Privacy Policy
dns.catcoderdev.com — private DNS resolver · last updated 2026-07-28
What this service is
A personal DNS resolver intended exclusively for the operator's own devices and household. It answers DNS queries over DNS-over-TLS (port 853) and, for the local network only, plain DNS (port 53). It offers no accounts, no tracking, and no commercial use of any data.
What is NOT collected
- No query logs. DNS queries are never logged: per-domain query and reply logging is disabled in the resolver configuration. There is no record of which domains any client asked for.
- No client database. No IP addresses, device identifiers, or usage profiles are stored anywhere.
- No cookies or analytics. This stats page is a static file; it sets no cookies and calls no third-party services.
What exists in memory only
The resolver keeps aggregate counters (total queries, cache hits, blocked answers, memory use) and a short-lived answer cache (1 h to 24 h per record). Both are stored only in memory. Restarting the resolver permanently resets every counter and immediately discards the in-memory DNS cache. The stats shown on the main page are those counters — numbers, never domains or client addresses.
Runtime-only statistics
The counters published on this website are generated directly from Unbound's internal runtime statistics. They represent anonymous aggregate values such as cache hits, total queries and memory usage. No information about individual DNS requests, client addresses or queried domains is available from these counters.
Upstream
Queries that cannot be answered locally or from cache are forwarded over encrypted TLS to NextDNS, which applies its own filtering profile and privacy policy. Domains matching the locally loaded blocklist (HaGeZi Pro) are answered locally with NXDOMAIN and never leave the server.
Temporary diagnostics
For debugging, the operator may temporarily enable query logging. Such logs go to the container's rotated output (30 MB hard cap, hours of retention at most), are used only to diagnose the issue at hand, and logging is switched off afterwards.
Access
The resolver accepts encrypted DoT connections rate-limited per source address. The plain DNS port and this stats page are reachable from the local network only. Certificates are issued by Let's Encrypt.