🚀 DoH Proxy Pro

A personal DNS over HTTPS service with parallel routing, Circuit Breaker, and geographic server selection — for bypassing filtering at the DNS layer.

runtimeCloudflare Workers protocolDNS-over-HTTPS providers7 licenseMIT

Active and ready — Parallel Racing, Circuit Breaker, geo-selection, and adaptive learning are running

This is an advanced DNS over HTTPS (DoH) service with anti-censorship features.
The Pro version includes: Parallel DNS Racing, Circuit Breaker Pattern, Geo-based Selection, DNS Padding, ECS Stripping, Negative Caching, Adaptive Timeouts, Enhanced Header Randomization, and more.

📊 View Live Server Statistics

📍 Your Service Address

https://domain-name-system-over-https.pages.dev/dns-query

✨ Advanced Features

⚡

Parallel DNS Racing — the top 10 servers are tried simultaneously and the first valid response wins

🛡️

Circuit Breaker Pattern — automatically manages unhealthy servers and temporarily takes them out of rotation

🌍

Geo-based Selection — picks the best server based on the user's geographic location

🧠

Adaptive learning that scores and selects servers more intelligently over time

🔄

Smart load balancing based on each server's response speed and reliability

🔒

DNS Padding per RFC 8467 — prevents packet-size analysis

🚫

ECS Stripping — genuinely removes EDNS Client Subnet from the OPT record

💾

Smart Caching with automatic management of cache size and expiry

⏱️

Adaptive Timeouts — automatically adjusts wait time based on each server's history

🔁

Negative Caching — intelligent caching of NXDOMAIN responses

⚙️

Uses 7 trusted DNS providers

🎭

Enhanced Header Randomization against provider-side fingerprinting

📊

Dynamic scoring: 35% health, 30% speed, 20% reliability, 15% region

🔗

Request Coalescing — merges concurrent requests for the same query to reduce latency

🌏

Full CORS support for browser requests

📡

JSON DoH API support with the application/dns-json format

🌐 DNS Providers Used

7 trusted DNS providers with region-based endpoint selection

Cloudflare, Google, Quad9, OpenDNS

AdGuard, NextDNS, Mullvad

✅ What this DoH proxy does

• Fully encrypts DNS requests over HTTPS
• Bypasses DNS poisoning and prevents tampering with DNS responses
• Opens websites filtered at the DNS layer
• Improves privacy — your ISP cannot see which domains you query
• Prevents man-in-the-middle attacks at the DNS layer
• Higher speed with Racing Mode, Circuit Breaker, and Smart Caching

💡 Understanding filtering types

Network filtering usually happens at several independent layers, each with its own solution:

Filtering Layer	Description	Is this DoH enough?
DNS Filtering	The site is blocked or spoofed at the DNS response level	✓ Yes
SNI Filtering	The connection is identified and blocked by the domain name in the TLS ClientHello	✗ No — needs ECH or Fragment
IP Blocking	The destination IP address is blocked directly	✗ No — needs a VPN/Proxy
Deep Packet Inspection	Packet patterns are inspected regardless of DNS or SNI	✗ No — needs an advanced VPN/Proxy

Bottom line: if the site you want is filtered only via DNS, this DoH is enough. For more advanced filtering (SNI/IP/DPI), use this DoH together with a Fragment config or a VPN — the two operate at different network layers and complement each other rather than replacing each other.

📱 How to Use

🌐 Browsers (Firefox, Chrome, Edge, Brave)

Go to browser settings → Privacy or Security → DNS over HTTPS → choose Custom Provider and enter the address above.

Enable ECH in Firefox:

1. Type this in the address bar: about:config
2. Search for: network.dns.echconfig.enabled
3. Set the value to true

With these settings, many DNS-filtered sites become accessible.

📱 Intra App (Android)

1. Install Intra from Google Play
2. Open the app
3. Tap "Configure custom server URL"
4. Enter the address below in the Custom DNS over HTTPS server URL field:

https://domain-name-system-over-https.pages.dev/dns-query

5. Turn the ON switch on

This encrypts your DNS and opens sites that are blocked only by DNS filtering.

🍎 iOS, iPadOS, and macOS

For Apple devices, download and install your personal profile:

🍎 Download iOS/macOS Profile

Installation:

• iOS/iPadOS: download the file with Safari → Settings → General → VPN, DNS & Device Management → Downloaded Profile → Install
• macOS: download the file → System Settings → Privacy & Security → Profiles → install the profile

After installation, DNS for all your apps is encrypted.

💻 Windows 10/11

Settings → Network & Internet → Properties → DNS server assignment → Edit → Preferred DNS encryption: Encrypted only (DNS over HTTPS), then enter the address above.

🐧 Linux (systemd-resolved)

1. Edit the config file:

sudo nano /etc/systemd/resolved.conf

2. Add these lines:

[Resolve]
DNS=https://domain-name-system-over-https.pages.dev/dns-query
DNSOverTLS=yes

3. Restart the service:

sudo systemctl restart systemd-resolved

🔧 Router

Depending on the model, your router may support DoH. Check your router's DNS settings. Configuring DoH on the router makes every device on the network use encrypted DNS.

🔧 Xray Configs

Simple Config (v2rayNG and similar)

For Xray-based clients, you can use the config below:

doh-proxy-simple.json

{ "remarks": "🛡️ DoH Proxy Pro", "dns": { "servers": [ { "address": "https://domain-name-system-over-https.pages.dev/dns-query", "skipFallback": true } ], "queryStrategy": "UseIP" }, "inbounds": [ { "port": 10808, "listen": "127.0.0.1", "protocol": "socks", "settings": { "auth": "noauth", "udp": true }, "sniffing": { "enabled": true, "destOverride": ["http", "tls"] } } ], "outbounds": [ { "protocol": "freedom", "settings": { "domainStrategy": "UseIP" }, "tag": "direct" } ], "routing": { "domainStrategy": "AsIs", "rules": [ { "type": "field", "outboundTag": "direct", "network": "udp,tcp" } ] } }

Note: this config secures your DNS and opens sites that are blocked only by DNS filtering.

Advanced Config with Fragment (Recommended)

On top of DoH, this config adds Fragment support, which helps bypass SNI-based filtering at the TCP/TLS layer:

doh-proxy-fragment.json

{ "remarks": "🛡️ DoH Proxy Pro + Fragment", "version": { "min": "26.6.27" }, "log": { "loglevel": "warning", "dnsLog": false, "access": "none" }, "policy": { "levels": { "0": { "uplinkOnly": 0, "downlinkOnly": 0 }, "1": { "uplinkOnly": 0, "downlinkOnly": 0, "connIdle": 12 } } }, "dns": { "hosts": { "cloudflare-dns.com": "challenges.cloudflare.com", "domain-name-system-over-https.pages.dev": [ "172.67.73.38", "104.19.155.92", "104.16.124.175" ] }, "servers": [ { "address": "https://domain-name-system-over-https.pages.dev/dns-query" }, { "address": "fakedns", "domains": [ "domain:ir", "geosite:private", "geosite:category-ir", "full:challenges.cloudflare.com" ] }, { "tag": "no-filter-dns", "address": "https://cloudflare-dns.com/dns-query", "timeoutMs": 12000, "finalQuery": true }, { "address": "localhost", "domains": [ "domain:ir", "geosite:private", "geosite:category-ir", "full:challenges.cloudflare.com" ], "finalQuery": true } ], "queryStrategy": "UseSystem", "useSystemHosts": true, "serveStale": true }, "inbounds": [ { "tag": "mixed-in", "port": 10808, "protocol": "mixed", "sniffing": { "enabled": true, "destOverride": [ "fakedns", "tls", "http", "quic" ], "routeOnly": false }, "settings": { "udp": true, "ip": "127.0.0.1" }, "streamSettings": { "sockopt": { "tcpKeepAliveInterval": 1, "tcpKeepAliveIdle": 11 } } } ], "outbounds": [ { "tag": "block", "protocol": "block" }, { "tag": "tcp-direct", "protocol": "direct", "streamSettings": { "sockopt": { "domainStrategy": "ForceIP", "happyEyeballs": { "tryDelayMs": 300, "prioritizeIPv6": true, "interleave": 2, "maxConcurrentTry": 20 } } } }, { "tag": "udp-direct", "protocol": "direct", "settings": { "targetStrategy": "ForceIPv6v4" } }, { "tag": "dns-out", "protocol": "dns", "settings": { "userLevel": 1 } }, { "tag": "tcp-fragment", "protocol": "direct", "streamSettings": { "finalmask": { "tcp": [ { "type": "fragment", "settings": { "packets": "1-1", "lengths": [ "1" ], "delays": [ "1", "1", "1", "1", "1", "1", "1", "1", "1", "400", "1", "1", "1", "1", "1", "1", "1", "1", "1", "400", "1", "1", "1", "1", "1", "1", "1", "1", "1", "400", "1" ], "maxSplit": "419" } } ] }, "sockopt": { "domainStrategy": "ForceIP", "happyEyeballs": { "tryDelayMs": 300, "prioritizeIPv6": true, "interleave": 2, "maxConcurrentTry": 20 } } } }, { "tag": "tcp-fragment-tls", "protocol": "direct", "streamSettings": { "finalmask": { "tcp": [ { "type": "fragment", "settings": { "packets": "tlshello", "lengths": [ "5", "1" ], "delays": [ "0" ], "maxSplit": "0" } }, { "type": "fragment", "settings": { "packets": "1-1", "lengths": [ "43", "1" ], "delays": [ "1", "1", "1", "1", "1", "1", "1", "1", "1", "400", "1", "1", "1", "1", "1", "1", "1", "1", "1", "400", "1", "1", "1", "1", "1", "1", "1", "1", "1", "400", "1" ], "maxSplit": "522" } } ] }, "sockopt": { "domainStrategy": "ForceIP", "happyEyeballs": { "tryDelayMs": 300, "prioritizeIPv6": true, "interleave": 2, "maxConcurrentTry": 20 } } } } ], "routing": { "domainStrategy": "IPOnDemand", "rules": [ { "outboundTag": "tcp-fragment-tls", "inboundTag": [ "no-filter-dns" ] }, { "outboundTag": "dns-out", "port": 53 }, { "outboundTag": "tcp-direct", "network": "tcp", "domain": [ "domain:ir", "geosite:private", "geosite:category-ir" ] }, { "outboundTag": "udp-direct", "network": "udp", "domain": [ "domain:ir", "geosite:private", "geosite:category-ir" ] }, { "outboundTag": "block", "ip": [ "10.10.34.0/24", "2001:4188:2:600::/64" ] }, { "outboundTag": "tcp-direct", "network": "tcp", "ip": [ "geoip:private", "geoip:ir" ] }, { "outboundTag": "udp-direct", "network": "udp", "ip": [ "geoip:private", "geoip:ir" ] }, { "outboundTag": "block", "network": "udp", "protocol": [ "quic" ], "ip": [ "0.0.0.0/0", "::/0" ] }, { "outboundTag": "block", "network": "udp", "port": "443", "ip": [ "0.0.0.0/0", "::/0" ] }, { "outboundTag": "udp-direct", "network": "udp", "ip": [ "0.0.0.0/0", "::/0" ] }, { "outboundTag": "tcp-fragment-tls", "network": "tcp", "protocol": [ "tls" ], "ip": [ "0.0.0.0/0", "::/0" ] }, { "outboundTag": "tcp-fragment-tls", "network": "tcp", "port": "443", "ip": [ "0.0.0.0/0", "::/0" ] }, { "outboundTag": "tcp-fragment", "network": "tcp", "ip": [ "0.0.0.0/0", "::/0" ] }, { "outboundTag": "block", "port": "0-65535" } ] } }

Fragment config benefits:

• Splits the TLS ClientHello packet to bypass DPI
• Complements DoH; it operates at a different network layer
• Improves the ability to bypass more advanced filtering

🛡️ Security Recommendations

For maximum security and access:

Scenario 1 — DNS filtering only:
✓ Use this DoH proxy
✓ Many sites become accessible

Scenario 2 — more advanced filtering:
✓ Use this DoH proxy
✓ Enable ECH in your browser
✓ Use the Fragment config in Xray
✓ Use a VPN for the other layers

General tips:
• Use up-to-date browsers
• Keep HTTPS enabled at all times
• Use reputable security software
• Use strong passwords

❓ Frequently Asked Questions

Can I access filtered sites with this DoH?

Yes, if the site is filtered only by DNS. If it is filtered by other methods (IP blocking, DPI, SNI), you will also need Fragment or a VPN.

What is Fragment and how does it help?

Fragment is an anti-filtering technique that splits the TLS ClientHello packet at the TCP level so that DPI cannot see the domain name (SNI) in a single complete packet. It applies to the connection to the destination itself, not to DNS, which is why it complements DoH rather than replacing it.

What is ECH and how does it help?

Encrypted Client Hello encrypts the domain name (SNI) during the TLS handshake and prevents SNI-based filtering. To use it, both your browser or client and the destination server must support it.

How is this DoH different from 1.1.1.1?

This is your own personal DoH proxy running on a Cloudflare Worker. Instead of relying on a single provider, it sends requests to the top 10 DNS servers simultaneously (Parallel Racing), sets unhealthy servers aside with a Circuit Breaker, picks the best server based on geographic location, and caches results intelligently. It ultimately uses the same trusted providers, but with an added layer of reliability and speed.

Is this service free?

Yes — it is completely free within the Cloudflare Workers free tier (100,000 requests per day).

Does using this DoH reduce speed?

No — with smart caching and Racing Mode you usually get the fastest response available.

What is the difference between the simple config and the Fragment config?

The simple config only enables DoH and is enough to bypass filtering at the DNS layer. On top of DoH, the Fragment config also splits TLS ClientHello packets, which helps bypass more advanced filtering (SNI/DPI). For maximum access, the Fragment config is recommended.

Can anyone see that I use this service?

Your DNS requests are encrypted and your ISP cannot see their contents; it can only see that you are connected to a Cloudflare server.

How does Parallel Racing work?

The system sends requests to the top 10 DNS servers simultaneously (scored by region, speed, health, and reliability) and accepts the first valid response. This reduces latency and improves reliability.

What is Request Coalescing?

When several users or apps query the same domain at the same time, instead of sending several separate requests to the upstream provider, the Worker sends only one and shares the response among all of them. This reduces server load and latency.