Add modDNS as a recommended DNS resolver

[ArmoredPixels]

Website

modDNS — Open-source DNS filtering by IVPN

Short description

“modDNS is a privacy-focused DNS service that helps protect privacy and improve security by blocking ads, trackers, and malicious domains. It supports modern DNS protocols including DNS-over-HTTPS (DoH), DNS-over-TLS (DoT), and DNS-over-QUIC (DoQ).”

Source: https://app.moddns.net/faq

Why I think this tool should be added

General criteria:

• Security: See May 2025 audit
• Source availability: https://github.com/ivpn/moddns
• Cross-platform support: Supports Windows, macOS, Linux, web browsers, Android, iOS, WiFi routers, and VPN apps.
• Active Development: Developed by the same team that provides IVPN.
• Usability: Comparable to, or slightly simpler than, NextDNS.
• Documentation:
  • https://app.moddns.net/privacy
  • https://app.moddns.net/faq

DNS resolvers criteria:

• Supports DNSSEC
• Supports QNAME minimization
• Anonymizes ECS or disable it by default
• Does not log any personal data to disk

Prior discussion in the forum:

• modDNS closed beta - DNS-level ad/tracker blocking by IVPN
• New IVPN tiers now include modDNS, MailX and Portmaster PRO - #23 by viktorivpn

Personal thoughts:

• Privacy Guides already recommends IVPN.
• I reached out to request clarification on modDNS’s support for QNAME minimization and ECS anonymization since these are requirements for tool recommendation. The team responded within 24 hours to my emails and was amenable to updating their FAQ with their responses (see links in “DNS resolvers criteria”).

Section on Privacy Guides

DNS Resolvers

[ignoramous]

Why I think this tool should be added

moddns looks neat! Unfortunate that it is bundled with iVPN subscription.

Do not read too much in to PG’s criteria for DNS resolvers. moddns is good as it is.

---

@ArmoredPixels

• modDNS — Open-source DNS filtering by IVPN

Privacy (mirror) does not mention what seems like Sentry’s replay and tracing integration on their webpages (code).

@ArmoredPixels

• Supports DNSSEC

A DNS resolver that rewrites answers (like a content-blocking resolver will) will (by definition) violate DNSSEC. This criteria shouldn’t really be there to recommend any DNS resolver.

@ArmoredPixels

• Does not log any personal data to disk

Doubt any of the PG-recommended DNS providers (that require signups) meet this bar. Comical.

[ArmoredPixels]

modDNS does support the HaGeZi blocklists, and many others. I agree that having a similar would be nice, I wouldn’t consider it blocking for the recommendation.

[ph00lt0]

Not sure we should recommend something that is not a standalone service. We recommend ivpn so those users i guess can use this, but does not seems so sensible to recommend it under dns as you cannot get it for that alone anyway.

[iluvprivacy]

I agree, and @viktorivpn has been very responsive, but I’m not totally happy with their roadmap. I wish and hope they’ll implement most of the important HaGeZi blocklists, but he seems a bit hesitant. I think the users should have the choice and make decisions that are best for them. I think the user dashboard should have all the stats that Control D and NextDNS have. I’m hoping modDNS will get there. I’m not sure how modDNS handles individual device statistics, but again, I hope it’ll reach parity with Control D and NextDNS.