# DeCloudUs DNS

> The most secure, private, customizable, and affordable DNS service.

Block ads, trackers, malware and adult content — or single apps like TikTok — on every device. Per-profile parental controls, schedules and safe search.

The earlier DeCloudUs servers (Alpha, Echo, Zulu and the rest) are retired. The service is now more robust and fully customizable, with profile-based and device-based configuration.

## Getting started

1. **Create your account** ([portal.decloudus.com](https://portal.decloudus.com)): Sign up with just an email — no credit card, no personal details required. Your free trial starts instantly.
2. **Configure your profile**: Choose what to block: ads, trackers, malware, adult content, social media, or write your own custom rules with wildcards.
3. **Point your devices** ([setup guide](https://decloudus.com/setup)): Set our encrypted DNS address on your phone, router, or any device. No apps to install — it just works, system-wide.

No account is needed for the Free resolver; its addresses are under Plans.

## Features

- **Block ads, trackers & malware**: Curated blocklists with hundreds of thousands of domains stop ads, trackers, malware, and phishing before your devices ever reach them.
- **Parental controls**: Create safe browsing profiles for kids. Block adult content, social media, streaming, and gambling with a single click — schedule different rules for school nights.
- **Security & privacy first**: DNS-over-TLS, DNS-over-HTTPS, and DNSCrypt on every profile. Plain and unencrypted DNS is intentionally blocked — your privacy and security matter to us!
- **Optional logs & analytics**: Logs are off by default — enable them per-profile only when you want them and easily delete them when you want. We never sell, share, or analyze your DNS traffic. Your data is only yours.
- **Block whole categories**: Easily toggle tens of broad site categories like de-google, adult content, gambling, social media, streaming, telemetry, etc with a single click.
- **Block specific services**: Granular blocking for hundreds of services — disable Facebook, TikTok, YouTube, or any other service without disrupting the rest of the web.
- **Multiple DNS profiles**: Create separate profiles for kids, work devices, gaming consoles, etc. Each profile has its own filters, custom rules, and schedules.
- **Your own custom rules**: See what it feels like to be in complete control! Block, allow, or rewrite any domain or IP with wildcard support. We make it easy with bulk imports.
- **Time-based schedules**: Switch profile rules automatically by time of day or day of week. Perfect for parental control or focused work hours.
- **Just ask for what you want**: Tell the built-in assistant "block TikTok on the kids' devices" and it does it — no rules to write. Or connect the AI you already use, like ChatGPT or Claude, and manage everything from there for free.
- **Works on every device**: Set up on phones, tablets, routers, gaming consoles, browsers, smart TVs — anything that supports encrypted DNS. No apps or extensions needed.
- **Robust developer APIs**: Power users can easily automate every single aspect of the DNS service from creating profiles to updating them to pulling all query logs (if enabled).

## What makes us different

- **Commitment to privacy**: Zero-knowledge by design — we don't need your real name, billing details, or IP address to operate. Logs are off by default and retention is yours to control. We never sell, share, or analyze your DNS traffic — and if you use our AI assistant, the AI models keep nothing and train nothing on what you ask.
- **No cloud or big tech**: Our infrastructure is self-managed end to end. No cloud workers. No Cloudflare proxies. No AWS load balancers. Your DNS traffic leaves your devices encrypted and stays encrypted until it reaches our own resolvers. Every byte your device sends is handled by infrastructure we control. Even our AI features are optional — connect the assistant you already pay for instead, and you are not tied to ours at all.
- **Truly customizable**: Block whole categories, individual services, or write your own advanced rules with wildcards. You can even block sites/services based on IPs they resolve to. Use different profiles for different family members or devices. Schedule different rule sets by time of day. You do not have to learn our tools, just ask the assistant in your native language and it sets it up for you. It's your DNS — bend it to your needs.
- **Customer service that responds**: We answer support emails, usually within a day. Bug reports become roadmap items, and feature requests genuinely shape what we build next. You're not "user 8745" — you're a person we're happy to help.

## Plans

Prices in USD.

- **Free**: Basic privacy and security protection. No subscription required. Includes: Works with DoT, DoH and DNSCrypt; Blocks ads, trackers, and malware. Limitations: One DNS profile shared by all users; No blocking for other site categories/services; No customization or custom rules; Single location, prone to higher latency; Throttled — slow under heavy load; No multiple profiles or schedules; No DNS logs or analytics.
  - DNS-over-TLS: `dns.decloudus.com`
  - DNS-over-HTTPS: `https://dns.decloudus.com/dns-query`
  - DNSCrypt (DoH stamp, for dnscrypt-proxy and apps that take a stamp): `sdns://AgAAAAAAAAAAAAARZG5zLmRlY2xvdWR1cy5jb20KL2Rucy1xdWVyeQ`
- **Premium**: from $0.50 per month when billed annually ($5.94 a year). 10-day free trial, no credit card required. Includes: 1 DNS profile; Block by category (ads, trackers, malware…); Block by service (Facebook, TikTok, YouTube…); Optional logs & analytics; Developer API & connect your own AI; Dex, the built-in AI assistant (Optional add-on). Not included: Custom rules with wildcards; Time-based scheduled rules; Region selection; Custom upstream resolver.
- **Premium Plus**: from $0.99 per month when billed annually ($11.88 a year). 10-day free trial, no credit card required. Includes: 5 DNS profiles (plus add-on profiles); Block by category (ads, trackers, malware…); Block by service (Facebook, TikTok, YouTube…); Custom rules with wildcards (up to 1,000); Time-based scheduled rules; Region selection; Custom upstream resolver; Optional logs & analytics; Developer API & connect your own AI; Dex, the built-in AI assistant (Optional add-on). Additional profiles are available as an optional add-on.

## Product

- [How to set up encrypted DNS on any device](https://decloudus.com/setup): Set up encrypted DNS on Android, iPhone, Mac, Windows 11, routers and browsers. One setting, no app to install, and how to check it is working.
- [Pricing](https://decloudus.com/pricing): Plans for encrypted DNS with filtering, per-device profiles and parental controls. Free tier available, free trial with no card, cancel any time.
- [Dex AI assistant — manage your DNS by asking](https://decloudus.com/dex): An AI assistant in your dashboard that changes your DNS filtering when you ask, and checks with you before deleting anything. Or connect your own AI.
- [DeCloudUs vs NextDNS, Control D and AdGuard DNS](https://decloudus.com/compare): Prices side by side, six questions to ask any provider, and where DeCloudUs is the wrong choice. A year of Premium costs under a third of NextDNS Pro.
- [Guides](https://decloudus.com/guides): Plain-English guides, kept current: parental controls, enforce safe search, block TikTok, block social media, block Roblox, block Google and more.

## Guides

- [How to enforce safe search on every device](https://decloudus.com/guides/enforce-safe-search): Enforce SafeSearch on Google, Bing and DuckDuckGo, and YouTube Restricted Mode, on every device, consoles and TVs too, so it cannot be switched off.
- [DNS parental controls for every device](https://decloudus.com/guides/parental-controls): Block TikTok, Roblox or adult content per device, on a schedule, with safe search enforced, including consoles and tablets where no app installs.
- [Block Google on every device](https://decloudus.com/guides/degoogle): Block Google’s trackers, analytics and background traffic on every device, not just in the browser, and choose what to allow back.
- [Stop smart TV tracking — Roku, LG, Samsung](https://decloudus.com/guides/smart-tv-tracking): Stop Roku, LG and Samsung televisions reporting what you watch. Block their tracking on your network and keep the TV working.
- [Should you block newly registered domains?](https://decloudus.com/guides/newly-registered-domains): A huge share of the web’s worst behaviour comes from addresses only days old. Most are .com, not the cheap extensions people block. What that means.
- [How an AI assistant can run your DNS for you](https://decloudus.com/guides/manage-dns-with-ai): Say what you want in ordinary words and the settings change. What happens in between, what MCP is, and how to connect the AI you already use.
- [How to block TikTok on every device in the house](https://decloudus.com/guides/block-tiktok): Block the TikTok app, not just the website, on every device, consoles and tablets too, plus the reasons a block seems to fail and how to fix them.
- [How to block social media on every device](https://decloudus.com/guides/block-social-media): Block Facebook, TikTok, Instagram, Snapchat and the rest with one switch, on every phone, tablet and console, or only during homework and bedtime.
- [How to block Roblox on every device in the house](https://decloudus.com/guides/block-roblox): Block Roblox on phones, tablets, computers and consoles with one switch, or only at the hours you choose, and what to check if it seems not to work.
- [Do you need an app for DeCloudUs to work?](https://decloudus.com/guides/decloudus-app): Manage your profiles, rules and Dex from your home screen. Install it from the browser in seconds and sign in with Face ID, Touch ID or a fingerprint.

## Developers

- [API reference](https://decloudus.com/developer): every endpoint of the account API
- [Connecting an AI assistant](https://decloudus.com/developer/mcp): the MCP server, its authorisation and limits
- [OpenAPI specification](https://decloudus.com/developer/openapi.json): the account API, machine-readable

## FAQ

- **What does it mean to use DNS to block ads, trackers, malware, etc?** Every time your device opens a website or an app, it asks a DNS resolver to translate domain names into IP addresses. We sit at that layer and refuse to resolve known ad, tracker, malware, phishing domains, and anything else you wish to block — so your devices never even reach those servers. No software, no apps, no browser extensions, just a one-time DNS setting change on each device.
- **Do I need to install an app on each device?** No. You change one DNS setting, once, on the device or on your router. Android has Private DNS built in, iOS and macOS take a configuration profile you download from the dashboard, Windows 11 supports encrypted DNS natively, and most routers accept DoT or DNSCrypt. Nothing installs and nothing runs in the background. We also work as the upstream resolver for Pi-hole, AdGuard Home, OPNsense/pfSense and OpenWrt if you prefer.
- **How do I block TikTok, Roblox or other apps on my kids' devices?** Pick the app by name — TikTok, Roblox, Instagram, Steam, Discord, Fortnite and many more — and switch the block on per profile. Because the block happens at the DNS layer it applies to every device on that profile at once, including consoles and tablets where you cannot install anything.
- **Can I set different rules for different devices?** Yes — that is what profiles are for. Each profile has its own resolver address, its own filtering categories, its own blocked services and its own custom rules. Point a device at a profile's address and it inherits exactly that policy, with nothing shared between profiles unless you want it to be.
- **Is there a query limit or device limit?** No DNS query limit and no device limit. Set up our DNS on as many devices and routers as you want — your phone, laptop, browser, gaming console, smart TV, an entire home network — all work the same.
- **Will it slow down my internet?** In practice, browsing usually feels faster, especially if you enable blocking for ads and trackers because your devices simply don't download them. Our resolvers are tuned for speed, and auto-routing sends your queries to a healthy resolver near you.
- **What happens to my logs if I enable them?** Logs are kept only for the retention period you choose for each profile. You can delete all logs for a profile at any time from the dashboard. They are never used for advertising, analytics, or any third-party purpose.
- **Can I use "regular" DNS - with plain IPv4 or IPv6 address - instead of DoT, DoH, or DNSCrypt?** We only use secure and encrypted DNS protocols as they guarantee that communication between your devices and our servers is completely secure and private. DNS queries over plain IPv4 or IPv6 can be read or modified by other parties as the traffic moves through the Internet, so they are neither secure nor private. You can use our secure DNS on any device or software that supports DoT, DoH, or DNSCrypt, which is fairly wide-spread nowadays. If your network device/router does not support encrypted DNS, you can set up secure DNS directly on individual devices that you wish to secure (mobile devices, laptops, browsers, etc). Alternatively, you can install additional software on your network to extend secure/encrypted DNS to your entire network (such as dnscrypt-proxy or Stubby).
- **My VPN provider (NordVPN, ProtonVPN, PIA, etc) is asking for DNS servers IPs. What IPs should I use?** For OpenVPN in general (which is what most VPN providers use), it is possible for VPN tunnel to use your device's DNS settings so you do not have to configure DNS IPs with the VPN provider. For mobile phones, for example, Private DNS option is set to use our DNS in android settings. Most VPN providers allow you to download a VPN client profile to modify and use on other OpenVPN apps (like the official OpenVPN app). The OpenVPN client profile you use from the VPN provider doesn't have any parameters regarding DNS settings. DNS queries are then handled by our DNS servers, securely, while the tunnel is up and running.
- **Can I block things only at certain times, like during school or bedtime?** Yes. Schedules let a profile switch policy by time of day and day of week, so social media can be blocked during homework hours and allowed afterwards without you touching anything. The change takes effect at the resolver, so it applies immediately to every device on that profile.
- **Which devices and platforms does it work on?** Anything that lets you set a DNS server: Android, iOS, macOS, Windows, Linux, browsers, routers, and clients such as Stubby, Unbound and dnscrypt-proxy. Encrypted transports are supported over DNS-over-HTTPS, DNS-over-TLS and DNSCrypt, so queries stay private in transit as well as filtered.
- **What do you log about my browsing?** Nothing, unless you turn query logging on yourself. It is off by default. If you do enable it — usually to see what your devices are connecting to or to monitor online activities — you choose how long entries are kept, you can read them in the dashboard and export them, and you can delete them at any time.
- **Can I use it for parental control?** Yes, that's one of the most common use cases. Create a separate profile for kids and configure it exactly how you want. For example, enable adult content / social media / streaming category blocks, enforce safe-search, filter YouTube content as moderate or strict, add custom rules for any specific sites you want to enforce, and optionally enable logs to review activity. You can even schedule different rules for school nights vs. weekends.
- **How is this different from 1.1.1.1, Quad9 or Google DNS?** Those resolvers answer every query the same way for everyone; they are known for speed and are sometimes more private than your ISP. DeCloudUs is yours: you decide what is blocked, and you can decide differently for each device. A child's tablet, a work laptop and a smart TV can each run their own profile with their own categories, service blocks, schedules and rules, and optional logs only when you actually want them.
- **How private is the service?** Logs are off by default — your DNS queries are not stored anywhere unless you explicitly enable per-profile logging for diagnostics. We only require an email so you can manage your account. Our infrastructure is self-managed; we don't proxy your DNS queries through Cloudflare, AWS, or any other big-cloud provider that parses your traffic, so your DNS query goes from your devices to our DNS resolvers directly in a secure and private way and only our own DNS servers processes it.
- **Can I just tell it what to block instead of manually setting up rules?** Yes. Every paid plan includes Dex, an assistant built into your dashboard — say "block TikTok on the kids' devices" or "why isn't this site loading?" and it does the work and explains what it changed. It is private, safe, secure and it asks you first before deleting anything. You never have to use it: every setting it touches is available in the dashboard the ordinary way.
- **Can I use my own AI assistant instead, like ChatGPT or Claude?** Yes, and it costs nothing extra from our side. If you already pay for an AI assistant, you can connect it to your account and manage your DNS by asking it — it connects to your DeCloudUs account securely through the open Model Context Protocol (MCP). It is easy to connect and you have control on how much access you give it. Because it runs on your own AI subscription, we charge nothing for the connection.
- **What does Dex AI assistant cost, and does it see my browsing?** Dex, our built-in assistant runs on hosted AI providers that charge for compute power, so it is paid for with credits you buy separately from our dashboard — a small one-off purchase, not a subscription, and unused credits never expire while your account is active. Connecting your own assistant instead is free. On privacy: only what is needed to answer the question you asked is ever sent, only when you ask one, and the AI model and hosting provider never store your data or train models on it. Your conversation history stays on our servers for your reference, and you can delete it at any time.
- **Is there a free trial? Do I need a credit card?** Yes — paid plans include a free trial period (the exact length is shown on each plan card). No credit card is required up front. After the trial, you can subscribe with the payment method you prefer. If you don't subscribe, the account is automatically removed when the trial ends.
- **Can I cancel anytime?** Yes. Cancellation is one click in the dashboard — no support ticket, no retention call. After cancelling a paid subscription, you can keep using the service through the end of your billing period. You can also delete your account completely at any time, in a couple of clicks.

## Optional

- [Terms of Service](https://decloudus.com/terms): The terms that apply to DeCloudUs DNS accounts, subscriptions and acceptable use of the service.
- [Privacy Policy](https://decloudus.com/privacy): What DeCloudUs does and does not record. Query logging is off by default, and you choose the retention when you turn it on.