GoyDNS signs hosted zones. It is still authoritative only. Transports below do not turn this box into a recursor. Other names are refused.

Nameservers

At the registrar, set NS to:

ns1.goydns.com
ns2.goydns.com

Both names point at this machine today so registrar forms that want two NS hosts can be filled. Glue for those names is on goydns.com.

DNSSEC

Member zones are signed (ECDSAP256SHA256, NSEC3). Each zone page shows CDS to paste as DS at the parent. Until DS is in the parent, validating resolvers may SERVFAIL; most stub users still see the A record.

For goydns.com itself, DS has to be added at the registrar (Namecheap Advanced DNS, add DS, not "enable DNSSEC" for BasicDNS).

Plain DNS

ns1.goydns.com / 185.130.44.71 UDP and TCP 53

DNS-over-TLS (DoT)

TLS on port 853. Use the nameserver name so the certificate matches:

tls://ns1.goydns.com
tls://ns2.goydns.com

Still authoritative only. Useful if your stub or forwarder can pin a TLS NS. Not a public recursor.

DNS-over-HTTPS (DoH)

RFC 8484, GET or POST, application/dns-message:

https://goydns.com/dns-query

Same answers as port 53. No query logs. No session cookies. Queries for names we do not host are refused.

Oblivious DNS-over-HTTPS (ODoH)

ODoH is a privacy protocol for recursive resolvers: a relay hides your IP from the resolver. GoyDNS is not a recursor and does not run an ODoH relay or proxy. We will not add a public recursive resolver to "support ODoH."

A third-party ODoH relay may use our DoH URL as a target only for names we actually host. That hides the client's IP from us. We still will not recurse, and we still do not log queries.

What we do not run

No public recursor. No "family filter." No query logging. DNS cookies and response-rate limits exist so the authoritative port is harder to use as a cannon. They are not surveillance.