-TLS, DNS-over-HTTPS, and (since October 2025) QUIC-based DNS. The service is run by Thomas Steen Rasmussen as a private project and is described on the site as available for anyone to use, free of charge. Below are the exact endpoints and what each one supports.

Server endpoints

The anycast address is served from multiple locations. The unicast node is hosted at AS9167 in Copenhagen, Denmark, so latency from outside Europe will generally be higher on that endpoint.

Supported protocols

DNS-over-TLS (DoT)

• Anycast: anycast.uncensoreddns.org:853
• Unicast: unicast.uncensoreddns.org:853

DNS-over-HTTPS (DoH)

• Anycast: https://anycast.uncensoreddns.org/dns-query
• Unicast: https://unicast.uncensoreddns.org/dns-query

DNS-over-QUIC (DoQ) and DoH3

A blog post dated October 23, 2025 states that UncensoredDNS fully supports QUIC-based lookups over UDP/853 — DoQ (RFC 9250) and DoH3. The same hostnames and IP addresses above apply; only the transport changes.

Cleartext DNS

Cleartext port 53 lookups (TCP and UDP) were turned off on September 1, 2022, following an earlier announcement in February 2022. Port 5353 cleartext was also discontinued. If you are configuring a device that only speaks plain DNS on port 53, these servers will not answer — you need a client that supports DoT, DoH, DoQ, or DoH3.

Choosing between anycast and unicast

• Use anycast if you want the resolver closest to you and the most resilient routing. It is the better default for most users.
• Use unicast if you specifically want the Copenhagen node, for example to compare behavior or to test a single fixed location. Expect downtime notices around host moves; the blog recorded a relocation in early 2022 and an IPv6 outage on the unicast node in February 2021.

Configuration notes and common snags

1. Pick a protocol your client supports. Modern browsers and operating systems handle DoH; routers and stub resolvers more often handle DoT. DoQ/DoH3 needs a client built against those RFCs.
2. Use the hostname, not just the IP, for TLS-based protocols. DoT and DoH rely on certificate validation against the hostname, so entering a bare IP will typically fail.
3. Expect no fallback to port 53. If your DoT/DoH configuration is wrong, resolution fails outright rather than silently downgrading to cleartext.
4. Check the blog for status. Node shutdowns and outages are announced there — for example, the Kracon anycast node was shut down permanently on October 24, 2024, and the unicast node had IPv6 problems in February 2021.

What the blog covers

The UncensoredDNS blog is the project's status and announcement channel. Recurring topics include protocol support changes (DoQ/DoH3, the cleartext shutdown), infrastructure changes (anycast node shutdowns, unicast relocations), outages, and project milestones such as the 15-year anniversary post in October 2024. For updates between posts, the site points to the @censurfridns account on Twitter.

UncensoredDNS permanently turned off cleartext DNS lookups on port 53 (both UDP and TCP) in September 2022, after announcing the plan in February 2022. The stated reason was "The Unfriendly Internet" — the operator's position that unencrypted DNS queries can be observed and manipulated in transit, so the service moved to encrypted-only resolution. If you were using the plain IP addresses 91.239.100.100 or 89.233.43.71 on port 53, those lookups stopped working and you need to switch to DNS-over-TLS (DoT) or DNS-over-HTTPS (DoH).

What exactly was turned off

The blog post "Cleartext DNS Turned Off" (September 01, 2022) states that cleartext port 53 DNS lookups over both TCP and UDP were switched off that day, "as promised." The earlier announcement, "The Unfriendly Internet - Turning Off Cleartext Lookups in September" (February 10, 2022), adds that cleartext UDP and TCP DNS on port 53 — and on this service also port 5353 — was being turned off permanently.

So the change covers:

• Plain DNS over UDP/53
• Plain DNS over TCP/53
• Plain DNS on port 5353 as used by this service

What remains available is the encrypted set of protocols, which the service already offered before the shutdown.

Why the operator made the change

The reason given is framed as "The Unfriendly Internet": the operator's view is that cleartext DNS is a poor fit for a network where queries can be read or interfered with. Rather than continue serving an unencrypted protocol alongside encrypted ones, the service dropped cleartext entirely and required clients to use an encrypted transport.

This is a policy decision by the operator, not a technical failure. The service is run by Thomas Steen Rasmussen as a private individual with his own money, and it is offered free of charge — so the protocol set is his call to make.

What you should use instead

UncensoredDNS publishes two nodes, and both support encrypted transports. The addresses below come from the service's own server information.

The anycast node is served from multiple locations. The unicast node is hosted at AS9167 in Copenhagen, Denmark.

Choosing between the two nodes

• Anycast is the better default if you want the service to route you to a nearby location automatically.
• Unicast pins you to the Copenhagen node. That can be useful if you want a predictable single location, but it also means a single point of failure — the blog has documented past incidents affecting this node, including an IPv6 outage starting February 15, 2021, and a hosting move announced in January 2022 with expected downtime.

How to switch: a concrete example

The exact steps depend on your client, but the shape of the task is the same everywhere. For example, to move a Linux resolver from plain DNS to DoT:

1. Input: your current configuration points at 91.239.100.100 on port 53.
2. Action: change the upstream to the DoT endpoint anycast.uncensoreddns.org:853 and enable TLS for that upstream (for example, in systemd-resolved this means setting DNSOverTLS=yes and using the DoT hostname; in Unbound or dnsdist it means configuring a TLS forwarder).
3. Expected result: queries are sent over an encrypted TLS connection on port 853 instead of cleartext on port 53, and resolution succeeds.

For DoH, the equivalent action is pointing the client at https://anycast.uncensoreddns.org/dns-query instead of an IP on port 53.

Common snags

• Certificate validation needs the hostname. DoT and DoH authenticate the server by name, so configure anycast.uncensoreddns.org or unicast.uncensoreddns.org rather than only the bare IP. Using the IP alone can break validation.
• Port 853 may be blocked. Some networks filter outbound port 853. If DoT fails but DoH on 443 works, that is usually why — DoH rides on standard HTTPS.
• Older clients may not support either. If your router or OS resolver only speaks plain DNS, it cannot use this service anymore; you would need a local forwarder that supports DoT/DoH, or a different resolver.
• The unicast node has had outages. The blog records an IPv6 problem affecting the unicast server in February 2021 and a planned move in January 2022. If you depend on a single node, prefer anycast or configure both.

Later protocol additions

The shutdown of cleartext did not freeze the protocol set. A blog post dated October 23, 2025 announces full support for QUIC-based DNS lookups over UDP/853 — DNS-over-QUIC (DoQ, RFC 9250) and DoH3. If your client supports DoQ or DoH3, those are now options alongside DoT and DoH.

UncensoredDNS is a free, uncensored DNS service run by Thomas Steen Rasmussen as a private project funded with his own money. It provides two public DNS servers — an anycast node and a unicast node — and its blog is where the operator posts project news: new protocol support, server shutdowns, outages, and milestones. If you want a DNS resolver that doesn't filter queries, or you want to track the operational history of this specific service, the blog is the primary source.

What the service actually provides

The homepage lists two resolvers, each reachable over several protocols:

Two things follow from this table:

• The service is encrypted-DNS oriented. Cleartext port 53 lookups (TCP and UDP) were turned off in September 2022, after being announced in February 2022. So if you're configuring a device, use DoT or DoH, not a plain resolver address.
• The anycast node is the one to prefer for general use, since it answers from multiple locations. The unicast node is a single host in Copenhagen, which makes it a reasonable secondary or a choice if you specifically want a Danish endpoint.

The service is described as available to anyone, free of charge. The site does not publish pricing tiers or account requirements, and nothing in the material suggests a paid plan exists.

What the blog covers

The blog is an operator's changelog, not a tutorial site. Its posts fall into a few recurring categories:

Protocol and feature support. The most recent post (October 23, 2025) announces full support for QUIC-based DNS lookups over UDP/853 — DNS-over-QUIC (DoQ, RFC 9250) and DNS-over-HTTPS over HTTP/3 (DoH3). If you're choosing a resolver for a client that supports DoQ or DoH3, this is the post that tells you the service is ready for it.

Infrastructure changes. "Kracon Anycast Node Shut Down" (October 24, 2024) notes a sponsored anycast node was permanently retired. "Moving Day Coming Up" (January 23, 2022) warned that the unicast server was relocating within one to two weeks, with expected downtime. These posts matter if you hard-coded an IP address rather than a hostname.

Outages and incidents. "IPv6 Issues for Unicast / Telia" (February 15, 2021) documents IPv6 failing for the unicast server starting at 01:57 CET that day. This is the kind of post to check when a resolver stops answering and you want to know whether it's you or the service.

Milestones and service policy. "Celebrating 15 Years of UncensoredDNS" (October 23, 2024) marks the project's anniversary. "Cleartext DNS Turned Off" (September 1, 2022) and its February 2022 precursor explain the decision to drop port 53 — the reasoning given is the unfriendly state of the internet, i.e. moving users toward encrypted transports.

How to use this in practice

• Setting up a device: use the DoT or DoH hostname rather than the bare IP, so that if a node moves you aren't left pointing at a dead address. The 2022 relocation post is the concrete reason for this habit.
• Checking whether an outage is yours: look at the most recent blog posts before debugging your own configuration. The IPv6/Telia post is an example of a problem that was on the service side.
• Deciding whether the service fits: it is a one-person, self-funded project with no filtering. That means no commercial SLA and no support contract — the blog is effectively the status channel. If you need guaranteed uptime or vendor support, that's a reason to look elsewhere; if you want an unfiltered resolver with published operational transparency, the blog gives you the history to judge it.
• Following updates: the site points to the @censurfridns account on Twitter for project updates, in addition to the blog itself.

One caveat worth stating plainly: the blog records changes after the fact, so it is a historical record and an announcement channel, not a real-time status page. For a live check, query the resolver directly.

Use anycast.uncensoreddns.org if you want the best chance of a fast, resilient connection, since it is served from multiple locations. Use unicast.uncensoreddns.org if you specifically want a single node in Copenhagen, Denmark (hosted at AS9167). Both are free to use, both support DNS-over-TLS and DNS-over-HTTPS, and they differ mainly in how they are distributed and where they are located.

The core difference

Anycast means the same address is announced from several locations, so your queries are routed to a nearby node. Unicast means one specific server in one specific place.

Which one to pick

Choose anycast when:

• You want lower latency without knowing where the servers are.
• You want resilience: if one location has a problem, traffic can be served elsewhere.
• You are configuring a device or router and just want a reliable default.

Choose unicast when:

• You want a predictable, single geographic location (Copenhagen, Denmark).
• You are testing or comparing behavior against a known fixed node.
• You have a reason to prefer that specific network (AS9167).

For most people, anycast is the sensible default. The unicast node is useful when you care about where your DNS queries physically land.

A note on protocol support

Both server sets support the same encrypted protocols, so the anycast-vs-unicast choice does not limit which protocol you can use:

• DNS-over-TLS (DoT): port 853 on either hostname.
• DNS-over-HTTPS (DoH): the /dns-query endpoint on either hostname.

UncensoredDNS has also added QUIC-based lookups over UDP/853 (DoQ, RFC 9250) and DoH3, announced in an October 2025 blog post. Cleartext port 53 lookups (TCP and UDP) were turned off in September 2022, so plan to use an encrypted protocol regardless of which server you choose.

Practical setup

1. Pick a hostname: anycast.uncensoreddns.org (recommended) or unicast.uncensoreddns.org.
2. In your client, choose DoT or DoH.
3. Enter the matching address:
   • DoT: <hostname>:853
   • DoH: https://<hostname>/dns-query
4. If your client asks for raw IPs instead of a hostname, use the IPv4/IPv6 pair from the table above.
5. Verify it works by resolving a domain and confirming the answer comes back; if it fails, check that you are not still trying cleartext port 53, which is no longer served.

Common pitfalls

• Using port 53 in cleartext: it was disabled in 2022. Switch to DoT or DoH.
• Mixing hostnames and IPs: the anycast and unicast IPs are not interchangeable; match the IP to the hostname you chose.
• Assuming anycast is always faster: it usually is, but routing depends on your network. If latency matters, test both and compare.