GraceDNSRouter setup#
Setting GraceDNS on your router protects every device on your network at once: phones, laptops, smart TVs, consoles and IoT devices, with nothing to install on each one.
How it works#
Most routers only speak classic DNS (port 53), which carries no configuration id. GraceDNS identifies your network by its public IP address instead: you link your network's IP range to your configuration, and every query arriving from it gets your rules.
Steps#
- Find your network's public IPv4 address (your router's status page shows it, or search "what is my IP").
- In your GraceDNS configuration, add that address as a linked client IP (a single address is fine; use a range if your provider gives you one).
- On your router's admin page, find the DNS server setting. It is usually under Internet, WAN or DHCP settings.
- Set the DNS server to the GraceDNS resolver address shown in your configuration's setup panel, and remove any other DNS servers so traffic cannot fall back around the filter.
- Renew the DHCP lease on a device (or reboot it) and test: visit a domain on your denylist; it should no longer resolve.
Dynamic IP addresses#
Home connections often change their public IP. If your IP changes, queries from your network fall back to the default (unfiltered baseline) configuration until you update the linked IP. Options:
- Update the linked IP via the API (it is one call, easy to automate from a script on your router or a Raspberry Pi).
- Prefer per-device encrypted DNS where possible: Android Private DNS and browser DoH carry your configuration id in the connection itself and are immune to IP changes.
Routers with encrypted DNS support#
If your router supports DNS over TLS (recent Fritz!Box, OpenWrt, pfSense, OPNsense, Unifi), use it instead of plain DNS: set the DoT server name to <configid>.dns.gracedns.eu. This both encrypts your queries and identifies your configuration without any IP linking.
Make the filter stick (optional but recommended)#
Devices and apps with hardcoded DNS can bypass your router's setting. To enforce the filter, add firewall rules that block outbound TCP/UDP port 53 to any destination except your router. See What DNS filtering cannot do for the honest limits of enforcement.
Back to docs.