← back to home

secure by design

how we built le_dns to protect your privacy and security.

architecture simplified overview

le_dns is built on a multi-layered architecture where each component has a specific role and limited scope. This separation of concerns minimizes attack surface and ensures that a compromise of one layer doesn't affect others. 

                              YOUR DEVICE
                                   │
        ┌──────────────────────────┼───────────────────────┐
        │              │           │           │           │
   :443/https       :53/udp     :53/tcp    :853/tls   :8853/quic
        │              │           │           │           │
        ▼              └───────────┴───────────┴───────────┘
┌───────────────────┐                          │
│ REVERSE PROXY     │                          ▼
│                   │         ┌─────────────────────────────────┐
│  • tls terminate  │         │ Secure DNS PROXY                │
│  • http/2         │         │                                 │
│  • doh routing    │         │  • rate limiting                │
└─────────┬─────────┘         │  • ddos protection              │
          │                   │  • query validation             │
          │  /dns-query       │  • response caching             │
          └──────────────────►│  • dot/doq termination          │
                              │  • any query blocking           │
                              └────────────────┬────────────────┘
                                               │
                                               ▼
                              ┌─────────────────────────────────┐
                              │ RECURSIVE RESOLVER              │
                              │                                 │
                              │  • dnssec validation            │
                              │  • direct root queries          │
                              │  • no upstream forwarding       │
                              │  • response rate limiting       │
                              └────────────────┬────────────────┘
                                               │
                                               ▼
                                        ROOT SERVERS
                                      & AUTHORITATIVE NS

ddos & amplification protection

le_dns implements multi-layer protection against DDoS attacks, amplification abuse, and misuse. These limits are tuned for high-traffic legitimate users (corporate networks, ISP CGN) while blocking attacks.

DNS proxy (front-line):

Query filtering: ANY queries are blocked (primary amplification vector).
Burst limit: 1000 QPS per IP (10s window) - exceeded = DROP
Sustained limit: 500 QPS per IP (60s window) - exceeded = REFUSED
Dynamic blocking: >2000 QPS = 5 min block, NXDOMAIN floods = 1 min block

Resolver Response Rate Limiting (RRL):

Anti-amplification at the resolver level. Attackers spoofing source IPs get rate-limited collectively.
Responses: 50/sec per /24 (IPv4) or /48 (IPv6)
Slip: 1 in 2 dropped queries get TC=1 (forces TCP retry for legitimate clients)
NXDOMAIN limit: 20/sec per prefix (stops enumeration)
Absolute cap: 100/sec per prefix

Response caching:

Large cache reduces backend load and absorbs query spikes.
Max TTL: 24 hours | Min TTL: 30 seconds | Stale serving: 24 hours (if backend fails)

Why these values? A corporate network with hundreds of users behind NAT can query at 500 QPS sustained (~43 million queries/day) without issues. Only attack-level traffic triggers blocking.

traffic filtering

All incoming traffic passes through multiple filtering layers before reaching the resolver:

encryption everywhere

We support multiple encrypted DNS protocols to ensure your queries can't be intercepted:

All TLS connections use modern cipher suites with TLS 1.2 minimum. Certificates are automatically renewed and monitored.

privacy & gdpr compliance

As a European service, we take GDPR seriously. Here's how we protect your privacy:

IP truncation (pseudonymization) at the edge:

IP addresses are truncated (pseudonymized) before any logging occurs. This is not full anonymization—it's pseudonymization per GDPR Article 4(5), meaning the data is still considered personal data but with significantly reduced identifiability.

What we truncate:

  • IPv4: 192.168.123.45 → 192.168.0.0 (/16 prefix)
  • IPv6: First 48 bits kept, remaining 80 bits zeroed (/48 prefix)

Where truncation happens: At the Traefik reverse proxy (DoH/HTTPS traffic) and dnsdist proxy (DNS/DoT/DoQ traffic), meaning backend services never see your full IP.

Why not full anonymization? /16 and /48 prefixes can still identify organizations or ISPs, so we're legally accurate by calling it pseudonymization. We're honest about what we do—no marketing fluff.

no forwarding, true recursion

Unlike many DNS services that forward your queries to upstream providers (Google, Cloudflare, etc.), le_dns performs true recursive resolution:

Why this matters:

When a DNS service forwards queries, the upstream provider sees all your DNS traffic. By performing true recursion, we ensure that only the authoritative servers for each domain see the query for their specific domain - and they only see our server's IP, not yours.

high availability & redundancy

le_dns runs on multiple independent servers across different locations:

built on open source

We trust what we can verify:

Every component in our stack is open source, audited by the community, and trusted by thousands of organizations worldwide.

what we don't do

For complete transparency, here's what we explicitly don't do:

contact & reports

If you discover a security vulnerability or have concerns about our practices: