DNSao - Quick and Private DNS Forwadder

Published on November 15, 2025

Just a quick post to show one of my latest projects, DNSao.

After running Pi-hole a few years as my home dns server, there were two things that bothered me in how it worked:

1. no way to send queries upstream in a private protocol: pi-hole is great for blocking unwanted dns queries, but it only supports open udp queries to upstream servers. That means that your ISP (or any middle agent) can sniff your queries, they are plain to be checked. Yes, you can use something like cloudflared to enable a more private setup, but it only means that you need a second service to run and monitor

2. no native way to share config between two pi-hole instances: if you want to setup two pi-holes to have a more reliable dns resolver, you have to rely on third-party tools to enable a sane config replication. I only want to share the block lists and local mappings, but even that demands a separate “sync” process

So, I built my own.

DNSao supports DoH, DoT and plain udp queries upstream. It also exposes a HTTP endpoint for local http queries. And all configuration lives in an YML file, so you can setup any number of instances without having to worry about more than one service for dns in your network: if DNSao is running, everything is okay.

It also contains a robust cache, out-of-the-box cache rewarm, parallel multiple upstreams querying, dnssec aware policies and more.

Check here for the docs, and here on how to install and run. And, if you use it, please, share with me your feedback.