GraceDNSHow to connect#
Every GraceDNS configuration has an id (configid in the examples below, shown in your configuration's settings). There are three ways to send DNS queries to us, and each one carries that id differently. Pick the one that matches where you want protection.
DNS over TLS: id in the hostname#
Best for Android and modern routers. Your queries travel encrypted on port 853, and your configuration id rides in the server name itself: <configid>.dns.gracedns.eu. Nothing else to set up, works on any network, immune to IP address changes.
Guides: Android Private DNS, Router setup (the encrypted DNS section).
DNS over HTTPS: id in the URL#
Best for browsers and Apple devices. Your queries travel as encrypted HTTPS requests to https://dns.gracedns.eu/<configid>. Like DNS over TLS, the id is part of the connection, so it works anywhere and survives IP changes. Browsers accept the URL directly; iPhone, iPad and Mac use it inside a configuration profile.
Guides: Browser setup, iOS and macOS setup.
Plain DNS: id from your linked IP address#
Best for routers and networks that only speak classic DNS (port 53). Classic DNS carries no id, so you link your network's public IP address (or range) to your configuration instead, and every query arriving from it gets your rules. Simple and universal, but unencrypted, and it needs an update when your public IP changes.
Guide: Router setup. Linking is described under Network rules.
Which one wins when several apply#
If a query could match more than one method, GraceDNS picks the most specific: an id in the DNS over HTTPS URL first, then the id in the DNS over TLS hostname, then your linked IP range. Queries that match none of these get a neutral default configuration, so an unrecognized device is never accidentally filtered by someone else's rules.
Back to docs.